urlscan.io logo urlscan.io
SecurityTrails logo

threatpost.com Open in urlscan Pro
35.173.160.135  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://secure-web.cisco.com/1jYXQgafoCfoVvSCPL5Qlci3vyA8VjcsMyFdxPFByLLxF1eMzKAXhg9IZFwGv5ale0RoegoxBt9Ez0gkuXKcugTHIX-pnbJK...
Effective URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%...
Submission: On March 10 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 110 IPs in 8 countries across 96 domains to perform 496 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com. The Cisco Umbrella rank of the primary domain is 152275.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on June 2nd 2021. Valid for: a year.
This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2a04:e4c7:fff... 36692 (OPENDNS)
1 2 2606:2c40::c7... 209242 (CLOUDFLAR...)
34 35.173.160.135 14618 (AMAZON-AES)
9 18.66.139.110 16509 (AMAZON-02)
7 2a00:1450:400... 15169 (GOOGLE)
7 2606:4700:303... 13335 (CLOUDFLAR...)
14 2600:9000:225... 16509 (AMAZON-02)
10 2600:9000:249... 16509 (AMAZON-02)
10 2a00:1450:400... 15169 (GOOGLE)
1 185.85.15.31 200107 (KL-EXT)
5 13.32.119.176 16509 (AMAZON-02)
1 6 151.101.130.137 54113 (FASTLY)
5 2a00:1450:400... 15169 (GOOGLE)
1 3.12.63.132 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
14 142.250.181.226 15169 (GOOGLE)
1 104.111.219.144 16625 (AKAMAI-AS)
1 46.105.202.126 16276 (OVH)
6 2a00:1450:400... 15169 (GOOGLE)
4 7 2620:116:800d... 16509 (AMAZON-02)
1 199.232.136.157 54113 (FASTLY)
3 52.215.111.225 16509 (AMAZON-02)
1 2600:9000:223... 16509 (AMAZON-02)
2 51.195.5.38 16276 (OVH)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
1 151.101.66.137 54113 (FASTLY)
9 18.216.183.199 16509 (AMAZON-02)
6 151.101.2.137 54113 (FASTLY)
4 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 34.255.107.204 16509 (AMAZON-02)
2 13.36.218.177 16509 (AMAZON-02)
1 1 54.75.68.230 16509 (AMAZON-02)
2 7 134.209.129.254 14061 (DIGITALOC...)
1 19 35.244.159.8 15169 (GOOGLE)
1 18.185.181.98 16509 (AMAZON-02)
3 12 37.252.173.62 29990 (ASN-APPNEX)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 3 147.75.38.124 54825 (PACKET)
3 52.29.1.115 16509 (AMAZON-02)
3 185.64.189.112 62713 (AS-PUBMATIC)
4 2602:803:c003... 26667 (RUBICONPR...)
5 213.19.147.42 3356 (LEVEL3)
1 3 72.251.249.14 29791 (VOXEL-DOT...)
3 184.31.84.150 16625 (AKAMAI-AS)
3 18.156.195.47 16509 (AMAZON-02)
10 52.215.175.9 16509 (AMAZON-02)
1 104.244.42.133 13414 (TWITTER)
1 64.140.160.2 18450 (WEBNX)
1 104.244.42.131 13414 (TWITTER)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
32 2a00:1450:400... 15169 (GOOGLE)
1 3.122.136.79 16509 (AMAZON-02)
2 3 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
3 5 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 2 142.250.185.230 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
18 2a00:1450:400... 15169 (GOOGLE)
11 2a00:1450:400... 15169 (GOOGLE)
3 2600:1901:0:7... 15169 (GOOGLE)
36 2606:4700:20:... 13335 (CLOUDFLAR...)
1 34.98.67.61 15169 (GOOGLE)
4 35.186.253.211 15169 (GOOGLE)
6 6 104.36.113.23 62713 (AS-PUBMATIC)
4 26 142.250.186.130 15169 (GOOGLE)
5 7 69.173.144.165 26667 (RUBICONPR...)
3 2a05:d01c:1d8... 16509 (AMAZON-02)
2 2 146.59.70.99 16276 (OVH)
3 2606:4700:20:... 13335 (CLOUDFLAR...)
6 2606:4700:20:... 13335 (CLOUDFLAR...)
12 12 84.200.5.215 31400 (ACCELERAT...)
3 78.46.85.162 24940 (HETZNER-AS)
3 46.4.41.145 24940 (HETZNER-AS)
3 104.111.239.217 16625 (AKAMAI-AS)
1 2 2a02:2638:1::13 44788 (ASN-CRITE...)
2 178.250.0.157 44788 (ASN-CRITE...)
3 2.18.232.130 16625 (AKAMAI-AS)
2 8 2.18.234.21 16625 (AKAMAI-AS)
5 2.18.233.180 16625 (AKAMAI-AS)
3 4 151.101.66.49 54113 (FASTLY)
6 6 3.127.158.112 16509 (AMAZON-02)
5 8 18.156.0.31 16509 (AMAZON-02)
6 11 3.33.220.150 16509 (AMAZON-02)
3 3 185.29.132.241 30419 (MEDIAMATH...)
4 4 37.157.2.234 198622 (ADFORM)
3 6 13.248.245.213 16509 (AMAZON-02)
1 1 165.227.252.242 14061 (DIGITALOC...)
1 205.185.216.42 20446 (STACKPATH...)
1 2620:1ec:46::44 8068 (MICROSOFT...)
6 104.109.78.125 16625 (AKAMAI-AS)
3 4 2a05:d018:d29... 16509 (AMAZON-02)
2 2 18.196.197.61 16509 (AMAZON-02)
5 6 3.121.19.101 16509 (AMAZON-02)
2 2 3.121.94.129 16509 (AMAZON-02)
1 52.31.32.190 16509 (AMAZON-02)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
5 9 209.54.180.144 16509 (AMAZON-02)
3 3 64.202.112.159 23352 (SERVERCEN...)
1 14 18.202.206.42 16509 (AMAZON-02)
2 67.202.105.22 32748 (STEADFAST)
1 51.75.86.98 16276 (OVH)
2 185.86.137.107 201081 (SMARTADSE...)
1 1 72.251.249.9 29791 (VOXEL-DOT...)
8 10 213.19.147.44 26120 (RHYTHMONE)
1 3.211.211.136 14618 (AMAZON-AES)
1 1 193.0.160.128 54312 (ROCKETFUEL)
3 178.162.133.149 60781 (LEASEWEB-...)
1 192.132.33.46 ()
1 1 34.111.151.213 15169 (GOOGLE)
4 4 69.173.144.138 26667 (RUBICONPR...)
1 35.244.174.68 15169 (GOOGLE)
2 3 52.95.126.160 16509 (AMAZON-02)
1 3 185.86.139.115 201081 (SMARTADSE...)
1 1 23.88.75.189 24940 (HETZNER-AS)
1 1 37.252.172.249 29990 (ASN-APPNEX)
1 1 47.252.78.131 ()
3 3 64.202.112.95 ()
1 1 34.205.3.24 ()
1 1 34.203.25.60 ()
1 150.136.26.45 ()
1 169.197.150.8 398989 (DEEPINTENT)
1 1 104.111.215.191 ()
2 2 34.255.38.72 16509 (AMAZON-02)
2 34.240.27.36 16509 (AMAZON-02)
1 1 198.148.27.139 ()
2 2 2.19.35.65 16625 (AKAMAI-AS)
2 18.195.155.181 16509 (AMAZON-02)
1 1 124.146.215.45 ()
2 2 185.184.8.65 204995 (RTB-HOUSE...)
1 178.162.133.148 60781 (LEASEWEB-...)
2 2 35.170.180.116 ()
1 2600:1f18:444... ()
1 69.173.151.100 ()
496 110
1    2a04:e4c7:ffff::69 (United States)

ASN36692 (OPENDNS, US)
secure-web.cisco.com
2    2606:2c40::c73c:67e1 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
marketing.reversinglabs.com
34    35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com
threatpost.com
kasperskycontenthub.com
9    18.66.139.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-139-110.fra60.r.cloudfront.net
tagan.adlightning.com
7    2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
7    2606:4700:3031::6815:456d (United States)

ASN13335 (CLOUDFLARENET, US)
qd.admetricspro.com
14    2600:9000:2250:4e00:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)
assets.threatpost.com
10    2600:9000:2490:5a00:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)
media.threatpost.com
10    2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    185.85.15.31 (Germany)

ASN200107 (KL-EXT, CH)
media.kaspersky.com
5    13.32.119.176 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-119-176.fra60.r.cloudfront.net
c.amazon-adsystem.com
6    151.101.130.137 (United States)

ASN54113 (FASTLY, US)
cd.connatix.com
cds.connatix.com
img.connatix.com
5    2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    3.12.63.132 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-12-63-132.us-east-2.compute.amazonaws.com
capi.connatix.com
2    2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
14    142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net
securepubads.g.doubleclick.net
partner.googleadservices.com
1    104.111.219.144 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-219-144.deploy.static.akamaitechnologies.com
secure.cdn.fastclick.net
1    46.105.202.126 (France)

ASN16276 (OVH, FR)
cdn.id5-sync.com
6    2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
7    2620:116:800d:21:51e4:db4b:4436:b305 (United States)

ASN16509 (AMAZON-02, US)
secure.quantserve.com
pixel.quantserve.com
cms.quantserve.com
1    199.232.136.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
3    52.215.111.225 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-111-225.eu-west-1.compute.amazonaws.com
dpm.demdex.net
1    2600:9000:223c:0:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
2    51.195.5.38 (France)

ASN16276 (OVH, FR)
PTR: p16.id5-sync.com
id5-sync.com
2    2606:4700:20::ac43:4bf1 (United States)

ASN13335 (CLOUDFLARENET, US)
script.4dex.io
1    151.101.66.137 (United States)

ASN54113 (FASTLY, US)
lit.connatix.com
9    18.216.183.199 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-216-183-199.us-east-2.compute.amazonaws.com
capi-tier-2-us-east-2.connatix.com
6    151.101.2.137 (United States)

ASN54113 (FASTLY, US)
vid.connatix.com
4    2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
imasdk.googleapis.com
2    2a00:1450:400c:c07::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    34.255.107.204 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-255-107-204.eu-west-1.compute.amazonaws.com
kaspersky.demdex.net
2    13.36.218.177 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-36-218-177.eu-west-3.compute.amazonaws.com
kaspersky.d3.sc.omtrdc.net
1    54.75.68.230 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-75-68-230.eu-west-1.compute.amazonaws.com
cm.everesttech.net
7    134.209.129.254 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
e.serverbid.com
19    35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com
teachingaids-d.openx.net
u.openx.net
eu-u.openx.net
us-u.openx.net
gift-connect-d.openx.net
1    18.185.181.98 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-185-181-98.eu-central-1.compute.amazonaws.com
tlx.3lift.com
12    37.252.173.62 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
ib.adnxs.com
1    2606:4700::6812:272 (United States)

ASN13335 (CLOUDFLARENET, US)
mp.4dex.io
3    147.75.38.124 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
prebid.a-mo.net
3    52.29.1.115 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-1-115.eu-central-1.compute.amazonaws.com
btlr.sharethrough.com
3    185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
4    2602:803:c003:200::61 (Amsterdam, Netherlands)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
5    213.19.147.42 (United Kingdom)

ASN3356 (LEVEL3, US)
tag.1rx.io
3    72.251.249.14 (Amsterdam, Netherlands)

ASN29791 (VOXEL-DOT-NET, US)
ap.lijit.com
3    184.31.84.150 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-31-84-150.deploy.static.akamaitechnologies.com
htlb.casalemedia.com
3    18.156.195.47 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
c2shb.ssp.yahoo.com
10    52.215.175.9 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-175-9.eu-west-1.compute.amazonaws.com
ads.servenobid.com
1    104.244.42.133 (United States)

ASN13414 (TWITTER, US)
t.co
1    64.140.160.2 (Ogden, United States)

ASN18450 (WEBNX, US)
PTR: threatintelligenceplatform.com
geo.ipify.org
1    104.244.42.131 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
2    2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    2a00:1450:4001:828::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
s0.2mdn.net
32    2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
1    3.122.136.79 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-122-136-79.eu-central-1.compute.amazonaws.com
ads.adaptv.advertising.com
3    2606:4700::6810:7baf (United States)

ASN13335 (CLOUDFLARENET, US)
unpkg.com
1    2a02:26f0:6c00::210:ba20 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
5    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
2    142.250.185.230 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f6.1e100.net
9582686.fls.doubleclick.net
1    2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
5    2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
1    2a00:1450:4001:808::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
59bf77f101e2a5c2e3c052a9c0f9547d.safeframe.googlesyndication.com
18    2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
11    2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
googleads.g.doubleclick.net
3    2600:1901:0:76b9:: (Kansas City, United States)

ASN15169 (GOOGLE, US)
prod-rtb.ad4mat.net
36    2606:4700:20::681a:ad1 (United States)

ASN13335 (CLOUDFLARENET, US)
as.ad4m.at
ad4m.at
assets.ad4m.at
1    34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com
odr.mookie1.com
4    35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com
rtb.openx.net
6    104.36.113.23 (United States)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
26    142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net
cm.g.doubleclick.net
7    69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
3    2a05:d01c:1d8:8102:d28c:83ad:1b58:a2c4 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
ag.innovid.com
2    146.59.70.99 (France)

ASN16276 (OVH, FR)
PTR: ns3210071.ip-146-59-70.eu
googlecm.hit.gemius.pl
3    2606:4700:20::681a:71b (United States)

ASN13335 (CLOUDFLARENET, US)
static-de.ad4mat.net
6    2606:4700:20::681a:bd1 (United States)

ASN13335 (CLOUDFLARENET, US)
ad4m.at
12    84.200.5.215 (Germany)

ASN31400 (ACCELERATED-IT, DE)
www.telefonica-partner.de
www.lead-alliance.net
3    78.46.85.162 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: nonstopads1.sunbonet.de
partner.o2online.de
3    46.4.41.145 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: nonstopads2.sunbonet.de
partner.blau.de
3    104.111.239.217 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-239-217.deploy.static.akamaitechnologies.com
www.awin1.com
2    2a02:2638:1::13 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
gum.criteo.com
2    178.250.0.157 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
mug.criteo.com
3    2.18.232.130 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-130.deploy.static.akamaitechnologies.com
acdn.adnxs.com
8    2.18.234.21 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com
js-sec.indexww.com
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
5    2.18.233.180 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-180.deploy.static.akamaitechnologies.com
ads.pubmatic.com
4    151.101.66.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
6    3.127.158.112 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-127-158-112.eu-central-1.compute.amazonaws.com
pixel.advertising.com
8    18.156.0.31 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
11    3.33.220.150 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com
match.adsrvr.org
3    185.29.132.241 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
4    37.157.2.234 (Denmark)

ASN198622 (ADFORM, DK)
c1.adform.net
6    13.248.245.213 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com
eb2.3lift.com
1    165.227.252.242 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
sync.serverbid.com
1    205.185.216.42 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map2.hwcdn.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1    2620:1ec:46::44 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
public.servenobid.com
6    104.109.78.125 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-109-78-125.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
4    2a05:d018:d29:3602:c713:d832:3f91:5c2a (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
pr-bh.ybp.yahoo.com
2    18.196.197.61 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-197-61.eu-central-1.compute.amazonaws.com
pm.w55c.net
6    3.121.19.101 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-121-19-101.eu-central-1.compute.amazonaws.com
x.bidswitch.net
2    3.121.94.129 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-121-94-129.eu-central-1.compute.amazonaws.com
ads.creative-serving.com
1    52.31.32.190 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-32-190.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
2    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
9    209.54.180.144 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
3    64.202.112.159 (Leesburg, United States)

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com
b1sync.zemanta.com
14    18.202.206.42 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
g2.gumgum.com
rtb.gumgum.com
2    67.202.105.22 (United States)

ASN32748 (STEADFAST, US)
PTR: ip22.67-202-105.static.steadfastdns.net
pixel.33across.com
ssc-cms.33across.com
1    51.75.86.98 (France)

ASN16276 (OVH, FR)
PTR: ip98.ip-51-75-86.eu
onetag-sys.com
2    185.86.137.107 (France)

ASN201081 (SMARTADSERVER, FR)
ssbsync.smartadserver.com
1    72.251.249.9 (Amsterdam, Netherlands)

ASN29791 (VOXEL-DOT-NET, US)
ce.lijit.com
10    213.19.147.44 (United Kingdom)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
sync.targeting.unrulymedia.com
1    3.211.211.136 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-211-211-136.compute-1.amazonaws.com
jadserve.postrelease.com
1    193.0.160.128 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
3    178.162.133.149 (Rijswijk, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-sync.go.sonobi.com
sync.go.sonobi.com
1    192.132.33.46 (None, )

ASN- ()
bttrack.com
1    34.111.151.213 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 213.151.111.34.bc.googleusercontent.com
dmp.brand-display.com
4    69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
token.rubiconproject.com
1    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com
3    52.95.126.160 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
aax-eu.amazon-adsystem.com
3    185.86.139.115 (France)

ASN201081 (SMARTADSERVER, FR)
rtb-csync.smartadserver.com
1    23.88.75.189 (Gunzenhausen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.189.75.88.23.clients.your-server.de
csync.loopme.me
1    37.252.172.249 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
secure.adnxs.com
1    47.252.78.131 (None, )

ASN- ()
event.clientgear.com
3    64.202.112.95 (None, )

ASN- ()
sync.outbrain.com
1    34.205.3.24 (None, )

ASN- ()
sync.srv.stackadapt.com
1    34.203.25.60 (None, )

ASN- ()
sync.ipredictive.com
1    150.136.26.45 (None, )

ASN- ()
sync.technoratimedia.com
1    169.197.150.8 (United States)

ASN398989 (DEEPINTENT, US)
PTR: g.deepintent.com
match.deepintent.com
1    104.111.215.191 (None, )

ASN- ()
stags.bluekai.com
2    34.255.38.72 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-255-38-72.eu-west-1.compute.amazonaws.com
ad.360yield.com
2    34.240.27.36 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-240-27-36.eu-west-1.compute.amazonaws.com
usersync.gumgum.com
1    198.148.27.139 (None, )

ASN- ()
bh.contextweb.com
2    2.19.35.65 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-35-65.deploy.static.akamaitechnologies.com
secure-assets.rubiconproject.com
2    18.195.155.181 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
cs.emxdgt.com
1    124.146.215.45 (None, )

ASN- ()
tg.socdm.com
2    185.184.8.65 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-65.rtbhouse.net
creativecdn.com
1    178.162.133.148 (Rijswijk, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1.go.sonobi.com
go.sonobi.com
2    35.170.180.116 (None, )

ASN- ()
i.liadm.com
1    2600:1f18:444a:4602:2c20:3113:5c28:1366 (None, )

ASN- ()
i6.liadm.com
1    69.173.151.100 (None, )

ASN- ()
pixel-us-east.rubiconproject.com
Apex Domain
Subdomains		 Transfer
56 threatpost.com
threatpost.com — Cisco Umbrella Rank: 152275
assets.threatpost.com — Cisco Umbrella Rank: 415104
media.threatpost.com — Cisco Umbrella Rank: 280247
823 KB
51 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 90
59bf77f101e2a5c2e3c052a9c0f9547d.safeframe.googlesyndication.com
tpc.googlesyndication.com — Cisco Umbrella Rank: 122
684 KB
48 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 159
stats.g.doubleclick.net — Cisco Umbrella Rank: 68
9582686.fls.doubleclick.net — Cisco Umbrella Rank: 289584
googleads.g.doubleclick.net — Cisco Umbrella Rank: 38
cm.g.doubleclick.net — Cisco Umbrella Rank: 176
222 KB
42 ad4m.at
as.ad4m.at — Cisco Umbrella Rank: 2174
ad4m.at — Cisco Umbrella Rank: 1742
assets.ad4m.at — Cisco Umbrella Rank: 32740
2 MB
24 rubiconproject.com
fastlane.rubiconproject.com — Cisco Umbrella Rank: 412
pixel.rubiconproject.com — Cisco Umbrella Rank: 289
eus.rubiconproject.com — Cisco Umbrella Rank: 503
token.rubiconproject.com — Cisco Umbrella Rank: 595
secure-assets.rubiconproject.com — Cisco Umbrella Rank: 944
pixel-us-east.rubiconproject.com
42 KB
23 openx.net
teachingaids-d.openx.net — Cisco Umbrella Rank: 17237
rtb.openx.net — Cisco Umbrella Rank: 1359
u.openx.net — Cisco Umbrella Rank: 621
eu-u.openx.net — Cisco Umbrella Rank: 1751
us-u.openx.net — Cisco Umbrella Rank: 323
gift-connect-d.openx.net — Cisco Umbrella Rank: 11553
4 KB
23 connatix.com
cd.connatix.com — Cisco Umbrella Rank: 3021
cds.connatix.com — Cisco Umbrella Rank: 3082
capi.connatix.com — Cisco Umbrella Rank: 2633
lit.connatix.com — Cisco Umbrella Rank: 6531
capi-tier-2-us-east-2.connatix.com
vid.connatix.com — Cisco Umbrella Rank: 3623
img.connatix.com — Cisco Umbrella Rank: 3711
2 MB
17 amazon-adsystem.com
c.amazon-adsystem.com — Cisco Umbrella Rank: 275
s.amazon-adsystem.com — Cisco Umbrella Rank: 260
aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 1352
50 KB
16 gumgum.com
g2.gumgum.com — Cisco Umbrella Rank: 1487
rtb.gumgum.com — Cisco Umbrella Rank: 991
usersync.gumgum.com — Cisco Umbrella Rank: 4784
5 KB
16 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 205
acdn.adnxs.com — Cisco Umbrella Rank: 523
secure.adnxs.com — Cisco Umbrella Rank: 359
62 KB
15 yahoo.com
c2shb.ssp.yahoo.com — Cisco Umbrella Rank: 682
ups.analytics.yahoo.com — Cisco Umbrella Rank: 268
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 416
6 KB
15 google.com
www.google.com — Cisco Umbrella Rank: 2
adservice.google.com — Cisco Umbrella Rank: 57
5 KB
14 pubmatic.com
hbopenbid.pubmatic.com — Cisco Umbrella Rank: 417
image6.pubmatic.com — Cisco Umbrella Rank: 571
ads.pubmatic.com — Cisco Umbrella Rank: 419
32 KB
12 1rx.io
tag.1rx.io — Cisco Umbrella Rank: 1169
sync.1rx.io — Cisco Umbrella Rank: 491
4 KB
11 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 293
4 KB
11 servenobid.com
ads.servenobid.com — Cisco Umbrella Rank: 1811
public.servenobid.com — Cisco Umbrella Rank: 3714
8 KB
9 adlightning.com
tagan.adlightning.com — Cisco Umbrella Rank: 1314
202 KB
8 casalemedia.com
htlb.casalemedia.com — Cisco Umbrella Rank: 409
ssum-sec.casalemedia.com — Cisco Umbrella Rank: 476
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 496
dsum.casalemedia.com — Cisco Umbrella Rank: 1197
8 KB
8 serverbid.com
e.serverbid.com — Cisco Umbrella Rank: 2774
sync.serverbid.com — Cisco Umbrella Rank: 5262
1 KB
7 advertising.com
ads.adaptv.advertising.com — Cisco Umbrella Rank: 1091
pixel.advertising.com — Cisco Umbrella Rank: 307
2 KB
7 google.de
www.google.de — Cisco Umbrella Rank: 6433
adservice.google.de — Cisco Umbrella Rank: 8832
2 KB
7 3lift.com
tlx.3lift.com — Cisco Umbrella Rank: 512
eb2.3lift.com — Cisco Umbrella Rank: 346
3 KB
7 quantserve.com
secure.quantserve.com — Cisco Umbrella Rank: 839
pixel.quantserve.com — Cisco Umbrella Rank: 381
cms.quantserve.com — Cisco Umbrella Rank: 929
12 KB
7 admetricspro.com
qd.admetricspro.com — Cisco Umbrella Rank: 18070
323 KB
7 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 147
241 KB
6 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 257
3 KB
6 lead-alliance.net
www.lead-alliance.net — Cisco Umbrella Rank: 46354
2 KB
6 telefonica-partner.de
www.telefonica-partner.de — Cisco Umbrella Rank: 48610
2 KB
6 ad4mat.net
prod-rtb.ad4mat.net — Cisco Umbrella Rank: 91678
static-de.ad4mat.net — Cisco Umbrella Rank: 128562
11 KB
6 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 434
www.linkedin.com — Cisco Umbrella Rank: 609
px4.ads.linkedin.com — Cisco Umbrella Rank: 5153
4 KB
6 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 31
40 KB
5 smartadserver.com
ssbsync.smartadserver.com — Cisco Umbrella Rank: 1266
rtb-csync.smartadserver.com — Cisco Umbrella Rank: 603
2 KB
5 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 878
sync-tm.everesttech.net — Cisco Umbrella Rank: 490
1 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 54
380 KB
4 sonobi.com
sync.go.sonobi.com — Cisco Umbrella Rank: 843
go.sonobi.com — Cisco Umbrella Rank: 680
2 KB
4 adform.net
c1.adform.net — Cisco Umbrella Rank: 524
2 KB
4 criteo.com
gum.criteo.com — Cisco Umbrella Rank: 347
mug.criteo.com — Cisco Umbrella Rank: 3185
1 KB
4 lijit.com
ap.lijit.com — Cisco Umbrella Rank: 594
ce.lijit.com — Cisco Umbrella Rank: 734
2 KB
4 googleapis.com
imasdk.googleapis.com — Cisco Umbrella Rank: 399
696 KB
4 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 184
kaspersky.demdex.net — Cisco Umbrella Rank: 215069
5 KB
3 liadm.com
i.liadm.com
i6.liadm.com
1 KB
3 outbrain.com
sync.outbrain.com
1017 B
3 unrulymedia.com
sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 829
1 KB
3 zemanta.com
b1sync.zemanta.com — Cisco Umbrella Rank: 528
2 KB
3 mathtag.com
sync.mathtag.com — Cisco Umbrella Rank: 384
2 KB
3 indexww.com
js-sec.indexww.com — Cisco Umbrella Rank: 604
5 KB
3 awin1.com
www.awin1.com — Cisco Umbrella Rank: 13937
2 KB
3 blau.de
partner.blau.de — Cisco Umbrella Rank: 58770
4 KB
3 o2online.de
partner.o2online.de — Cisco Umbrella Rank: 51158
5 KB
3 innovid.com
ag.innovid.com — Cisco Umbrella Rank: 1391
887 B
3 googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 716
353 B
3 unpkg.com
unpkg.com — Cisco Umbrella Rank: 821
2 KB
3 sharethrough.com
btlr.sharethrough.com — Cisco Umbrella Rank: 989
337 B
3 a-mo.net
prebid.a-mo.net — Cisco Umbrella Rank: 1055
807 B
3 4dex.io
script.4dex.io — Cisco Umbrella Rank: 1689
mp.4dex.io — Cisco Umbrella Rank: 2262
24 KB
3 id5-sync.com
cdn.id5-sync.com — Cisco Umbrella Rank: 1490
id5-sync.com — Cisco Umbrella Rank: 488
12 KB
2 creativecdn.com
creativecdn.com — Cisco Umbrella Rank: 614
695 B
2 emxdgt.com
cs.emxdgt.com — Cisco Umbrella Rank: 806
2 360yield.com
ad.360yield.com — Cisco Umbrella Rank: 630
623 B
2 33across.com
pixel.33across.com — Cisco Umbrella Rank: 2310
ssc-cms.33across.com
2 bing.com
c.bing.com — Cisco Umbrella Rank: 193
766 B
2 creative-serving.com
ads.creative-serving.com — Cisco Umbrella Rank: 3287
1 KB
2 w55c.net
pm.w55c.net — Cisco Umbrella Rank: 730
1 KB
2 gemius.pl
googlecm.hit.gemius.pl — Cisco Umbrella Rank: 7401
502 B
2 omtrdc.net
kaspersky.d3.sc.omtrdc.net — Cisco Umbrella Rank: 205395
560 B
2 gstatic.com
www.gstatic.com
283 KB
2 kasperskycontenthub.com
kasperskycontenthub.com — Cisco Umbrella Rank: 320047
1 KB
2 reversinglabs.com
marketing.reversinglabs.com
4 KB
1 socdm.com
tg.socdm.com
688 B
1 contextweb.com
bh.contextweb.com
382 B
1 bluekai.com
stags.bluekai.com
1 KB
1 deepintent.com
match.deepintent.com — Cisco Umbrella Rank: 813
44 B
1 technoratimedia.com
sync.technoratimedia.com
293 B
1 ipredictive.com
sync.ipredictive.com
428 B
1 stackadapt.com
sync.srv.stackadapt.com
588 B
1 clientgear.com
event.clientgear.com
263 B
1 loopme.me
csync.loopme.me — Cisco Umbrella Rank: 908
242 B
1 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 565
1 brand-display.com
dmp.brand-display.com — Cisco Umbrella Rank: 1624
318 B
1 bttrack.com
bttrack.com
380 B
1 rfihub.com
p.rfihub.com — Cisco Umbrella Rank: 631
749 B
1 postrelease.com
jadserve.postrelease.com — Cisco Umbrella Rank: 935
427 B
1 onetag-sys.com
onetag-sys.com — Cisco Umbrella Rank: 797
814 B
1 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 462
430 B
1 digitaloceanspaces.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com — Cisco Umbrella Rank: 6046
5 KB
1 mookie1.com
odr.mookie1.com — Cisco Umbrella Rank: 794
324 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 799
3 KB
1 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 246
17 KB
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 464
459 B
1 ipify.org
geo.ipify.org — Cisco Umbrella Rank: 37428
627 B
1 t.co
t.co — Cisco Umbrella Rank: 448
336 B
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 792
353 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 531
6 KB
1 fastclick.net
secure.cdn.fastclick.net — Cisco Umbrella Rank: 1623
17 KB
1 kaspersky.com
media.kaspersky.com — Cisco Umbrella Rank: 98638
48 KB
1 cisco.com
secure-web.cisco.com — Cisco Umbrella Rank: 12674
493 B
496 96
Domain Requested by
32 pagead2.googlesyndication.com srcdoc
securepubads.g.doubleclick.net
tpc.googlesyndication.com
tagan.adlightning.com
pagead2.googlesyndication.com
googleads.g.doubleclick.net
www.googletagservices.com
32 threatpost.com marketing.reversinglabs.com
threatpost.com
26 cm.g.doubleclick.net 4 redirects googleads.g.doubleclick.net
u.openx.net
eb2.3lift.com
ssum-sec.casalemedia.com
g2.gumgum.com
18 assets.ad4m.at as.ad4m.at
18 tpc.googlesyndication.com tagan.adlightning.com
googleads.g.doubleclick.net
14 assets.threatpost.com threatpost.com
assets.threatpost.com
13 rtb.gumgum.com 1 redirects g2.gumgum.com
12 ad4m.at as.ad4m.at
ad4m.at
12 as.ad4m.at googleads.g.doubleclick.net
as.ad4m.at
ad4m.at
12 ib.adnxs.com 3 redirects qd.admetricspro.com
cds.connatix.com
acdn.adnxs.com
11 match.adsrvr.org 6 redirects u.openx.net
eb2.3lift.com
ssum-sec.casalemedia.com
11 securepubads.g.doubleclick.net tagan.adlightning.com
www.googletagservices.com
securepubads.g.doubleclick.net
threatpost.com
10 ads.servenobid.com qd.admetricspro.com
public.servenobid.com
ssum-sec.casalemedia.com
ssbsync.smartadserver.com
g2.gumgum.com
10 www.google.com threatpost.com
tagan.adlightning.com
googleads.g.doubleclick.net
10 media.threatpost.com threatpost.com
9 s.amazon-adsystem.com 5 redirects eb2.3lift.com
ssum-sec.casalemedia.com
ssbsync.smartadserver.com
9 capi-tier-2-us-east-2.connatix.com cd.connatix.com
9 tagan.adlightning.com threatpost.com
tagan.adlightning.com
8 ups.analytics.yahoo.com 5 redirects
7 sync.1rx.io 7 redirects
7 eu-u.openx.net u.openx.net
qd.admetricspro.com
eu-u.openx.net
7 pixel.rubiconproject.com 5 redirects g2.gumgum.com
7 googleads.g.doubleclick.net tagan.adlightning.com
marketing.reversinglabs.com
googleads.g.doubleclick.net
7 e.serverbid.com 2 redirects qd.admetricspro.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
7 qd.admetricspro.com threatpost.com
qd.admetricspro.com
7 www.googletagservices.com threatpost.com
tagan.adlightning.com
googleads.g.doubleclick.net
6 x.bidswitch.net 5 redirects eb2.3lift.com
6 eus.rubiconproject.com qd.admetricspro.com
eus.rubiconproject.com
g2.gumgum.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
6 eb2.3lift.com 3 redirects qd.admetricspro.com
eb2.3lift.com
6 us-u.openx.net 1 redirects u.openx.net
eu-u.openx.net
6 pixel.advertising.com 6 redirects
6 www.lead-alliance.net 6 redirects
6 www.telefonica-partner.de 6 redirects
6 image6.pubmatic.com 6 redirects
6 vid.connatix.com cd.connatix.com
6 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
threatpost.com
5 ads.pubmatic.com cds.connatix.com
qd.admetricspro.com
g2.gumgum.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
5 adservice.google.com tagan.adlightning.com
9582686.fls.doubleclick.net
5 adservice.google.de tagan.adlightning.com
adservice.google.com
5 tag.1rx.io qd.admetricspro.com
cds.connatix.com
5 www.googletagmanager.com threatpost.com
www.googletagmanager.com
5 c.amazon-adsystem.com qd.admetricspro.com
c.amazon-adsystem.com
4 token.rubiconproject.com 4 redirects
4 pr-bh.ybp.yahoo.com 3 redirects eu-u.openx.net
4 c1.adform.net 4 redirects
4 sync-tm.everesttech.net 3 redirects ssum-sec.casalemedia.com
4 rtb.openx.net googleads.g.doubleclick.net
eu-u.openx.net
4 px.ads.linkedin.com 2 redirects eb2.3lift.com
4 fastlane.rubiconproject.com qd.admetricspro.com
4 imasdk.googleapis.com cd.connatix.com
imasdk.googleapis.com
3 sync.outbrain.com 3 redirects
3 rtb-csync.smartadserver.com 1 redirects ssbsync.smartadserver.com
3 aax-eu.amazon-adsystem.com 2 redirects
3 sync.go.sonobi.com public.servenobid.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
3 sync.targeting.unrulymedia.com 1 redirects ssbsync.smartadserver.com
g2.gumgum.com
3 b1sync.zemanta.com 3 redirects
3 sync.mathtag.com 3 redirects
3 js-sec.indexww.com cds.connatix.com
qd.admetricspro.com
3 acdn.adnxs.com cds.connatix.com
qd.admetricspro.com
3 www.awin1.com as.ad4m.at
3 partner.blau.de as.ad4m.at
3 partner.o2online.de as.ad4m.at
3 static-de.ad4mat.net as.ad4m.at
3 ag.innovid.com googleads.g.doubleclick.net
3 cms.quantserve.com 2 redirects googleads.g.doubleclick.net
3 prod-rtb.ad4mat.net marketing.reversinglabs.com
googleads.g.doubleclick.net
3 partner.googleadservices.com tagan.adlightning.com
3 unpkg.com 2 redirects
3 pixel.quantserve.com 2 redirects threatpost.com
3 c2shb.ssp.yahoo.com qd.admetricspro.com
3 htlb.casalemedia.com qd.admetricspro.com
cds.connatix.com
3 ap.lijit.com 1 redirects qd.admetricspro.com
3 hbopenbid.pubmatic.com qd.admetricspro.com
cds.connatix.com
3 btlr.sharethrough.com qd.admetricspro.com
3 prebid.a-mo.net 1 redirects qd.admetricspro.com
cds.connatix.com
3 teachingaids-d.openx.net qd.admetricspro.com
cds.connatix.com
3 dpm.demdex.net media.kaspersky.com
threatpost.com
ssum-sec.casalemedia.com
3 cds.connatix.com threatpost.com
cd.connatix.com
2 i.liadm.com 2 redirects
2 creativecdn.com 2 redirects
2 cs.emxdgt.com g2.gumgum.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
2 secure-assets.rubiconproject.com 2 redirects
2 usersync.gumgum.com g2.gumgum.com
2 ad.360yield.com 2 redirects
2 dsum-sec.casalemedia.com 1 redirects ssum-sec.casalemedia.com
2 ssum-sec.casalemedia.com 1 redirects public.servenobid.com
2 ssbsync.smartadserver.com public.servenobid.com
g2.gumgum.com
2 c.bing.com eb2.3lift.com
g2.gumgum.com
2 ads.creative-serving.com 2 redirects
2 pm.w55c.net 2 redirects
2 u.openx.net cds.connatix.com
2 mug.criteo.com
2 gum.criteo.com 1 redirects
2 googlecm.hit.gemius.pl 2 redirects
2 9582686.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 www.google.de threatpost.com
2 kaspersky.d3.sc.omtrdc.net media.kaspersky.com
2 stats.g.doubleclick.net www.google-analytics.com
2 img.connatix.com threatpost.com
2 script.4dex.io qd.admetricspro.com
script.4dex.io
2 id5-sync.com cdn.id5-sync.com
qd.admetricspro.com
2 www.gstatic.com www.google.com
2 kasperskycontenthub.com threatpost.com
2 marketing.reversinglabs.com 1 redirects
1 pixel-us-east.rubiconproject.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 i6.liadm.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 gift-connect-d.openx.net serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 go.sonobi.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 tg.socdm.com 1 redirects
1 ssc-cms.33across.com g2.gumgum.com
1 bh.contextweb.com 1 redirects
1 stags.bluekai.com 1 redirects
1 match.deepintent.com g2.gumgum.com
1 sync.technoratimedia.com g2.gumgum.com
1 sync.ipredictive.com 1 redirects
1 sync.srv.stackadapt.com 1 redirects
1 event.clientgear.com 1 redirects
1 secure.adnxs.com 1 redirects
1 csync.loopme.me 1 redirects
1 id.rlcdn.com
1 dsum.casalemedia.com ssum-sec.casalemedia.com
1 dmp.brand-display.com 1 redirects
1 bttrack.com ssum-sec.casalemedia.com
1 p.rfihub.com 1 redirects
1 jadserve.postrelease.com public.servenobid.com
1 ce.lijit.com 1 redirects
1 onetag-sys.com public.servenobid.com
1 pixel.33across.com public.servenobid.com
1 g2.gumgum.com public.servenobid.com
1 match.prod.bidr.io eu-u.openx.net
1 public.servenobid.com qd.admetricspro.com
1 serverbid-sync.nyc3.cdn.digitaloceanspaces.com qd.admetricspro.com
1 sync.serverbid.com 1 redirects
1 odr.mookie1.com googleads.g.doubleclick.net
1 59bf77f101e2a5c2e3c052a9c0f9547d.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 px4.ads.linkedin.com
1 www.linkedin.com 1 redirects
1 snap.licdn.com www.googletagmanager.com
1 ads.adaptv.advertising.com cds.connatix.com
1 s0.2mdn.net imasdk.googleapis.com
1 analytics.twitter.com tagan.adlightning.com
1 geo.ipify.org qd.admetricspro.com
1 t.co threatpost.com
1 mp.4dex.io qd.admetricspro.com
1 tlx.3lift.com qd.admetricspro.com
1 cm.everesttech.net 1 redirects
1 kaspersky.demdex.net tagan.adlightning.com
1 lit.connatix.com cd.connatix.com
1 rules.quantcount.com secure.quantserve.com
1 static.ads-twitter.com www.googletagmanager.com
1 secure.quantserve.com www.googletagmanager.com
1 cdn.id5-sync.com tagan.adlightning.com
1 secure.cdn.fastclick.net tagan.adlightning.com
1 capi.connatix.com cd.connatix.com
1 cd.connatix.com 1 redirects
1 media.kaspersky.com threatpost.com
1 secure-web.cisco.com 1 redirects
496 157
Subject Issuer Validity Valid
marketing.reversinglabs.com
Cloudflare Inc ECC CA-3		 2021-06-04 -
2022-06-03		 a year crt.sh
threatpost.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-06-02 -
2022-07-03		 a year crt.sh
*.adlightning.com
Amazon		 2021-06-24 -
2022-07-23		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-08-11 -
2022-08-10		 a year crt.sh
assets.threatpost.com
Amazon		 2022-01-05 -
2023-02-03		 a year crt.sh
media.threatpost.com
Amazon		 2022-01-05 -
2023-02-03		 a year crt.sh
*.google.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
kasperskycontenthub.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-06-02 -
2022-07-03		 a year crt.sh
www.google.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
media.kaspersky.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-04-23 -
2022-04-28		 a year crt.sh
c.amazon-adsystem.com
Amazon		 2021-07-06 -
2022-06-27		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
*.connatix.com
Go Daddy Secure Certificate Authority - G2		 2021-08-20 -
2022-09-21		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
secure.cdn.fastclick.net
DigiCert SHA2 Secure Server CA		 2022-01-15 -
2023-01-17		 a year crt.sh
cdn.id5-sync.com
R3		 2022-02-02 -
2022-05-03		 3 months crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-22 -
2022-09-21		 a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-21 -
2022-07-26		 a year crt.sh
*.demdex.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-19 -
2022-11-19		 a year crt.sh
*.id5-sync.com
R3		 2022-03-08 -
2022-06-06		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
*.d3.sc.omtrdc.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-17 -
2023-03-07		 a year crt.sh
e.serverbid.com
R3		 2022-01-17 -
2022-04-17		 3 months crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2021-07-08 -
2022-08-08		 a year crt.sh
*.3lift.com
Amazon		 2021-06-12 -
2022-07-11		 a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2022-02-11 -
2023-03-14		 a year crt.sh
*.a-mo.net
R3		 2022-03-08 -
2022-06-06		 3 months crt.sh
*.sharethrough.com
Amazon		 2021-08-13 -
2022-09-11		 a year crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1		 2021-08-04 -
2022-09-04		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-30 -
2022-04-04		 a year crt.sh
*.1rx.io
Sectigo RSA Domain Validation Secure Server CA		 2021-06-01 -
2022-07-02		 a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2021-03-11 -
2022-04-12		 a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2021-12-12 -
2022-12-13		 a year crt.sh
web.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-03-08 -
2022-08-31		 6 months crt.sh
ads.servenobid.com
Amazon		 2021-06-28 -
2022-07-27		 a year crt.sh
t.co
DigiCert TLS RSA SHA256 2020 CA1		 2022-01-06 -
2023-01-05		 a year crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA		 2022-02-07 -
2023-03-10		 a year crt.sh
*.twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-01-06 -
2023-01-05		 a year crt.sh
www.google.de
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
*.v.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-10-19 -
2022-04-13		 6 months crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA		 2021-07-15 -
2022-07-20		 a year crt.sh
*.google.de
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
prod-rtb.ad4mat.net
GTS CA 1D4		 2022-02-19 -
2022-05-20		 3 months crt.sh
*.mookie1.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-24 -
2023-03-27		 a year crt.sh
*.innovid.com
RapidSSL RSA CA 2018		 2020-02-07 -
2022-04-07		 2 years crt.sh
www.awin1.com
DigiCert SHA2 Secure Server CA		 2021-06-11 -
2022-06-16		 a year crt.sh
*.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-02-04 -
2022-05-03		 3 months crt.sh
cdn.adnxs.com
GeoTrust RSA CA 2018		 2021-12-10 -
2022-12-09		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2021-03-18 -
2022-04-19		 a year crt.sh
*.nyc3.cdn.digitaloceanspaces.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-30 -
2022-04-30		 a year crt.sh
public.servenobid.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-17 -
2023-02-17		 a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-01-18 -
2022-07-13		 6 months crt.sh
*.match.prod.bidr.io
Amazon		 2022-01-27 -
2023-02-25		 a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA		 2022-03-01 -
2022-09-01		 6 months crt.sh
*.bidswitch.net
Sectigo RSA Domain Validation Secure Server CA		 2020-04-23 -
2022-05-04		 2 years crt.sh
www.bing.com
Microsoft RSA TLS CA 01		 2021-12-22 -
2022-06-22		 6 months crt.sh
*.gumgum.com
Amazon		 2021-06-05 -
2022-07-04		 a year crt.sh
*.33across.com
Sectigo RSA Domain Validation Secure Server CA		 2021-09-23 -
2022-09-30		 a year crt.sh
*.onetag-sys.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-01-10 -
2023-01-03		 a year crt.sh
*.smartadserver.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-01-25 -
2023-01-25		 a year crt.sh
*.postrelease.com
Amazon		 2021-12-28 -
2023-01-25		 a year crt.sh
*.go.sonobi.com
Go Daddy Secure Certificate Authority - G2		 2021-12-08 -
2023-01-09		 a year crt.sh
*.bttrack.com
Sectigo RSA Domain Validation Secure Server CA		 2021-03-29 -
2022-03-29		 a year crt.sh
*.everesttech.net
GlobalSign Atlas R3 DV TLS CA 2022 Q1		 2022-02-03 -
2023-03-07		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
*.technoratimedia.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-09-17 -
2022-10-05		 a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2020-04-09 -
2022-06-08		 2 years crt.sh
*.ad-server.k8s.ie.ggops.com
Amazon		 2022-02-15 -
2023-03-16		 a year crt.sh
*.emxdgt.com
Go Daddy Secure Certificate Authority - G2		 2021-05-18 -
2022-06-19		 a year crt.sh

This page contains 80 frames:

Primary Page: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Frame ID: 973D113E33E21FBD0D9B1941A77A1A0E
Requests: 151 HTTP requests in this frame

Frame: https://cds.connatix.com/p/154208/connatix.player.dc.js
Frame ID: AE9BD017038C0168396575A1384BCE90
Requests: 20 HTTP requests in this frame

Frame: https://kaspersky.demdex.net/dest5.html?d_nsid=0
Frame ID: D21B4665CF3AA782DB896104B9C89417
Requests: 1 HTTP requests in this frame

Frame: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Frame ID: CFD6D31CB97DB5729518DCC85DD6F3BB
Requests: 19 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.503.0_en.html
Frame ID: 74137EEB2412CB99FFB7D2AC910D4EF3
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.503.0_en.html
Frame ID: 014A5D718745DFB8E5F15611FB56837B
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.503.0_en.html
Frame ID: 4673EA6E5AD1086396E9FC2BFAC56B0E
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 86065CF92D599316D634315BE7340A95
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: ED2FAEBA5E242D92C51DB2E8973D0900
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 42571811E101337A1B99DB1B11289AC6
Requests: 1 HTTP requests in this frame

Frame: https://9582686.fls.doubleclick.net/activityi;dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F;u6=;u7=30625287790357303784341966813391233075-865144764.1646946976;u9=_microsoft-accounts-targeted-russian-credential-harvesting_178698_;~oref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email
Frame ID: D42281414938CF9E387DE919FDC882A3
Requests: 1 HTTP requests in this frame

Frame: https://59bf77f101e2a5c2e3c052a9c0f9547d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 873639FAF8B696A445B5156B4E5DA1BF
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F;u6=;u7=30625287790357303784341966813391233075-865144764.1646946976;u9=_microsoft-accounts-targeted-russian-credential-harvesting_178698_;~oref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email
Frame ID: 6DE6B36188C3AED3B52AA97ED1602F0D
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 93B45411513E5821A7710FE2B830B83A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D3D0BF087B1165B5C4B65FAF8604DF60
Requests: 2 HTTP requests in this frame

Frame: https://adservice.google.de/ddm/fls/i/dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F;u6=;u7=30625287790357303784341966813391233075-865144764.1646946976;u9=_microsoft-accounts-targeted-russian-credential-harvesting_178698_;~oref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email
Frame ID: 017D47F857AAC0D5459B3CAB5EABE4CF
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-92ee7c4-c5ba5efc.js
Frame ID: B4495A91080386B6071629044A9ACD10
Requests: 15 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-92ee7c4-c5ba5efc.js
Frame ID: 519E106B87460F2D3B029E5A806F0B04
Requests: 15 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-92ee7c4-c5ba5efc.js
Frame ID: 58A1C73DB9B308569D72DD82B4C56085
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220308/r20190131/zrt_lookup.html
Frame ID: EED21A0FB81874BCAB3CB636DA5A2E01
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Frame ID: B3D798737B99569D7E61765435581F1B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Frame ID: FCB83DFE9A05AF2EBD52632BEDDD4EFD
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Frame ID: 1CB8DDF5F8C3CF88C4ED24EB7352D51D
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: F48C38BA153621A5EC8826996365FD9D
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: FABD67F542A243A65689AB3FBE378152
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 2CA77EC9969F7C9E1C0F9E46E3DC1223
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 390D306F00DE27CA5CE2C3D57AC244C5
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: D28261456B6E3A899CAD8D78B6C4BE63
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 37A555C8232B1D5B54B787870E21C53E
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=C1vFUomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgSZA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Icwhgfh9eWNgw1dnfcLhAYCauLtjKGGu83GIftdfFhZCp1Hrx1mABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi03NTAwNTkzMjM2NzA3MzI1GAA&sigh=Q-Zc9DYN6Dk&uach_m=[UACH]&cid=CAQSPACNIrLMeFFLxzgtW8WbUcc73wCMHV1BOO6p-CwzqG65zatYkBQCMOxNqHOybYQQoVFJn8_gJ9cdMWedsxgB
Frame ID: E031E4084F24AE284F2A405A83293F58
Requests: 8 HTTP requests in this frame

Frame: https://as.ad4m.at/ad/dr?ed=1hapaqsf06bc3s73kz1e4nnpvf42nc8ap3qrzg99fsedaa0agv2vze4vpnbcpvcghqqap7ry39trck3ee1fpft1p47nmr378cqs1pebjm4tkqekcye879p24j89vpymbttee6ccmp9sw1v06ca5dd60h637b9tjww4nk52k6h4fy1w1s01wbvxp4m0kchtecsf4d07bsjmv8frdfjxwv5yt6vy0n35dtfcxt070aa1shh1g92m05zvpt89afj2g0av6t727t6q4hqynn1jaa4pt6j1mqxfb9sgt6j28v0dp172vsb1ywcjds2nca74bh5spf5kscwrztjc0535je98akbwv6cma52mdmzbhfc7wc0h35pykfwp3hk5k0brjbjj1rhwkrzsd7522wxe6f7vh1gag6yvfnq1gndcyzdv9dhd4shpjg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%26client%3Dca-pub-7500593236707325%26adurl%3D
Frame ID: E9CDB539D45F6526C1F1949929BFCD7C
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: D950DCDBEEB98CF245BBE5AA05BCF8F7
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CE34FomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEmgNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z2HoM3n-MRq4g1XR3IDG0cSjrE8RO9U_VgCCZxKLLus0iKjKLBl0YAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItNzUwMDU5MzIzNjcwNzMyNRgA&sigh=NSpumQnm5eA&uach_m=[UACH]&cid=CAQSPACNIrLM3YraB3rSD1Eijg_9lExJFNrkzD6-U_-d0WkFPUTkv1tB8frKRJvIch7AepHeyXe64PFSk2QEaRgB
Frame ID: 5A993DD282F98E8C4BC6AF2CEBD65BC1
Requests: 7 HTTP requests in this frame

Frame: https://as.ad4m.at/ad/dr?ed=1jwxytvzdtfztg26m3yta04wqrr2hhkxx1mpvtb3rahhq1knh6aj7kj1qvt6q8pt8gmkms4aj4670zr4p92hw5f2a6bj2v5bbc34qftap4tan2b0zxfe55ab78y7cvjp6mrksjw7tn3d7xs9es5t6t9c2xv60mgba2vsg6s66gx5ewjh8zh7nxxa60q7ka68gw9jq5yvx1t2rmdn5hqf4qybtsnnmvp84mrav8x7f587tt5rkn07pzynk7fpkzd3w983aqk6yx027c7c0h4kb9thphv7vm5k4g70kc7y0v5apt493s1bwfn523yp520f5rk2dph25kycr1kp8tc3khxrdwj702dshjm9mnx5thmn1q5w3289zfqqkhvzy9zqke38dhzt1b6yyzk0ej8rbdhsg5d830rs8k9r2nbv8jn13f6gyrhv2&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%26client%3Dca-pub-7500593236707325%26adurl%3D
Frame ID: 36EDFA7F25372E558A80AC3D14A4BC8C
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 28FE3620BF8A3DC90B4AE50FE92D4091
Requests: 9 HTTP requests in this frame

Frame: https://as.ad4m.at/ad/dr?ed=1g00gqb8xm6wfb8a3vy8c82p22ptbz0v91xbmpgqdktrpwnhq8hpjf5ek09tjn33xcgxj6jfrksn8aj4ww9b6t4p9y07zmme32re1k08bfbd4ehfmbgfq8kghdd06czxqxd3ysvf2c9grerq6hrdwdr57syq28afsv3w4w1vawjjenf95ve94dvv53606b1bafh6vyc6r460fg042jwe1tyrn2ka1vd50987gzs0nbmthkpkt2afcnpgyafsbx3jq111cv5e8zfrzp229jgc0wfhc5dc00gkedtcpybs48ej08ghstz50824w5baw5zjvfg30fg2d9zfjpx2merg26g3ct6c4jdmr01sekh7feaz84ged6y7sdgxvk1rskecx9yw3pbwt8ry1bfeww0gcsnk7ghtsf4gvjmnjxspq9pyfz5y1e62g&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%26client%3Dca-pub-7500593236707325%26adurl%3D
Frame ID: 85E015262EC1CD507DC0DFE0D5848133
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: FF2CA97C8CB94AE07D71919EB5C97320
Requests: 9 HTTP requests in this frame

Frame: https://ad4m.at/frame.html
Frame ID: 96FEAEB77A07BE499AAE038D24DBFB7B
Requests: 1 HTTP requests in this frame

Frame: https://ad4m.at/frame.html
Frame ID: E012B058894964EBF465C710084D3F55
Requests: 1 HTTP requests in this frame

Frame: https://ad4m.at/frame.html
Frame ID: A4356DC6AE776FD1BE87DF8B26B4F298
Requests: 1 HTTP requests in this frame

Frame: https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Frame ID: 3C5233CCF35FC20A27D2ADCC31E92FEC
Requests: 11 HTTP requests in this frame

Frame: https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Frame ID: 62CD1104EDFA34DC8553AB23E29D4080
Requests: 11 HTTP requests in this frame

Frame: https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Frame ID: DCF61BC5B92165C1AACE6BB2F2670447
Requests: 11 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Frame ID: CB8AFADF4632DE50FE7640453C2886F3
Requests: 7 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: BC3EC9CB3AD3B35043CC3CA5BBC10FC1
Requests: 3 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 9456E200524B3BC3947D9DDC2C20F51F
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Frame ID: 3B9F0D22170BE5FCED0938AD16A8CC81
Requests: 7 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 790E2EC30A488FAE227A034C23F103EE
Requests: 3 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Frame ID: 7BF44A20CE1BD0E0BF52EB9CC4B24AA9
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Frame ID: E479E8984B45462DD5B29A5B973244B1
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: A08D0D3CFB1558CAC8144A3BD0EAFD79
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 0AD89D20C98B641ACA8AF7C9EDCC752E
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: A23618D0576F5AB16EC403E8B9149B5C
Requests: 11 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Frame ID: 715D8E19E63693D5DDAA8D9DFFD8D659
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: 14C6B137E27601F2A851F819669D4E81
Requests: 7 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: B1576F5297A19AC0119B4DC1E6D753AB
Requests: 3 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 3F3DA1285D0CE40AD39746E6715A8C69
Requests: 8 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13394437
Frame ID: 3A033ED18378AE556FDD6CFCD84CB627
Requests: 1 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 0E08ADBA9552C702616E516B4B04F60E
Requests: 9 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: ACC388885823F56DBCB26795AA91E3E0
Requests: 10 HTTP requests in this frame

Frame: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Frame ID: 041BCC258B1F0131619156EF7EE038D0
Requests: 16 HTTP requests in this frame

Frame: https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Frame ID: 6C9E774622B470C74D5792F5B87BEFE6
Requests: 1 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Frame ID: 4E2A95A0AA7844C5603F2E413B1E6C8D
Requests: 1 HTTP requests in this frame

Frame: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Frame ID: 50677A89B451299D8B8EE7C3267714D9
Requests: 6 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Frame ID: 1024B8AFB5CCD11FB23F6070D3E6A320
Requests: 10 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=mmh&i=ad8b622a-6aa3-4b00-85b2-11db6d3e7dda&gdpr=0&gdpr_consent=
Frame ID: ED77D1B3B2D1D06B2BE73A66723C7A68
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=atm&i=YipqoAAAAFJ7uAQA&gdpr=0&gdpr_consent=
Frame ID: 411BCB34F3638971AB04223BDE7C37F8
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV8wZWY2OTVmNS05OGQzLTQ0Y2EtYjA3Yi01MWYxYjIxYTBiMmI=&gdpr=0&gdpr_consent=
Frame ID: 5301639DD5CADA52528D26ECAE60995C
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Frame ID: 8B0946223BEE8FABDD2DA03A4FF9A4C7
Requests: 1 HTTP requests in this frame

Frame: https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Frame ID: 18754CDCE587F544A67EA1C9FFDDCE9D
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=ttd&i=d7b276ae-2a2a-4852-9181-19b97d7e27a1&t=1649538982
Frame ID: 3CA5E70FB3F44DF5051F0B540CFE8DC6
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=gumgum
Frame ID: 9E3B4575F94EA2FA9FE70270C4AC6054
Requests: 3 HTTP requests in this frame

Frame: https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Frame ID: 85E2C84B3756C1DD02138A60E67691A8
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=sus&i=Yipqp8Co8YEAAA5EJGUAAAAA
Frame ID: 62FD0DFAC9080F37500A826092CBB8ED
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=rth&i=KIxk9HKbaftOgxoA2ejD&pi=gumgum&tc=1
Frame ID: C2B75B200A0DA8938BF421BD05791873
Requests: 1 HTTP requests in this frame

Frame: https://cs.emxdgt.com/um?ssp=pbs&redirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D44%26userId%3D%24UID
Frame ID: DDF8B188E7D71C7D50129E4D0A52CCE0
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Frame ID: 7ECE042E723B331BAB703B5255339B55
Requests: 3 HTTP requests in this frame

Frame: https://go.sonobi.com/uc.html?pubid=e55fb5d7c2
Frame ID: 26A0D35E1A643AD186A1ADF368C453EE
Requests: 1 HTTP requests in this frame

Frame: https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Frame ID: C6EC3087D016F9DFDF10DA2555CCD736
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156319&userIdMacro=PM_UID&predirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D4%26userId%3DPM_UID
Frame ID: A6C57B4C6B885F485076C81BA692E53F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Microsoft Accounts Targeted by Russian-Themed Credential Harvesting | Threatpost

Page URL History Show full URLs

  1. https://secure-web.cisco.com/1jYXQgafoCfoVvSCPL5Qlci3vyA8VjcsMyFdxPFByLLxF1eMzKAXhg9IZFwGv5ale0RoegoxBt9E... HTTP 302
    https://marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJ... Page URL
  2. https://marketing.reversinglabs.com/events/public/v1/encoded/track/tc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9... HTTP 307
    https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campai... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • googletagservices\.com/tag/js/gpt(?:_mobile)?\.js
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • /prebid\.js
  • adnxs\.com/[^"]*(?:prebid|/pb\.js)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

496
Requests

84 %
HTTPS

28 %
IPv6

96
Domains

157
Subdomains

110
IPs

8
Countries

7657 kB
Transfer

16570 kB
Size

115
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://secure-web.cisco.com/1jYXQgafoCfoVvSCPL5Qlci3vyA8VjcsMyFdxPFByLLxF1eMzKAXhg9IZFwGv5ale0RoegoxBt9Ez0gkuXKcugTHIX-pnbJKsG_KIh4CogEdW-UbcA89l930tRuKsE5vQh5g_7nnSJhI-BMgB97HH3YtFgYqQkDg04CeuwuJXDgr7uqFI86CvsHLUyxyFz7tW2WpaKaWQR7rIwIpw5pexjS3gcX62NfCc2Oe55uFfVv8CfV2w-O-hT0iRo8PcbC5MMN4aWyMownsdzFsDeQMSaDg7EC3lla01D-r11q-z8t_k1akxUrQ6oabRq4xujjFx/https%3A%2F%2Fmarketing.reversinglabs.com%2Fe3t%2FCtc%2FLV%2B113%2Fcprv104%2FMW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1 HTTP 302
    https://marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1 Page URL
  2. https://marketing.reversinglabs.com/events/public/v1/encoded/track/tc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1?_ud=25d45e83-27ec-4404-be6c-6c0c52ad5d02&_ch=p&_pr2=p&_pl=3&_lg=en-US,en&_dr=p&_ts=p HTTP 307
    https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://secure-web.cisco.com/1jYXQgafoCfoVvSCPL5Qlci3vyA8VjcsMyFdxPFByLLxF1eMzKAXhg9IZFwGv5ale0RoegoxBt9Ez0gkuXKcugTHIX-pnbJKsG_KIh4CogEdW-UbcA89l930tRuKsE5vQh5g_7nnSJhI-BMgB97HH3YtFgYqQkDg04CeuwuJXDgr7uqFI86CvsHLUyxyFz7tW2WpaKaWQR7rIwIpw5pexjS3gcX62NfCc2Oe55uFfVv8CfV2w-O-hT0iRo8PcbC5MMN4aWyMownsdzFsDeQMSaDg7EC3lla01D-r11q-z8t_k1akxUrQ6oabRq4xujjFx/https%3A%2F%2Fmarketing.reversinglabs.com%2Fe3t%2FCtc%2FLV%2B113%2Fcprv104%2FMW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1 HTTP 302
  • https://marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1
Request Chain 46
  • https://cd.connatix.com/connatix.player.js HTTP 302
  • https://cds.connatix.com/p/154208/connatix.player.dc.js
Request Chain 105
  • https://cm.everesttech.net/cm/dd?d_uuid=26556241689329212323610521727414406761 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YipqoAAAAFJ7uAQA
Request Chain 168
  • https://unpkg.com/web-vitals HTTP 302
  • https://unpkg.com/web-vitals@2.1.4 HTTP 302
  • https://unpkg.com/web-vitals@2.1.4/dist/web-vitals.umd.js
Request Chain 177
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1646946976749&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3F_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_content%3D206456747%26utm_source%3Dhs_email%26utm_medium%3Demail%26_hsmi%3D206456747 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D39138%26time%3D1646946976749%26url%3Dhttps%253A%252F%252Fthreatpost.com%252Fmicrosoft-accounts-targeted-russian-credential-harvesting%252F178698%252F%253F_hsenc%253Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%2526utm_campaign%253DThis%252520Week%252520in%252520ReversingLabs%2526utm_content%253D206456747%2526utm_source%253Dhs_email%2526utm_medium%253Demail%2526_hsmi%253D206456747%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1646946976749&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3F_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_content%3D206456747%26utm_source%3Dhs_email%26utm_medium%3Demail%26_hsmi%3D206456747&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1646946976749&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3F_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_content%3D206456747%26utm_source%3Dhs_email%26utm_medium%3Demail%26_hsmi%3D206456747&liSync=true&e_ipv6=AQIPptevaJiVPQAAAX91sIXyP8WvOaUqO3VJsok3sBKkWGBpz07B2bveePoH_5_YSd2TcNbC5gHA8elGqsf1PZ6EQ77lSA
Request Chain 180
  • https://9582686.fls.doubleclick.net/activityi;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F;u6=;u7=30625287790357303784341966813391233075-865144764.1646946976;u9=_microsoft-accounts-targeted-russian-credential-harvesting_178698_;~oref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email HTTP 302
  • https://9582686.fls.doubleclick.net/activityi;dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F;u6=;u7=30625287790357303784341966813391233075-865144764.1646946976;u9=_microsoft-accounts-targeted-russian-credential-harvesting_178698_;~oref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email
Request Chain 278
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEIhcKUhoHsRAg3PF2WqMzf4&google_cver=1&google_push=AYg5qPKaL1RPO58LbPF2jtWpbgg21tKQDi1BY2tEngE2P9LTRpAS1gZ7_wx2eJf3N8l8eVhC6HtpLoGTgmDw6WhFntR2VhT48Q HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEIhcKUhoHsRAg3PF2WqMzf4&google_cver=1&google_push=AYg5qPKaL1RPO58LbPF2jtWpbgg21tKQDi1BY2tEngE2P9LTRpAS1gZ7_wx2eJf3N8l8eVhC6HtpLoGTgmDw6WhFntR2VhT48Q&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=XhjJ079LTCih5lhWGfEsow%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKaL1RPO58LbPF2jtWpbgg21tKQDi1BY2tEngE2P9LTRpAS1gZ7_wx2eJf3N8l8eVhC6HtpLoGTgmDw6WhFntR2VhT48Q
Request Chain 279
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEMXiGxemxKx5M3d-Ptkh_Ik&google_cver=1&google_push=AYg5qPJqCtWp2iizWJmo9fAALId221AUho5jXhuRGbVXflK9OB8Qx9vGgM9UBBwGWb2zMhZVAg4a0QtpI4LJnoIgPt2EkuMOtA HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==&google_push=AYg5qPJqCtWp2iizWJmo9fAALId221AUho5jXhuRGbVXflK9OB8Qx9vGgM9UBBwGWb2zMhZVAg4a0QtpI4LJnoIgPt2EkuMOtA
Request Chain 280
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo&s=184023&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo
Request Chain 290
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEEYK8SpY5k3kuV-KiJYX7Cw&google_cver=1&google_push=AYg5qPJxMzIy-jB0DIeVDMIZ-KRDuAlWNWyMzDA96urkNIu9kYkxm_KIGGk4LSBLdF4bW62U2c3GNhMlCjCK5jvgmITEH-N-2GJ1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPJxMzIy-jB0DIeVDMIZ-KRDuAlWNWyMzDA96urkNIu9kYkxm_KIGGk4LSBLdF4bW62U2c3GNhMlCjCK5jvgmITEH-N-2GJ1&google_hm=0ts_V5TErrf7fggM5IxfKA
Request Chain 292
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEIhcKUhoHsRAg3PF2WqMzf4&google_cver=1&google_push=AYg5qPLCydKehyIwlWe-5noHW7FLRRCPA9gGGzUVpg3czl21hyXkz4NLH1jq00TCaRwx7AHUQ1zd1fqoZvDA1T5jpVddXoW9_25s HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEIhcKUhoHsRAg3PF2WqMzf4&google_cver=1&google_push=AYg5qPLCydKehyIwlWe-5noHW7FLRRCPA9gGGzUVpg3czl21hyXkz4NLH1jq00TCaRwx7AHUQ1zd1fqoZvDA1T5jpVddXoW9_25s&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2XnQexdERh23wJ-QDZNpxw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLCydKehyIwlWe-5noHW7FLRRCPA9gGGzUVpg3czl21hyXkz4NLH1jq00TCaRwx7AHUQ1zd1fqoZvDA1T5jpVddXoW9_25s
Request Chain 293
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEMXiGxemxKx5M3d-Ptkh_Ik&google_cver=1&google_push=AYg5qPJ4gKDpfnqb52ZJopkcSHFlV9Zpwd6FzW79z3qy7BZfHs7BReR9uMDbRKkRz9RZHZxBgFWLjD2yBZFdafOnQ9nCVw0_HG8 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==&google_push=AYg5qPJ4gKDpfnqb52ZJopkcSHFlV9Zpwd6FzW79z3qy7BZfHs7BReR9uMDbRKkRz9RZHZxBgFWLjD2yBZFdafOnQ9nCVw0_HG8
Request Chain 294
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&s=184023&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1
Request Chain 296
  • https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESENXS9PUWpDazJhtU21vcWv8&google_cver=1&google_push=AYg5qPKzjJLHN6fHegEenKleihlm5CLwP09T0XP3nd_blGRxYsrzVPiR6dAn_xHx8YSvoAxuXkIsMH-tu0PA3MseSn3RaEB3UoVhUA HTTP 301
  • https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKzjJLHN6fHegEenKleihlm5CLwP09T0XP3nd_blGRxYsrzVPiR6dAn_xHx8YSvoAxuXkIsMH-tu0PA3MseSn3RaEB3UoVhUA&google_hm=
Request Chain 301
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEEYK8SpY5k3kuV-KiJYX7Cw&google_cver=1&google_push=AYg5qPKlz8__CmVF0Jwv-DGetsgIdav7U40d8OEfhu_z5X8kA8S7mdo6F9zDzOMYpddsgHG4rcK2oWMl-D-tJ761mluy8mr87hCc HTTP 302
  • https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPKlz8__CmVF0Jwv-DGetsgIdav7U40d8OEfhu_z5X8kA8S7mdo6F9zDzOMYpddsgHG4rcK2oWMl-D-tJ761mluy8mr87hCc&google_hm=0ts_V5TErrf7fggM5IxfKA
Request Chain 303
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEIhcKUhoHsRAg3PF2WqMzf4&google_cver=1&google_push=AYg5qPItR7Mr6BNQF2PkunVOb5LKyjEQ2v57tyv44mPcYeI3PvLS2UvNIy-XMcxeP3yygDSNCBCjq1EIKvA73oRM5K-GEgBBgHpG HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEIhcKUhoHsRAg3PF2WqMzf4&google_cver=1&google_push=AYg5qPItR7Mr6BNQF2PkunVOb5LKyjEQ2v57tyv44mPcYeI3PvLS2UvNIy-XMcxeP3yygDSNCBCjq1EIKvA73oRM5K-GEgBBgHpG&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=SbFH4vmtSVOkh1Yc4Oc_ow%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPItR7Mr6BNQF2PkunVOb5LKyjEQ2v57tyv44mPcYeI3PvLS2UvNIy-XMcxeP3yygDSNCBCjq1EIKvA73oRM5K-GEgBBgHpG
Request Chain 304
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEMXiGxemxKx5M3d-Ptkh_Ik&google_cver=1&google_push=AYg5qPKaC7WjCMepPsYIzGFbDM--KDpzsGBN_WYyuiUcc4CT7jqvp2DvATz6mtUJiO2GR4PbuyQYWLeSNr7OaxePYvpEUl1h25X0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==&google_push=AYg5qPKaC7WjCMepPsYIzGFbDM--KDpzsGBN_WYyuiUcc4CT7jqvp2DvATz6mtUJiO2GR4PbuyQYWLeSNr7OaxePYvpEUl1h25X0
Request Chain 305
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o
Request Chain 307
  • https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESENXS9PUWpDazJhtU21vcWv8&google_cver=1&google_push=AYg5qPIOrTwCwouM3Ootn-Fy3JZOLx3zxqnWHz_eAn1ItnSyisS7IbUD8D7WzZwwllwnaWgL7uRmosrJgZ7bzmm8i_qVvBZk6MNv HTTP 301
  • https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIOrTwCwouM3Ootn-Fy3JZOLx3zxqnWHz_eAn1ItnSyisS7IbUD8D7WzZwwllwnaWgL7uRmosrJgZ7bzmm8i_qVvBZk6MNv&google_hm=
Request Chain 331
  • https://www.telefonica-partner.de/tpv.php?t=117679V1226132702M&subid=oneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://www.lead-alliance.net/tpv.php?t=117679V1226132702M&subid=oneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022031022161965414948587X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022031022161965414948587X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
Request Chain 334
  • https://www.telefonica-partner.de/tpv.php?t=117663V1225131106M&subid=oneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://www.lead-alliance.net/tpv.php?t=117663V1225131106M&subid=oneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=117663&s_id=2022031022161965414948595X117663V1225131106MSoneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth
Request Chain 341
  • https://www.telefonica-partner.de/tpv.php?t=117679V1226132702M&subid=oneid3bgFpf14UB63a7HrHAtEt997f8TWTReadoneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://www.lead-alliance.net/tpv.php?t=117679V1226132702M&subid=oneid3bgFpf14UB63a7HrHAtEt997f8TWTReadoneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022031022161965414948591X117679V1226132702MSoneid3bgFpf14UB63a7HrHAtEt997f8TWTReadoneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022031022161965414948591X117679V1226132702MSoneid3bgFpf14UB63a7HrHAtEt997f8TWTReadoneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
Request Chain 344
  • https://www.telefonica-partner.de/tpv.php?t=113752V1225131106M&subid=oneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://www.lead-alliance.net/tpv.php?t=113752V1225131106M&subid=oneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022031022161965414948593X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth
Request Chain 351
  • https://www.telefonica-partner.de/tpv.php?t=117679V1226132702M&subid=oneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://www.lead-alliance.net/tpv.php?t=117679V1226132702M&subid=oneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022031022161965414948589X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022031022161965414948589X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
Request Chain 354
  • https://www.telefonica-partner.de/tpv.php?t=113752V1225131106M&subid=oneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://www.lead-alliance.net/tpv.php?t=113752V1225131106M&subid=oneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022031022161965414948585X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth
Request Chain 364
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthreatpost.com%2F&domain=threatpost.com&cw=1&lsw=1 HTTP 302
  • https://mug.criteo.com/sid?cpp=DoGzV3xpazYrTTljc3ZYSW9NZklVbUxhQkYwZFMxZGE4WVk1Tzg1RU9hVTRWcGl0OFZmTzFoejlXNEx0aGNpTElIRldYVkp5MHFQZllKY2JDNFR4WmFwWE1ndXJ0S1FHNkZraE51d2Z6OThmT2FVR0tRb3VGZ2R2MTE2cCtIVHhzQ1dldDNvV0QzNHJFT0k3bUEzbzg0S3lqUUozNjlSWEtSUSsrNFVWeGlYYS9ZL0tUUjFJc3NFb2Z2WG5jOHN3VUpJUmNkbnAzZDA2MXJLNm5pUURDS2FWby90Wm9UdUdLazUzVGpNNTVTU09JRHFVPXw&cppv=2
Request Chain 373
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.advertising.com/ups/55986/sync?uid=YipqoAAAAFJ7uAQA&_origin=0&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.advertising.com/ups/55986/sync?uid=YipqoAAAAFJ7uAQA&_origin=0&gdpr=0&gdpr_consent=&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=YipqoAAAAFJ7uAQA&_origin=0&gdpr=0&gdpr_consent=&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8 HTTP 302
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=YipqoAAAAFJ7uAQA&_origin=0&gdpr=0&gdpr_consent=&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8&verify=true
Request Chain 374
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8 HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8&verify=true HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VVA1NDU5NGFiNy1hMGI3LTExZWMtYmVhNC0wMjM4YTBmNWZmZDg%3D HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEJMoIXvvr02cxOnRYcLBeMw&google_cver=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEJMoIXvvr02cxOnRYcLBeMw&google_cver=1&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8
Request Chain 375
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=d7b276ae-2a2a-4852-9181-19b97d7e27a1&_origin=1&gdpr=1&gdpr_consent=
Request Chain 376
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=d3a2622a-6aa3-4500-b4fa-1b5df0770cc6
Request Chain 377
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&&val=4KoqHeD5eUz7qCsY5a81SLeufkT7ryFNsKkWRb_8
Request Chain 378
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8882919795340086458
Request Chain 381
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKeI7MDe-3hsJq8hsd2q418&google_cver=1
Request Chain 382
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=ad8b622a-6aa3-4b00-85b2-11db6d3e7dda
Request Chain 383
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&&val=4KoqHeD5eUz7qCsY5a81SLeufkT7ryFNsKkWRb_8
Request Chain 384
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6957336235413161053
Request Chain 387
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKeI7MDe-3hsJq8hsd2q418&google_cver=1
Request Chain 397
  • https://eb2.3lift.com/sync HTTP 302
  • https://eb2.3lift.com/sync?&ld=1
Request Chain 401
  • https://sync.serverbid.com/ss/2000891.html HTTP 302
  • https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Request Chain 407
  • https://pm.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_ HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_ HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537072979&val=g2xR0Ow31Nsq905
Request Chain 408
  • https://x.bidswitch.net/sync?ssp=openx HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=openx HTTP 302
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=openx&bsw_custom_parameter=c8366fd5-e3eb-4447-9ebf-eb5d8b206510 HTTP 302
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=openx&bsw_custom_parameter=c8366fd5-e3eb-4447-9ebf-eb5d8b206510 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=133a9be6-7793-412b-9edb-d9693a3b2969&ssp=openx&expires=30&user_group=5&bsw_param=c8366fd5-e3eb-4447-9ebf-eb5d8b206510 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072968&val=c8366fd5-e3eb-4447-9ebf-eb5d8b206510&gdpr=&gdpr_consent=
Request Chain 409
  • https://ib.adnxs.com/getuid?https://eu-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537072399&val=2769691298401138908
Request Chain 414
  • https://eb2.3lift.com/ebda?sync=1&gdpr=1&cmp_cs= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDA2ODk3NzAyNDg2NjMxNjY4MzUx
Request Chain 416
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDA2ODk3NzAyNDg2NjMxNjY4MzUx
Request Chain 418
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/406897702486631668351?gdpr=1&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-Wvrd.ZxE2oRaY7tp.HkU77s4QEgzjST4ahP8TKHZCA--~A&dongle=0883
Request Chain 421
  • https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=406897702486631668351 HTTP 302
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=406897702486631668351&dcc=t
Request Chain 422
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Request Chain 428
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID HTTP 302
  • https://ads.servenobid.com/sync?pid=312&uid=2769691298401138908
Request Chain 429
  • https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D HTTP 302
  • https://ads.servenobid.com/sync?pid=310&uid=401a0ec0a2ae1e2b91219257
Request Chain 430
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D HTTP 302
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1646946982236 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2968747261 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/d7b276ae-2a2a-4852-9181-19b97d7e27a1 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-6a648ec4-4459-4197-85be-6bbf37b216e5-003 HTTP 302
  • https://ads.servenobid.com/sync?pid=321&uid=RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
Request Chain 432
  • https://p.rfihub.com/cm?pub=44007&in=1 HTTP 302
  • https://ads.servenobid.com/sync?pid=324&uid=5131077720858604117
Request Chain 434
  • https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D HTTP 302
  • https://ads.servenobid.com/sync?pid=327&uid=a2122771-06e0-4b3f-93ef-8ceef4f9c4f8&gdpr=0&gdpr_consent=&us_privacy=1YN-
Request Chain 435
  • https://ups.analytics.yahoo.com/ups/58559/occ HTTP 302
  • https://ads.servenobid.com/sync?pid=337&uid=y-UsuQWIhE2uHorDGvzV0riQunUMj.Sf.bYwVATMQ-~A
Request Chain 436
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENjVMe1j5GBcPzpljZfj_Fk&google_cver=1&gdpr=1
Request Chain 437
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&dcc=t
Request Chain 442
  • https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3CIndex_user_id%3E&gdpr=1 HTTP 302
  • https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=b4f5b009-8b11-e467-9d9f7740
Request Chain 445
  • https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjlhZDA1NzcwYzAxOGUzY2E4ZmY0YWIyMzJkYjE0ODc2NjgyZmI2MQ
Request Chain 446
  • https://token.rubiconproject.com/token?pid=25470 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==
Request Chain 448
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id= HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=WZOKSeC8Qg-E0B3TIzqIww&rk=usync-na HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=WZOKSeC8Qg-E0B3TIzqIww
Request Chain 450
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/Jq3z7CSsEUvlD7JKjevcpMn5EUdSAgOZEtemQ7w0kco?csrc= HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2534768160550192133
Request Chain 451
  • https://token.rubiconproject.com/token?pid=36584 HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L0LHPFUG-13-G6NQ
Request Chain 452
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id= HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=5eHGSDVwS8WS___d1zMiJw&rk=usync-other HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=5eHGSDVwS8WS___d1zMiJw
Request Chain 454
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fdcm%3Fpid%3D72348060-38ad-4586-8e4f-f1e2a8e789b3%26id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=655740961209670750&gdpr=0&gdpr_consent= HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=655740961209670750&gdpr=0&gdpr_consent=&dcc=t
Request Chain 455
  • https://sync.1rx.io/usersync2/smartadserver?gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4508649151 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/d7b276ae-2a2a-4852-9181-19b97d7e27a1 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
Request Chain 456
  • https://sync-tm.everesttech.net/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=YipqoAAAAFJ7uAQA&gdpr=0&gdpr_consent=
Request Chain 457
  • https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&gdpr=0&gdpr_consent= HTTP 307
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=ee919e6c-367f-4ce2-b4db-c6b63f767887&gdpr_consent=null&gdpr=0
Request Chain 458
  • https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID HTTP 302
  • https://rtb.gumgum.com/usersync?b=apn&i=2769691298401138908
Request Chain 459
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_0ef695f5-98d3-44ca-b07b-51f1b21a0b2b&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://event.clientgear.com/cookie/bidswitch?partner=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=c8366fd5-e3eb-4447-9ebf-eb5d8b206510 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=257&user_id=mka2690cea-fdae-4c76-a6fd-9c4001392695&expires=7&user_group=5&ssp=gumgum2&bsw_param=c8366fd5-e3eb-4447-9ebf-eb5d8b206510 HTTP 302
  • https://rtb.gumgum.com/usersync?b=bsw&i=c8366fd5-e3eb-4447-9ebf-eb5d8b206510
Request Chain 460
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
  • https://rtb.gumgum.com/usersync?b=obn&i=ENC%28eaVBx3jiCUfRnjTu9cmc-MQ1xVOvfrBsHnd9cDMBS8teia9Ep1u_gGzzR-xnahef%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%28eaVBx3jiCUfRnjTu9cmc-MQ1xVOvfrBsHnd9cDMBS8teia9Ep1u_gGzzR-xnahef%29 HTTP 302
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_0ef695f5-98d3-44ca-b07b-51f1b21a0b2b&obuid=ENC(eaVBx3jiCUfRnjTu9cmc-MQ1xVOvfrBsHnd9cDMBS8teia9Ep1u_gGzzR-xnahef) HTTP 302
  • https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51 HTTP 302
  • https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D
Request Chain 461
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
  • https://rtb.gumgum.com/usersync?b=opx&i=89397eee-4611-410e-b96c-e4a7b81f977c
Request Chain 462
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=sta&i=0-a8585234-f896-4018-710c-47237522e79a$ip$217.114.215.131
Request Chain 463
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=oth&i=y-ubMM9HJE2pf0DSvobeikbDTYb4dkdGjagPU6~A
Request Chain 464
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
  • https://rtb.gumgum.com/usersync?b=vnt&i=5638b94f-a0b7-11ec-bcde-477f26462834
Request Chain 467
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=e_0ef695f5-98d3-44ca-b07b-51f1b21a0b2b&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://stags.bluekai.com/site/23178?id=H2smdvEF4TEG19QlX96j&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2SBSONWWI5SFIY2FIRKHGE4VC3CYHE3GUJTVONPXA4TJOZQWG6J5GEWS2LI&gdpr=0&us_privacy=1--- HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2SBSONWWI5SFIY2FIRKHGE4VC3CYHE3GUJTVONPXA4TJOZQWG6J5GEWS2LI HTTP 302
  • https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=H2smdvEF4TEG19QlX96j&us_privacy=1---
Request Chain 468
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://usersync.gumgum.com/usersync?b=idi&i=af15bb5e-9b9c-478b-b687-dfb0beda6c1c
Request Chain 469
  • https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3494928880 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/d7b276ae-2a2a-4852-9181-19b97d7e27a1 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
Request Chain 470
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
  • https://rtb.gumgum.com/usersync?b=pln&i=ntTW0dDKSofh&ev=1&pid=558355
Request Chain 473
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
  • https://rtb.gumgum.com/usersync?b=mmh&i=ad8b622a-6aa3-4b00-85b2-11db6d3e7dda&gdpr=0&gdpr_consent=
Request Chain 474
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=atm&i=YipqoAAAAFJ7uAQA&gdpr=0&gdpr_consent=
Request Chain 478
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=ttd&i=d7b276ae-2a2a-4852-9181-19b97d7e27a1&t=1649538982
Request Chain 479
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=gumgum
Request Chain 481
  • https://tg.socdm.com/aux/idsync?proto=gumgum HTTP 302
  • https://rtb.gumgum.com/usersync?b=sus&i=Yipqp8Co8YEAAA5EJGUAAAAA
Request Chain 482
  • https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
  • https://rtb.gumgum.com/usersync?b=rth&i=KIxk9HKbaftOgxoA2ejD&pi=gumgum&tc=1
Request Chain 484
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17632&endpoint=us-east HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Request Chain 488
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D28%26userId%3D%24UID HTTP 302
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=2769691298401138908
Request Chain 489
  • https://ssum-sec.casalemedia.com/usermatchredir?s=185073&cb=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D1%26userId%3D HTTP 302
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=Yipqotmaf5R3Tjh7Fnb4KgAA%261190
Request Chain 490
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D24%26userId%3D%24UID HTTP 307
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=401a0ec0a2ae1e2b91219257
Request Chain 492
  • https://pixel.advertising.com/ups/56621/occ HTTP 302
  • https://ups.analytics.yahoo.com/ups/56621/occ?apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8 HTTP 302
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8
Request Chain 493
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dco%26nuid%3D HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89
Request Chain 494
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fi.liadm.com%2Fs%2F56939%3Fbidder_id%3D203802%26bidder_uuid%3D HTTP 302
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89 HTTP 303
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89&_li_chk=true&previous_uuid=7540f2f72c4d4512903426f1b21dec29 HTTP 303
  • https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89

496 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f6...
marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/
Redirect Chain
  • https://secure-web.cisco.com/1jYXQgafoCfoVvSCPL5Qlci3vyA8VjcsMyFdxPFByLLxF1eMzKAXhg9IZFwGv5ale0RoegoxBt9Ez0gkuXKcugTHIX-pnbJKsG_KIh4CogEdW-UbcA89l930tRuKsE5vQh5g_7nnSJhI-BMgB97HH3YtFgYqQkDg04CeuwuJ...
  • https://marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFC...
10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Thu, 10 Mar 2022 21:16:12 GMT
content-type
text/html;charset=utf-8
cf-ray
6e9f11ef2f4a9b45-FRA
last-modified
Thu, 10 Mar 2022 21:16:12 GMT
vary
Accept-Encoding
cf-cache-status
MISS
access-control-allow-credentials
false
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy
no-referrer
x-hubspot-correlation-id
f30882f2-4945-491a-b37f-90d8c99a0f3e
x-robots-tag
none
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gvpXIz41vUDhA9FS%2FWGvbbCz4FARPBBdboOeFig0G%2B6N41iq7ZYU%2FwDCnc4hrXnDj6PKy5mEk2sU1odNsGH3h2A7WoaGUvdkpIX4RLv5AvQF0qSV49DFWVSc1UnXduXYnaiFCcaQmLxUHPzSLwMRQAMwhqRe1MBBCw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
content-encoding
br

Redirect headers

server
openresty/1.19.3.1
date
Thu, 10 Mar 2022 21:16:11 GMT
content-type
text/html
content-length
0
location
https://marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1
talos-dc-id
4
Primary Request /
threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/
Redirect Chain
  • https://marketing.reversinglabs.com/events/public/v1/encoded/track/tc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33n...
  • https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV...
88 KB
23 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Requested by
Host: marketing.reversinglabs.com
URL: https://marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
31c1613a34d87d9a03090babcfb88c16fdff9e9e5d1c03c696d5f9bdf06a65b2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1

Response headers

Server
nginx
Date
Thu, 10 Mar 2022 21:16:13 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
close
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Link
<https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/wp-json/wp/v2/posts/178698>; rel="alternate"; type="application/json" <https://threatpost.com/?p=178698>; rel=shortlink
X-Frame-Options
SAMEORIGIN
X-Debug-Auth
off
X-Request-Host
threatpost.com
x-cache-hit
MISS
Content-Encoding
gzip

Redirect headers

date
Thu, 10 Mar 2022 21:16:12 GMT
location
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
cf-ray
6e9f11f0ba1e9b45-FRA
link
<https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email>; rel="canonical"
vary
Accept-Encoding
cf-cache-status
MISS
access-control-allow-credentials
false
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy
no-referrer
x-hubspot-correlation-id
8ba8eeeb-2bc6-4e8d-a85a-d51d1c61f8b5
x-robots-tag
none
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wi6R8M5TpNbkqbOsCr26Xcb%2Ba7yLOyZ%2Fz3xtD%2FnIJuDKnRHqdQHNsc4JarL%2BDCc8sFB5EkF6GpBuzLJy3rwl3NdAHqF5BrIQPYw4hzRHdbZS8Laakc5XsKhZEiVPnIlj8NMPH0i0o9W8N4RWgpVAFd7AsuCsEs8ILw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
museosans-900italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-900italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8edaef698e025c37ba9e8d632a895d7252c62251df3f095d5cff17b6f3304854

Request headers

Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:14 GMT
Last-Modified
Wed, 02 Mar 2022 11:07:06 GMT
Server
nginx
ETag
"621f4fda-3ca8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
15528
museosans-900-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-900-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4823c011e4b4cb4b7f35ced3ab09d57215ee243676d9bfcc24d10ec77d3db398

Request headers

Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:14 GMT
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
"621f4fdc-5124"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20772
museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:14 GMT
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
"621f4fdc-3dcc"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
15820
museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:14 GMT
Last-Modified
Wed, 02 Mar 2022 11:07:06 GMT
Server
nginx
ETag
"621f4fda-51a4"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20900
museosans-500italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
17aee1fe3d7d16e647b97f568230c2ff36c1855ce35ce930c26aec5d2c58eaf4

Request headers

Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:14 GMT
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
"621f4fdc-5c74"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
23668
museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:14 GMT
Last-Modified
Wed, 02 Mar 2022 11:07:06 GMT
Server
nginx
ETag
"621f4fda-5194"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20884
museosans-300italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:14 GMT
Last-Modified
Wed, 02 Mar 2022 11:07:06 GMT
Server
nginx
ETag
"621f4fda-5bac"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
23468
museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:14 GMT
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
"621f4fdc-51b8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20920
museosans-100italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
038fc4d49a9191d416d49841f371b6e0b06bb40f719124099d40fe8f393b9e2c

Request headers

Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:14 GMT
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
"621f4fdc-5b34"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
23348
museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:14 GMT
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
"621f4fdc-50c8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20680
op.js
tagan.adlightning.com/math-aids-threatpost/ 		44 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.139.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-139-110.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
bc2ff895812543f6ec943eddb5fe186ec0e57c2ea8a498494c110b2c33c70c1a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
.goQZFygnu.3h_Ytd_vECPb9pc8V98eC
content-encoding
gzip
etag
"46353b39440894a424fcd41b75b98f46"
age
1939
x-cache
Hit from cloudfront
content-length
18433
x-amz-meta-git_commit
7b120a5
last-modified
Wed, 09 Mar 2022 22:37:32 GMT
server
AmazonS3
date
Thu, 10 Mar 2022 20:49:36 GMT
content-type
application/javascript
via
1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
FRA60-P4
accept-ranges
bytes
x-amz-cf-id
QTxXglXo5rcm-YcxSGhmPbN1y-Vx6KzjUYD2EcKnkcGtZyZgmD_8Kg==
gpt.js
www.googletagservices.com/tag/js/ 		81 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
48612d697d41f938e9392cd38c1715d982e4ad11d81765aeffe06ec9196d40a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27773
x-xss-protection
0
server
sffe
etag
"1155 / 472 of 1000 / last-modified: 1646914126"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Thu, 10 Mar 2022 21:16:15 GMT
ros-layout.js
qd.admetricspro.com/js/threatpost/ 		26 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2a647d79b31b4b19f30c795aac862bcf5b424731c732e239775127b8ac4aae0a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:14 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 09 Mar 2022 04:05:55 GMT
server
cloudflare
etag
W/"67e2-5d9c136d2119a-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h%2Bc1xdxl3y%2BX5SEqtkpXUZI%2B68CMPdHu23csh69Kf4mI2%2FAdsJHub%2FrkuzufrEEzqbzw5vdT3htMKG%2BC38SdFpeLQsMr2GcR892xkJuHFj72lmb3absrBxE08Shqm9%2FrCGK3zvCH3as%2Fnv1GdNMuD9er"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6e9f11fc9de49bf2-FRA
expires
Thu, 10 Mar 2022 21:17:27 GMT
cmp.js
qd.admetricspro.com/js/threatpost/ 		310 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
519815bc4a3dd9a571cb56f57c7c6abfbda2b4e2de8c4b884a7535a1705438f2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
336
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Tue, 01 Jun 2021 14:47:10 GMT
server
cloudflare
etag
W/"4d957-5c3b56abf6028-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NMugxksckoG0DoU1tw5hffxUOMtOBIvw1PK6AlZAec3ff7pVqih7uo4qKE8Q9RRz%2BxL1%2B8T7SvEix00CkPn%2BfqsDURFSc5HOtoPPtVv5v6MZ17d8S97CM5V6ynDpUDo%2FNTEXJKFQ%2FZ8rIOndPZc5wIv6"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6e9f1202cc209bf2-FRA
expires
Thu, 10 Mar 2022 21:18:36 GMT
uspcmp.js
qd.admetricspro.com/js/threatpost/ 		148 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/uspcmp.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
336
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Sat, 08 Aug 2020 22:40:07 GMT
server
cloudflare
etag
W/"24e50-5ac65673cef1c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H6ZKxDm1Evlaguk07nsJ0ZOez2u%2FtkQ2Lo7M6NVpqSxX4OFzyNPTerrlABppHlfcOLT483qvuSrcJiiFkaFTQGNsBG3UzYBjZ7HBxrX9g8JzuAiRY36uzsFTsvAPqg4llhiWU72dj8cHuDeOh171v0QO"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6e9f1202cc229bf2-FRA
expires
Thu, 10 Mar 2022 21:20:18 GMT
targeting.js
qd.admetricspro.com/js/threatpost/ 		393 B
558 B 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03cc687f0c8a2d1694e509b91fcd6c62c0fbdbdbdb850b8007b8052f649c7f77

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
336
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 04 Aug 2021 21:50:12 GMT
server
cloudflare
etag
W/"189-5c8c2c96f96c7-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tKxQjNOCHW5qtUzs3Df2CjYWcEfSO8HIzxPA7lwUkS6pfKPt6MHK9eVisWC4a0TUJi%2BywYKS8%2BkK%2BXJXMrxLS%2BIxbiCDGcmqEHt5psy2rs9xvHPx8SSAcivsovJKwwdVrK5KYYMzgg6Yxi%2Bxu34dsj%2Fw"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6e9f1202cc239bf2-FRA
expires
Thu, 10 Mar 2022 21:18:28 GMT
prebid.js
qd.admetricspro.com/js/threatpost/ 		430 KB
124 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8c03fd4dea0f2c83fa05b10dfd913bfcff51d05e0c6e84b7f340b857fdda517

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
336
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 14 Oct 2021 15:35:01 GMT
server
cloudflare
etag
W/"6b738-5ce51d26ef74c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uVsOTxiDTyy4FhWO9LGsqLY574b%2FkKqa9%2FeEDCK%2BBIHxzK0kHvNQpDrO%2BMCrSP2Kw7d2Ostivs%2FDxp2jlz1xin6dAaRQHR7W9s9Kqxo2CF1VOVmpUK9lO6Jc4tByebSjaC7Fg%2BtuP%2BfOkHtj1GmLIaLh"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6e9f1202cc279bf2-FRA
expires
Thu, 10 Mar 2022 21:17:45 GMT
engine.js
qd.admetricspro.com/js/threatpost/ 		35 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/engine.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e6377776a1104aed9b11142115b22dcaad3cf78ae76d255e454b04b7189af32

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:14 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
335
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 24 Jan 2022 02:31:38 GMT
server
cloudflare
etag
W/"8cae-5d64ac49b9c1c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KEdFX13bQ9kh4YJ6M6Po1TAseXGNMlzDWwEP3XZNx8FR9zfCQBdVLuWH4l1nLe2X6Yk2YcD2eDOFJITEF1nTmS7s4yzh7kMDvOhjFyztB5pkMAXtuAviCTnPOjH1Mp4topCsvFEvLMZkPSxbL9%2BwMmVA"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6e9f11fc9de69bf2-FRA
expires
Thu, 10 Mar 2022 21:16:56 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		294 KB
42 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
62cbf085d014439b719c84c3d2f3222fde66e299c2da1b41dfc4dbb315db0456
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:14 GMT
content-encoding
gzip
x-amz-cf-pop
FRA60-P2
x-cache
Miss from cloudfront
content-length
42696
x-cache-hit
HIT
last-modified
Wed, 02 Mar 2022 11:07:08 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css; charset=utf-8
via
1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
YE-kcbOHg-W0Iybol4d8pneaCI76iL6LGNLo2fLttE06leVYls-gPA==
expires
Fri, 11 Mar 2022 19:56:50 GMT
jquery-1.12.4-wp.js
threatpost.com/wp-content/plugins/kaspersky-enable-jquery-migrate-helper/js/jquery/ 		95 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kaspersky-enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:14 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:05 GMT
Server
nginx
ETag
W/"621f4fd9-17a56"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:14 GMT
alert_text.js
threatpost.com/wp-content/plugins/kaspersky-cookies-notification/scripts/ 		107 B
461 B 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js?ver=1646219228
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
68cdaaeccd079ab33df06d3e5fb47594a4458a6491d48a8ae2f394defb419eb5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:14 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
W/"621f4fdc-6b"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:14 GMT
alert.js
threatpost.com/wp-content/plugins/kaspersky-cookies-notification/scripts/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js?ver=1646219228
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
500288356853c7199a27a6a2cdcd14b217d18dd9c8103272d8e6def6acbe2580

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
W/"621f4fdc-104a"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
public.js
threatpost.com/wp-content/plugins/honeypot-comments/public/assets/js/ 		116 B
495 B 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/honeypot-comments/public/assets/js/public.js?ver=1.0.0
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
931dc539e87db7f509be9c77dfcc9b2baee0b91e5236aa04580ab14ed81e2cc0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 11 Jun 2014 19:20:42 GMT
Server
nginx
ETag
W/"5398ac0a-74"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
kaspersky-twitter-pullquote.js
threatpost.com/wp-content/plugins/kspr_twitter_pullquote/js/ 		599 B
713 B 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js?ver=1.0
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1791bf831c158912a11ca40bcf5f3573fc54ec8f8343c37780dab679c0203d63

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:05 GMT
Server
nginx
ETag
W/"621f4fd9-257"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
loadmore.js
threatpost.com/wp-content/themes/threatpost-2018/assets/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/js/loadmore.js?ver=5.9.1
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e0f1df7af81fd8eb920863093c426fdafd241b8d9aeb6126fb2fd24f36c061b3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:05 GMT
Server
nginx
ETag
W/"621f4fd9-11e7"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
social-share.js
threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/js/ 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js?ver=1.0.0
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
546be401414bcb20cdea07cdbcd806409b9629e4895737e214401948c40409f3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
W/"621f4fdc-484d"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
MicrosoftOutlook-scaled-e1643388571356.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2022/01/28114907/ 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2022/01/28114907/MicrosoftOutlook-scaled-e1643388571356.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:5a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9db763fc6b8b1e326731d686dd817d0e0b3f88dbb1c9c3b7355ed3a2594fff51

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 21 Feb 2022 09:31:51 GMT
via
1.1 fa5a3d5abd34c6fac657b045a4dcbdc4.cloudfront.net (CloudFront), 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified
Fri, 28 Jan 2022 16:49:32 GMT
server
AmazonS3
age
1511065
etag
"6734a978a3eaea794fe2a3820097cb19"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA56-P6
accept-ranges
bytes
content-length
41838
x-amz-cf-id
ZQL5gq3udFM-34YPUxhpUA7dbq2nBFLl7SG1IgBobaxQIuXBM-MyPg==
expires
Sat, 28 Jan 2023 16:49:31 GMT
wolf-in-sheps-clothing-2-scaled-e1646927420433-540x270.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2022/03/10104939/ 		55 KB
55 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/10104939/wolf-in-sheps-clothing-2-scaled-e1646927420433-540x270.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:5a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
816f5777083926d282d6307a1d75ff2cf6ccdc7a834032739637654bc2cc7d76

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 19:54:20 GMT
via
1.1 b9d2ce196c8a711fb15d92175d58476e.cloudfront.net (CloudFront), 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified
Thu, 10 Mar 2022 15:50:25 GMT
server
AmazonS3
age
4916
etag
"589a86b0d7f214e731a1bcc394b1554a"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P2, FRA56-P6
accept-ranges
bytes
content-length
56135
x-amz-cf-id
gffxz1C5szZ01XGHSFlkPmF0EVoD-8yJHxh8YuygU19V0XN9BfM63w==
expires
Fri, 10 Mar 2023 15:50:22 GMT
api.js
www.google.com/recaptcha/ 		852 B
577 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?hl=en&render=explicit
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
c8e92abaf2e87fa74d7c90513d7fde3b3249f1145ef5831dc82007a92925ffaf
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
556
x-xss-protection
1; mode=block
expires
Thu, 10 Mar 2022 21:16:15 GMT
scripts.js
kasperskycontenthub.com/threatpost-global/wp-content/plugins/kaspersky-embeds/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kasperskycontenthub.com/threatpost-global/wp-content/plugins/kaspersky-embeds/js/scripts.js?ver=1.0
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1f863d13dbad7d5240f577a73b47b06227d218909259042da95301e2eb8be55

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
W/"621f4fdc-828"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
api.js
www.google.com/recaptcha/ 		852 B
967 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=explicit&ver=202124050927
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
442e238997ccdf2457f7e614c2d4d1746b749fb20bc20d1786467e93b3a5a025
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
554
x-xss-protection
1; mode=block
expires
Thu, 10 Mar 2022 21:16:15 GMT
main.js
threatpost.com/wp-content/plugins/kaspersky-gravity-forms-dynamic-recaptcha/assets/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kaspersky-gravity-forms-dynamic-recaptcha/assets/js/main.js?ver=202124050927
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4d52f37b83f70c5035632548c652508d793eec55e17f2ac19552f4fa19d323be

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:05 GMT
Server
nginx
ETag
W/"621f4fd9-ab4"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
s_code_single_suite.js
media.kaspersky.com/tracking/omniture/ 		172 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=5.9.1
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.85.15.31 , Germany, ASN200107 (KL-EXT, CH),
Reverse DNS
Software
/ Kaspersky Labs, Kaspersky Labs
Resource Hash
1cc8f236395021ae8cedd13405db496e01adb47b7a9a9df3fd85ad420eb8df8d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
etag
"80c39fb6fb26d81:0"
x-powered-by
Kaspersky Labs, Kaspersky Labs
content-length
49078
x-xss-protection
1; mode=block
last-modified
Mon, 21 Feb 2022 08:19:15 GMT
server
x-frame-options
SAMEORIGIN
date
Thu, 10 Mar 2022 21:16:14 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=3600
x-server
fr2/KLM8
accept-ranges
bytes
x-content-type-options
nosniff
main.js
threatpost.com/wp-content/themes/threatpost-2018/assets/js/ 		114 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/js/main.js?ver=202107061113
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4e0b5563ff1fc5175d65e11e1546bee1945486d65d76c9248bdd77487532dadf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
W/"621f4fdc-1c643"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
regenerator-runtime.min.js
threatpost.com/wp-includes/js/dist/vendor/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a3e64300797e8078baa41dbc49e2affc1d2bedd04a470f0c929ed7fac698fbcd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Feb 2022 15:31:48 GMT
Server
nginx
ETag
W/"621501e4-195e"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
wp-polyfill.min.js
threatpost.com/wp-includes/js/dist/vendor/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e20ddb9ed1fa044cb624f0253bb06b13c92ed9915063bd63a5806440c6b1ce7c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Feb 2022 15:31:48 GMT
Server
nginx
ETag
W/"621501e4-4b3d"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
dom-ready.min.js
threatpost.com/wp-includes/js/dist/ 		1 KB
989 B 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/dist/dom-ready.min.js?ver=ecda74de0221e1c2ce5c57cbb5af09d5
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e127aead57cd6625f795f8c41d8b7c463c2c50158e3a3dc398424db2b16bd5db

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Feb 2022 15:31:48 GMT
Server
nginx
ETag
W/"621501e4-4e9"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
hooks.min.js
threatpost.com/wp-includes/js/dist/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e5935466216a250bb06338805b32ffb19eeda9042ead790ebc6e5dda27820adb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Feb 2022 15:31:48 GMT
Server
nginx
ETag
W/"621501e4-163a"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
i18n.min.js
threatpost.com/wp-includes/js/dist/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
22c90613db09ef65c964b143e6adbe584b42eae85c9b7a75fa27c22b25cccb90

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Feb 2022 15:31:48 GMT
Server
nginx
ETag
W/"621501e4-28a7"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
a11y.min.js
threatpost.com/wp-includes/js/dist/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/dist/a11y.min.js?ver=68e470cf840f69530e9db3be229ad4b6
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
927e16d837ac9f46ddb4a64c8fea1cbe39343902c91b14e11b484e9b01f98cdd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Feb 2022 15:31:48 GMT
Server
nginx
ETag
W/"621501e4-bfd"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
jquery.json.min.js
threatpost.com/wp-content/plugins/gravityforms/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/gravityforms/js/jquery.json.min.js?ver=2.5.16.3
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
693c8b61667ac94847264924178702a190c5113b41b82085dad0641f89e3f864

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
W/"621f4fdc-730"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
gravityforms.min.js
threatpost.com/wp-content/plugins/gravityforms/js/ 		43 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.5.16.3
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
69f0ade8cca67112ef495f707fb73c68fd5099a6cd9c51d9ba9ceda8dcca16f7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
W/"621f4fdc-abe0"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
conditional_logic.min.js
threatpost.com/wp-content/plugins/gravityforms/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/gravityforms/js/conditional_logic.min.js?ver=2.5.16.3
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
7104f88840a420f1702717d900db98910deb6141ad639bb7338b88993e989c72

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:05 GMT
Server
nginx
ETag
W/"621f4fd9-213f"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
placeholders.jquery.min.js
threatpost.com/wp-content/plugins/gravityforms/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/gravityforms/js/placeholders.jquery.min.js?ver=2.5.16.3
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
public
Date
Thu, 10 Mar 2022 21:16:15 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
W/"621f4fdc-121f"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 17 Mar 2022 21:16:15 GMT
apstag.js
c.amazon-adsystem.com/aax2/ 		134 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.119.176 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-119-176.fra60.r.cloudfront.net
Software
Server /
Resource Hash
3ef5bfd224e0baa902eb88c94979cfaeccf2169a996c601fa3de4c3f3b33da01

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
cDw9qPFdR3WLu_gch_nIk4UAdfcPuNG7
content-encoding
gzip
etag
4e3fad24a118a07cea7ce88b2721a583
age
603
x-cache
Hit from cloudfront
server
Server
x-amz-rid
1MM0NM24PRAWXPR0479T
date
Thu, 10 Mar 2022 21:06:15 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
cache-control
public, max-age=900
x-amz-cf-pop
FRA60-P1
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
kkoZjCSYWFD19enMmk4RCDOnz5MmRJetMbHJpSYF30F-OZIhlz4W-w==
connatix.player.dc.js
cds.connatix.com/p/154208/ Frame AE9B
Redirect Chain
  • https://cd.connatix.com/connatix.player.js
  • https://cds.connatix.com/p/154208/connatix.player.dc.js
990 KB
239 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/154208/connatix.player.dc.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
bb83a3ba5468dc41aa8b6456858d98bcbd45cc745e076a0de6fcdd91bfb00b84

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:14 GMT
content-encoding
br
last-modified
Thu, 10 Mar 2022 10:37:52 GMT
age
38058
etag
"98aaa89a3565aa94b9c1801a38ca5fa6"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
244532

Redirect headers

location
https://cds.connatix.com/p/154208/connatix.player.dc.js
date
Thu, 10 Mar 2022 21:16:14 GMT
cache-control
no-cache, no-store, must-revalidate, max-age=0
server
Kestrel
accept-ranges
bytes
content-length
0
/
kasperskycontenthub.com/ 		0
399 B 		Script
General
Check archive.org
Download Go to
Full URL
https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=133429140&back=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:15 GMT
X-Content-Type-Options
nosniff
Server
nginx
X-Frame-Options
SAMEORIGIN
Connection
close
Content-Type
application/javascript
x-cache-hit
MISS
Transfer-Encoding
chunked
X-Debug-Auth
off
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Request-Host
kasperskycontenthub.com
X-XSS-Protection
1; mode=block
gtm.js
www.googletagmanager.com/ 		178 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
156a9802a1ba3acf722fe76ddb97dccb14a2138a5ce3a526100c42d7f2b18eb9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
60569
x-xss-protection
0
last-modified
Thu, 10 Mar 2022 21:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 10 Mar 2022 21:16:15 GMT
gtm.js
www.googletagmanager.com/ 		503 KB
116 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3f156b054149f99085e69ea1a23cdb601aaa9213219dc541569d2f6cd033324b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
118701
x-xss-protection
0
last-modified
Thu, 10 Mar 2022 21:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 10 Mar 2022 21:16:15 GMT
icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 		13 KB
13 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
97f5070aadd9475bb56a49a7bc1114e9fe1b992b55f2b227502f35f8bba71d74

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:16 GMT
Last-Modified
Wed, 02 Mar 2022 11:07:08 GMT
Server
nginx
ETag
"621f4fdc-328e"
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
12942
icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 		13 KB
13 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
97f5070aadd9475bb56a49a7bc1114e9fe1b992b55f2b227502f35f8bba71d74

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:16 GMT
Last-Modified
Wed, 02 Mar 2022 11:07:06 GMT
Server
nginx
ETag
"621f4fda-328e"
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
12942
logo.png
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
public
date
Thu, 10 Mar 2022 21:16:15 GMT
via
1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:08 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fdc-4a32"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
max-age=604800, public
accept-ranges
bytes
content-length
18994
x-amz-cf-id
qI4h5RTBdgcg9sUdskzwoofrQOc1Cv1fO4Q8luki-XAoTKeuw0jbtg==
expires
Thu, 17 Mar 2022 21:16:15 GMT
mail-plane-light.svg
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		828 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
via
1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:06 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fda-33c"
x-cache
Miss from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
828
x-amz-cf-id
OKdB8rMW56wOVvkEd8XpFzLdEBdJSB7Djjs7i4UDOAEgSBYG9fjOMw==
twitter-blue.svg
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		868 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
via
1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:08 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fdc-364"
x-cache
Miss from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
868
x-amz-cf-id
hGOmbgi4radZHSoyoLV7HkG-SM8UeCRLWEWXcSUQ429MSZwV0cnPkw==
museosans-700-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
via
1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:08 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fdc-51a4"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
20900
x-amz-cf-id
bjOn5sTUegQ4uqaBSFPfahhy1ypAHaczzpu8ZMHgqj2sVu5eGMAAEw==
museosans-100-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
via
1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:08 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fdc-50c8"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
20680
x-amz-cf-id
5W0bVtVK8gf9mjxh6W-ZYGVVD0ZBkdK3_UVg3u67C7v3XfyKmqz4Pw==
museosans-300-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
via
1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:08 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fdc-51b8"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
20920
x-amz-cf-id
5uXIHUUnHG6pSZGE6MhAfSNAxr9JljDYORHPv5KvfR722F2vOQChEg==
museosans-500-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
via
1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:08 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fdc-5194"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
20884
x-amz-cf-id
VJCS3Yz4qM6zxqTH7-GChmDNDALZoqrAkfsfWTzruuYkPaQv_vJbQQ==
museosans-300italic-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
via
1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:06 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fda-5bac"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
23468
x-amz-cf-id
dvz-vDEkWLP3EFEQUYPONbpRT9IAT0iU9sMRRDUo3P1WRLk5YwtZUg==
museosans-700italic-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
via
1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:08 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fdc-3dcc"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
15820
x-amz-cf-id
nt0sg-_duksbvxRR9PUAlTR6ezE0rks_4xlzhf6lTjHdgXmzxHpEog==
player.css
cds.connatix.com/p/154208/ 		56 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/154208/player.css
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
abfa5ce24f65db048040344e04b17c9f99d99170f41393641a1531828c05b3ce

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
br
last-modified
Thu, 10 Mar 2022 10:37:53 GMT
age
38058
etag
"0a34539cb7da12fef4114e7cd93564e7"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
8618
mail-plane-large-dark.svg
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		812 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
via
1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:08 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fdc-32c"
x-cache
Miss from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
812
x-amz-cf-id
2wK30QEzY61Iz1SpLRnn7Tahp9Xthb38ewGefz9-O9Lv4JoSCqC1Zw==
logo-white.png
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
public
date
Thu, 10 Mar 2022 21:16:15 GMT
via
1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:06 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fda-260a"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
max-age=604800, public
accept-ranges
bytes
content-length
9738
x-amz-cf-id
TfulH719UtCt00EvXY1K7hy0XAIOpd-nQE9VeTDpwzYz8n_7TYv4xw==
expires
Thu, 17 Mar 2022 21:16:15 GMT
Tara-headshot.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/Tara-headshot.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:5a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 30 Dec 2021 23:07:47 GMT
via
1.1 50c53efe331c3da25a4faf191817af8c.cloudfront.net (CloudFront), 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified
Fri, 17 Aug 2018 16:22:08 GMT
server
AmazonS3
age
6041309
etag
"dee18dfeea6de13bec60c1e5237eb723"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P2, FRA56-P6
accept-ranges
bytes
content-length
13097
x-amz-cf-id
XMhWCaJeVxRe-bk4_QWJ_CH49kmb2nz3KgRNfa23MngrlzUHqEpygA==
expires
Sat, 17 Aug 2019 16:22:07 GMT
cryptocurrency-bitcoin-evasion-540x270.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2022/03/10090357/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/10090357/cryptocurrency-bitcoin-evasion-540x270.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:5a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
86cf7cdf56588a045829e9bd6d130cb75889b8d8110bbab4e060a435bcf46373

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 14:11:24 GMT
via
1.1 32c8da10203574baccb74b8f771a7ffa.cloudfront.net (CloudFront), 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified
Thu, 10 Mar 2022 14:04:08 GMT
server
AmazonS3
age
25492
etag
"906d885f20b4321f5780a5997efda40a"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA56-P6
accept-ranges
bytes
content-length
18591
x-amz-cf-id
SRl9jBAAcYLh56R5VRPe85oKp3Lc4NLATP4gn7w2vkSqEkjB9Vzk2Q==
expires
Fri, 10 Mar 2023 14:04:07 GMT
blame-the-victim-540x270.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2022/03/07190013/ 		24 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/07190013/blame-the-victim-540x270.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:5a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
079112c3107dfb6e95b14f8ddd2d1a1c3a094ebd3212077a99876cb41bad13b2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 14:01:39 GMT
via
1.1 e6d97713eb9b65f883e0f86b833878dc.cloudfront.net (CloudFront), 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified
Tue, 08 Mar 2022 00:00:25 GMT
server
AmazonS3
age
26077
etag
"b55a94ecf350ea1fe58ef234fda8a4e8"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA56-P6
accept-ranges
bytes
content-length
24896
x-amz-cf-id
Nvs1Ex6M4nsWpCD2pGqFoaOL3JJvCWt5dhj6060aKeYViiSW3VG5EA==
expires
Wed, 08 Mar 2023 00:00:24 GMT
14_kaspersky_secure_futures_magazine_composable_infrastructure-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2022/03/01154703/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/01154703/14_kaspersky_secure_futures_magazine_composable_infrastructure-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:5a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7e75ade51afcae47ec8dedc46bd50962ebb58b46638a69951f1f494c5052fe14

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Tue, 08 Mar 2022 15:57:05 GMT
via
1.1 57d93b321db68494cc6755a0d3fb29cc.cloudfront.net (CloudFront), 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified
Tue, 01 Mar 2022 20:47:09 GMT
server
AmazonS3
age
191951
etag
"502f5a6c66ba05c0831f656eb6cc29dd"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, FRA56-P6
accept-ranges
bytes
content-length
2476
x-amz-cf-id
oS_7tHh1wpwjluDTyzjmjJ_c3EtK6hQLuY7tEVvR2GA-WjUnYrJh1g==
expires
Wed, 01 Mar 2023 20:47:08 GMT
checklist2-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/10/19100940/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/10/19100940/checklist2-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:5a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7fd9983a3429d6ead1f66bf933770f9b790818b189e39ff0f2a0d3f590bbf67b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 18:49:28 GMT
via
1.1 fb8c0300277bd0137c1693d3d64ab550.cloudfront.net (CloudFront), 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified
Tue, 19 Oct 2021 14:09:44 GMT
server
AmazonS3
age
1132008
etag
"14bf40c9dffffaec5cd1337f170dac93"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA56-P6
accept-ranges
bytes
content-length
2112
x-amz-cf-id
V81zxKzS_Jv2KqXHohgxBNsWomm82FnpvUlGnGGtLORXnREWy0Zpbw==
expires
Wed, 19 Oct 2022 14:09:43 GMT
5-Steps-For-Securing-Your-Remote-Work-Space-e1645021300212-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/09/09141032/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/09/09141032/5-Steps-For-Securing-Your-Remote-Work-Space-e1645021300212-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:5a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1f3d8b57f69b73694c38ba6bbf8ddc46c8a5e52db401795fa8ab80643e14236d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 21:12:50 GMT
via
1.1 666eddda46892ed48d8d771b6142ac24.cloudfront.net (CloudFront), 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified
Wed, 16 Feb 2022 14:21:42 GMT
server
AmazonS3
age
1209806
etag
"8d2fd78b5abc332b1098cc4de81608b9"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P2, FRA56-P6
accept-ranges
bytes
content-length
1940
x-amz-cf-id
rkZfGOXjvxdsZhyLzevk9qZ7BJjmioS_uK6ZzwoiHsGDHhXUpsXM1Q==
expires
Thu, 16 Feb 2023 14:21:40 GMT
nuclear-bomb-explosion-1478796377Hhl-64x64.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2021/09/29112739/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/09/29112739/nuclear-bomb-explosion-1478796377Hhl-64x64.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:5a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6c8e343da3b15a6a26e0367b83d1c97813863ea6e6a905bd9e69870bb0a0ebd0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 21:08:04 GMT
via
1.1 9c7c26f5beeb09381cea450ea3581b36.cloudfront.net (CloudFront), 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified
Wed, 29 Sep 2021 15:27:43 GMT
server
AmazonS3
age
2506092
etag
"6d0d1a22dbbe088376115135bb5be675"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA56-P6
accept-ranges
bytes
content-length
2337
x-amz-cf-id
xylDpkclQl8G2qruQA6iPnioRkJO_n4MCAHOAHlzZFhuJv84Dv_Kkg==
expires
Thu, 29 Sep 2022 15:27:42 GMT
Log4J_shell_thrpst-e1643986376319-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/12/30110920/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/12/30110920/Log4J_shell_thrpst-e1643986376319-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:5a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
41f047950d4db7e04d250ebe65613aaaf482546a855d9321d1536ecb8ab6cccf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 04 Feb 2022 18:59:05 GMT
via
1.1 e38834cd8f7f79ef118dc9bba0861780.cloudfront.net (CloudFront), 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified
Fri, 04 Feb 2022 14:52:59 GMT
server
AmazonS3
age
2945831
etag
"8b8e89e4e306930920312db10e2c0dbf"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA56-P6
accept-ranges
bytes
content-length
2455
x-amz-cf-id
HR1d74kIsfkpmK6EWm271QaXPbCxPpSmua9NWxg7XrGVTZpd9YUMmw==
expires
Sat, 04 Feb 2023 14:52:57 GMT
pls
capi.connatix.com/core/ Frame AE9B 		10 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/pls?v=154208
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.12.63.132 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-12-63-132.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
2e9992ed264174e850e57d7cf584dcf322d30c954514badc658592349c0d0933

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
4962
vendor-list.json
qd.admetricspro.com/js/cmp2/ 		256 KB
36 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1aeb3ee07f4b462935c5d8047ff038c8e279d75f9be1dcd0b848ba68223a3ee2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Mon, 31 May 2021 16:54:38 GMT
server
cloudflare
etag
W/"3ffae-5c3a314b5dcb2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8cF%2FNWjG1SQciS4tqzytrt0NlmBHWCcJOEGEqdneTX56MVii9FV8AVc2yL6kHZVkRx%2FnwavkuBr46jKdA0WYADsxCjheSPU3CU9ciT3SwTf229sanBgp0XGAow4dQAbmC8SlA5jOmpRCshWkw60y192l"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=600
cf-ray
6e9f1203dc1a6943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 10 Mar 2022 21:26:15 GMT
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.139.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-139-110.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 05 Feb 2022 22:56:33 GMT
content-encoding
gzip
age
2845182
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P4
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
BfMNoDW58TDwKSiky098j0q2ateEJdDAb64pOI5bu4uw_FJXyYVdEA==
bl-92ee7c4-c5ba5efc.js
tagan.adlightning.com/math-aids-threatpost/ 		42 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-92ee7c4-c5ba5efc.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.139.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-139-110.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b13a70bbf9440ad94f2108d762ca3db168fc275d6389538dfb0f032b18d5975f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 09 Mar 2022 23:37:00 GMT
content-encoding
gzip
age
77956
x-cache
Hit from cloudfront
content-length
17921
x-amz-meta-git_commit
92ee7c4
last-modified
Wed, 09 Mar 2022 22:36:37 GMT
server
AmazonS3
etag
"ad102c3990b861a93224b547049fd6a9"
x-amz-version-id
bVh6vHYGCZJSJO2e5ZulPSWfjYynPfxF
via
1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P4
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
dWKM-_OWaG2dAnq3qhLkZ0C9bqYYo3dV4yIsYmq09D1AwFd40H7fYg==
recaptcha__en.js
www.gstatic.com/recaptcha/releases/_exWVY_hlNJJl2Abm8pI9i1L/ 		356 KB
141 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/_exWVY_hlNJJl2Abm8pI9i1L/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&render=explicit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d526e08d2f18f7fea947247c440cf46473ed39655b4931e959939c383291f665
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 07:03:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
51169
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
143652
x-xss-protection
0
last-modified
Mon, 28 Feb 2022 23:43:01 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 10 Mar 2023 07:03:26 GMT
config
c.amazon-adsystem.com/cdn/prod/ 		662 B
1019 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fthreatpost.com&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.119.176 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-119-176.fra60.r.cloudfront.net
Software
Server /
Resource Hash
6493fe707262fb8d9bc0e4d487e319fc9ebe7de26ebe7e3b4f58a5d17f03a9ea

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 19:12:59 GMT
via
1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
server
Server
age
7396
x-cache
Hit from cloudfront
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://threatpost.com
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
x-amz-cf-pop
FRA60-P1
content-length
662
x-amz-cf-id
v-_wSQxJ4fl1OrekOvgOBN3lpRwwH_H6nq_mCrv4N_vsCqfnGFCIkA==
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.119.176 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-119-176.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
SUwxoOFVf.oGi397tNuwFzfmo0lFzuJd
content-encoding
gzip
etag
W/"a4d296427fc806b21335359e398c025c"
age
49238
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-origin
*
last-modified
Wed, 02 Mar 2022 02:09:50 GMT
server
AmazonS3
date
Thu, 10 Mar 2022 20:29:26 GMT
vary
Origin
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 0dec5f752f0f332c449471a83f050dd2.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
FRA60-P1
x-amz-cf-id
dLHpyd4YeD0Ywz_yVsSnEJJXfN8NBPQx2HXDa_3cjD1uvZgJwadlIw==
pubads_impl_2022030701.js
securepubads.g.doubleclick.net/gpt/ 		364 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
sffe /
Resource Hash
64806986d08d884e0edc911b9fc00398f00fb4fdf7aea5455649092b4875f1fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 19:15:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7275
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
124591
x-xss-protection
0
last-modified
Mon, 07 Mar 2022 20:44:35 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Fri, 10 Mar 2023 19:15:00 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		141 B
737 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=threatpost.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
d4c4215f41a4bb6f12e0d100854eecc6bc5c57ef23af0e945b8359d7727ae94e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
101
x-xss-protection
0
expires
Thu, 10 Mar 2022 21:16:15 GMT
pubcid.min.js
secure.cdn.fastclick.net/js/pubcid/latest/ 		53 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.219.144 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-219-144.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
last-modified
Tue, 01 Jun 2021 17:06:57 GMT
server
Apache
etag
"d398-5c3b75e9ebb41-gzip"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=900
accept-ranges
bytes
content-length
17087
expires
Thu, 10 Mar 2022 21:31:15 GMT
id5-api.js
cdn.id5-sync.com/api/1.0/ 		38 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/id5-api.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.202.126 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
cbbd5676d9c7345483787d39fb83cb6880b4ee7d114e53f5b3df9b217af5f72b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
br
x-cacheable
Matched cache
x-cdn-pop-ip
137.74.120.0/27
date
Thu, 10 Mar 2022 21:05:38 GMT
content-type
text/javascript;charset=utf-8
cache-control
max-age=3600
x-cdn-pop
sbg
content-disposition
attachment;filename="id5-api.js"
accept-ranges
bytes
content-length
10644
x-request-id
136871961
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
4283
date
Thu, 10 Mar 2022 20:04:52 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Thu, 10 Mar 2022 22:04:52 GMT
quant.js
secure.quantserve.com/ 		24 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
b236dccee1a0d5280842bdff52b4005e2b0c9ee5d74a15db3e939c53306576d3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
etag
"yoD6mq4JTyPdtDBolW+GUg=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
expires
Thu, 17 Mar 2022 21:16:15 GMT
uwt.js
static.ads-twitter.com/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
last-modified
Sat, 05 Feb 2022 00:44:37 GMT
etag
"8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache
x-cache
HIT, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
5410
x-served-by
cache-iad-kiad7000148-IAD, cache-hhn11576-HHN
gtm.js
www.googletagmanager.com/ 		415 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
be6f75489b6c2d061c4085b9e67b4ff000ad74513600d361560c67f49ae8652b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
107796
x-xss-protection
0
last-modified
Thu, 10 Mar 2022 21:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 10 Mar 2022 21:16:15 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/_exWVY_hlNJJl2Abm8pI9i1L/ 		360 KB
142 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/_exWVY_hlNJJl2Abm8pI9i1L/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=explicit&ver=202124050927
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
84d00511d9ac2d60f4b43ad8dd4c237a8093c7a45f1e8da88f5c233866d408f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 15:57:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
19152
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
145103
x-xss-protection
0
last-modified
Mon, 28 Feb 2022 23:43:01 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 10 Mar 2023 15:57:03 GMT
id
dpm.demdex.net/ 		368 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=983502BE532960BE0A490D4C%40AdobeOrg&d_nsid=0&ts=1646946975640
Requested by
Host: media.kaspersky.com
URL: https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=5.9.1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.111.225 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-111-225.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a1051ebf75059a19bb11690e1c0ae38f508170a08e04ec1dad1c8c62fdb1bfed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-2-v029-083137965.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
itpMuvZPSYk=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
310
Expires
Thu, 01 Jan 1970 00:00:00 UTC
rules-p-_7kVx0t9Jqj90.js
rules.quantcount.com/ 		2 B
353 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223c:0:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:00:01 GMT
via
1.1 59d5785a1d012a54118141e7e216a492.cloudfront.net (CloudFront)
server
AmazonS3
age
973
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
cross-origin-resource-policy
cross-origin
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA56-P2
content-length
2
x-amz-cf-id
wRoGd5WEbeAugw2ANq3v0S6RlOCJ6UqFQKdePo7Hx5l3AL3vc9yr4Q==
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&aip=1&a=436918474&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ul=en-us&de=UTF-8&dt=Microsoft%20Accounts%20Targeted%20by%20Russian-Themed%20Credential%20Harvesting%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1593244679&gjid=1204355590&cid=865144764.1646946976&tid=UA-35676203-21&_gid=1299625775.1646946976&_r=1&gtm=2wg370PM29HLF&z=538423777
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:15 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&aip=1&a=436918474&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ul=en-us&de=UTF-8&dt=Microsoft%20Accounts%20Targeted%20by%20Russian-Themed%20Credential%20Harvesting%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=YEDAAEABAAAAAC~&jid=&gjid=&cid=865144764.1646946976&tid=UA-35676203-21&_gid=1299625775.1646946976&gtm=2wg370PM29HLF&z=698275822
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 09 Mar 2022 23:42:17 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
77638
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
724.json
id5-sync.com/g/v2/ 		213 B
532 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/724.json
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.195.5.38 , France, ASN16276 (OVH, FR),
Reverse DNS
p16.id5-sync.com
Software
/
Resource Hash
950ae7fb1dbd8fd4c849224f7bf9dd7f02912f0d16fb32047c6479a4a5ea7f18
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://threatpost.com
Date
Thu, 10 Mar 2022 21:16:15 GMT
Access-Control-Allow-Credentials
true
Vary
Origin
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/json;charset=UTF-8
localstore.js
script.4dex.io/ 		483 B
940 B 		Script
General
Check archive.org
Download Go to
Full URL
https://script.4dex.io/localstore.js
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
127769
x-amz-request-id
tx9e2734ae1ff24bdbb6982-0062287777
x-amz-id-2
tx9e2734ae1ff24bdbb6982-0062287777
last-modified
Wed, 09 Mar 2022 09:45:16 GMT
server
cloudflare
etag
W/"922cffdd75f7192f75231d92684885aa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FR9QLah8sdmypIONBz3izNGB0NVUNTmXh5kNLkm35gpN3ioTophhoLaJxHppyTw7Jo3%2Fnde3psn2Nr0GXSG7reydO2qFWTUxrflyCW54357vlfxz%2BI9f8TiWsz1KJ1COKv7Kx71wXL731Ofc"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=1800
x-amz-version-id
1646819115209325
cf-ray
6e9f1206f8c092b9-FRA
724.json
id5-sync.com/g/v2/ 		213 B
532 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/724.json
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.195.5.38 , France, ASN16276 (OVH, FR),
Reverse DNS
p16.id5-sync.com
Software
/
Resource Hash
511c99debe7a98083a9bb165bc5ee93de821a4056f82000c657cceb6d41519a6
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://threatpost.com
Date
Thu, 10 Mar 2022 21:16:15 GMT
Access-Control-Allow-Credentials
true
Vary
Origin
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/json;charset=UTF-8
bid
c.amazon-adsystem.com/e/dtb/ 		64 B
533 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&pid=upeXAtLfLo59C&cb=0&ws=1600x1200&v=7.74.0&t=1200&slots=%5B%7B%22sd%22%3A%22div-gpt-ad-6794670-2%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6794670-3%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6794670-5%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6794670-1%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.119.176 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-119-176.fra60.r.cloudfront.net
Software
Server /
Resource Hash
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
via
1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA60-P1
x-amz-rid
J5JVN4ZM7290YAVAVWRW
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
64
x-amz-cf-id
qbVWi5CPAyJ9xxa9tbgMdNK0OTXNMMT5bbWPtIKlhyNSRTA8p46hdw==
blockedDomains_6.bin
lit.connatix.com/08d79ac9-d151-59b7-8ffc-1666f862d246/ Frame AE9B 		88 B
326 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://lit.connatix.com/08d79ac9-d151-59b7-8ffc-1666f862d246/blockedDomains_6.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
7ee7be21d91af71ca9589c2044eb2f4666ac9f7427e73c6dea7d4d0d870b8af4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
last-modified
Tue, 08 Mar 2022 17:33:26 GMT
age
186097
etag
"1f2b4300f4f8d9e0c60e2712121468eb"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
90
sr
capi-tier-2-us-east-2.connatix.com/tr/ Frame AE9B 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-2-us-east-2.connatix.com/tr/sr?v=154208
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.216.183.199 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-216-183-199.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		81 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
sffe /
Resource Hash
48612d697d41f938e9392cd38c1715d982e4ad11d81765aeffe06ec9196d40a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27773
x-xss-protection
0
server
sffe
etag
"1155 / 959 of 1000 / last-modified: 1646914126"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Thu, 10 Mar 2022 21:16:15 GMT
6_media.bin
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/ Frame AE9B 		564 B
580 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/6_media.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
19b1abbb0de5388bec8b3f45f26dfc27c7e48630553559aad0a07026122f27bd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
last-modified
Thu, 25 Feb 2021 03:39:26 GMT
age
108967
etag
"177b62094ff30cad856d864aedd89890"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
342
ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame AE9B 		367 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7492476dfa60f0146889b13e37c67fd1a70e42e6ddb017c0c08e25148fd8985
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
124424
x-xss-protection
0
expires
Thu, 10 Mar 2022 21:16:15 GMT
1.png
img.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/c2ecd04f-0dca-4ffa-8761-d93b34717380/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/c2ecd04f-0dca-4ffa-8761-d93b34717380/1.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
739ab1cbd5fc795c806cfbc012e937834a1d566f02ed72ff02af2700c0629eb4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
br
age
2991174
etag
"CDlq0wWU2N6Hha9Y1OkqKS7K/JyWAUvXYL5GlZ2se8g"
access-control-max-age
86400
fastly-io-info
ifsz=8114 idim=288x42 ifmt=png ofsz=6487 odim=288x42 ofmt=png
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/png
content-length
6487
collect
stats.g.doubleclick.net/j/ 		4 B
441 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-35676203-21&cid=865144764.1646946976&jid=1593244679&gjid=1204355590&_gid=1299625775.1646946976&_u=YEBAAEAAAAAAAC~&z=577566838
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Thu, 10 Mar 2022 21:16:15 GMT
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
dest5.html
kaspersky.demdex.net/ Frame D21B 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://kaspersky.demdex.net/dest5.html?d_nsid=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.255.107.204 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-255-107-204.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding
gzip
Content-Type
text/html;charset=UTF-8
date
Thu, 10 Mar 2022 21:16:16 GMT
DCS
dcs-prod-irl1-1-v029-036945c08.edge-irl1.demdex.com UNKNOWN
Expires
Thu, 01 Jan 1970 00:00:00 UTC
last-modified
Fri, 4 Mar 2022 17:38:30 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
vary
accept-encoding
X-TID
yI/nHGbAQPI=
Content-Length
2791
Connection
keep-alive
id
kaspersky.d3.sc.omtrdc.net/ 		2 B
316 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://kaspersky.d3.sc.omtrdc.net/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=983502BE532960BE0A490D4C%40AdobeOrg&mid=30625287790357303784341966813391233075&ts=1646946975923
Requested by
Host: media.kaspersky.com
URL: https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=5.9.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-36-218-177.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-7f6b754cd4-hlf29
vary
Origin
x-c
main-1629.I879dac.M0-556
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
content-type
application/x-javascript;charset=utf-8
content-length
2
x-xss-protection
1; mode=block
ibs:dpid=411&dpuuid=YipqoAAAAFJ7uAQA
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=26556241689329212323610521727414406761
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YipqoAAAAFJ7uAQA
42 B
943 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YipqoAAAAFJ7uAQA
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
HTTP/1.1
Server
52.215.111.225 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-111-225.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v029-0c4f59260.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
tQlIwx61ROw=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YipqoAAAAFJ7uAQA
Date
Thu, 10 Mar 2022 21:16:16 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
v2
e.serverbid.com/api/ 		711 B
984 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://e.serverbid.com/api/v2
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
134.209.129.254 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Thu, 10 Mar 2022 21:16:16 GMT
access-control-allow-credentials
true
content-length
711
vary
Origin
content-type
application/json
arj
teachingaids-d.openx.net/w/1.0/ 		174 B
591 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=3dc5e07a-1c82-4795-813b-49c14c2e32ae%2C3dc5e07a-1c82-4795-813b-49c14c2e32ae%2C69fa3387-24ef-4281-a338-f407798262b4%2C321d0efe-5502-4981-b8ca-0474fdd5993f%2C321d0efe-5502-4981-b8ca-0474fdd5993f&nocache=1646946975945&gdpr=0&x_gdpr_f=1&id5id=0&pubcid=ada8e5c7-c783-46af-84c1-3ca21468a5c7&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divids=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&aucs=%252F22404337467%252C21707124336%252Fthreatpost-970x250-ATF%2C%252F22404337467%252C21707124336%252Fthreatpost-970x250-ATF%2C%252F22404337467%252C21707124336%252Fthreatpost-300x250-ATF%2C%252F22404337467%252C21707124336%252Fthreatpost-300x600-ATF%2C%252F22404337467%252C21707124336%252Fthreatpost-300x600-ATF&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
443d084812077ec6712c919ad9eb37f26151f52a2b9822573827cca0c9ee4e77

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
content-encoding
gzip
server
OXGW/17.2.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
165
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
auction
tlx.3lift.com/header/ 		19 B
487 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=5.17.0&referrer=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&tmax=1200&gdpr=false
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.185.181.98 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-185-181-98.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
accept-ch
Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width,SecCH-Viewport-Width, Sec-CH-Viewport-Height,Sec-CH-Device-Memory, Sec-CHRTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
prebid
ib.adnxs.com/ut/v3/ 		376 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
8a320365cca763b186df5b19567471ca60e33d41c287bda5a73a9631bc5c83cd
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:16 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
fb5db063-a427-439b-9ea8-90fb5491cf37
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
376
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
prebid
mp.4dex.io/ 		99 B
577 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mp.4dex.io/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:272 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22637db89b1d70be76a1594fa204683657da188de1bc49233a8ea2e235035504

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

cf-ray
6e9f12080a879182-FRA
pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://threatpost.com
expires
0
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-encoding
gzip
x-err
Validating the Prebid Request adunits. Sampled or No valid non-debug AdUnits
c
prebid.a-mo.net/a/ 		0
206 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Thu, 10 Mar 2022 21:16:16 GMT
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
server
envoy
x-envoy-upstream-service-time
684
vary
origin, Accept-Encoding
v1
btlr.sharethrough.com/universal/ 		0
112 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.29.1.115 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-29-1-115.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Thu, 10 Mar 2022 21:16:16 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/universal/ 		0
113 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.29.1.115 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-29-1-115.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Thu, 10 Mar 2022 21:16:16 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/universal/ 		0
112 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.29.1.115 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-29-1-115.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Thu, 10 Mar 2022 21:16:16 GMT
access-control-allow-credentials
true
vary
Origin
translator
hbopenbid.pubmatic.com/ 		0
115 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Thu, 10 Mar 2022 21:16:15 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ 		858 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&eid_id5-sync.com=0%5E1%5E&rf=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&kw=Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy&tg_i.ref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&tg_i.page=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F&tg_i.domain=threatpost.com&tg_i.dfp_ad_unit_code=22404337467%2C21707124336%2Fthreatpost-970x250-ATF&tg_i.pbadslot=22404337467%2C21707124336%2Fthreatpost-970x250-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=3dc5e07a-1c82-4795-813b-49c14c2e32ae&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.07316660173962353
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
eded679506e3297bab085a54c0e0c062ddfcb46f43a34e961d44c53d7e7d0eee

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:16 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
858
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		856 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&eid_id5-sync.com=0%5E1%5E&rf=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&kw=Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy&tg_i.ref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&tg_i.page=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F&tg_i.domain=threatpost.com&tg_i.dfp_ad_unit_code=22404337467%2C21707124336%2Fthreatpost-300x250-ATF&tg_i.pbadslot=22404337467%2C21707124336%2Fthreatpost-300x250-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=69fa3387-24ef-4281-a338-f407798262b4&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.12461943037699075
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
13e3e608a99640f5a7c2b3ae0a38e0d01b0ac6545cf3cf96503d3986cc1d9e4e

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:16 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
856
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		856 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&eid_id5-sync.com=0%5E1%5E&rf=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&kw=Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy&tg_i.ref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&tg_i.page=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F&tg_i.domain=threatpost.com&tg_i.dfp_ad_unit_code=22404337467%2C21707124336%2Fthreatpost-300x600-ATF&tg_i.pbadslot=22404337467%2C21707124336%2Fthreatpost-300x600-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=321d0efe-5502-4981-b8ca-0474fdd5993f&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8296522913589532
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
cc0c786efbbe7567af9d4754502be241a47319e077fbce9f5e91384d5985b8d9

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:16 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
856
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		856 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&eid_id5-sync.com=0%5E1%5E&rf=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&kw=Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy&tg_i.ref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&tg_i.page=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F&tg_i.domain=threatpost.com&tg_i.dfp_ad_unit_code=22404337467%2C21707124336%2Fthreatpost-300x600-ATF&tg_i.pbadslot=22404337467%2C21707124336%2Fthreatpost-300x600-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=321d0efe-5502-4981-b8ca-0474fdd5993f&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.6532872229557363
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
ffd115e2f82505f80c02d8d141620cd10f8edaa9e066294e716863f4af20427c

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:16 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
856
Expires
Wed, 17 Sep 1975 21:32:10 GMT
mvo
tag.1rx.io/rmp/216477/0/ 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/216477/0/mvo?z=1r&hbv=5.17,2.1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.42 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
bid
ap.lijit.com/rtb/ 		94 B
741 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.17.0
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash
13eb644aa7c69a15e7e0a356a8d3901278d54db305211aeb2ee224365f3da8c5

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

Date
Thu, 10 Mar 2022 21:16:16 GMT
Content-Encoding
gzip
Vary
Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap1ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
98
cygnus
htlb.casalemedia.com/ 		37 B
331 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=438654&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22510652682a7831f%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%22%2C%22ref%22%3A%22https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email%22%2C%22domain%22%3A%22threatpost.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22threatpost.com%22%7D%2C%22keywords%22%3A%22Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A4%2C%22msi%22%3A4%2C%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A3%2C%22ren%22%3Afalse%2C%22version%22%3A%225.17.0%22%2C%22userIds%22%3A%5B%22id5id%22%5D%2C%22fpd%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22528055391170441%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-970x250-ATF%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-970x250-ATF%22%2C%22sid%22%3A%22970x250%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-970x250-ATF%22%2C%22sid%22%3A%22970x90%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%2253737909eafc37e%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x250-ATF%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x250-ATF%22%2C%22sid%22%3A%22336x280%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%2254057a4decac093%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x600-ATF%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x600-ATF%22%2C%22sid%22%3A%22300x600%22%7D%7D%5D%7D%7D%5D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.84.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-31-84-150.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ba2bfa49e9c9b015fa91ff873ee8b778f31583ed99a619922abfedc5f22b0fa5

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
x-ak-initial-geo
CC:[DE], RC:[HE], CN:[EU], CIP:[217.114.215.131], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://threatpost.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
37
x-ak-client-geo
12
expires
Thu, 10 Mar 2022 21:16:16 GMT
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6b03bc00b5&pos=threatpost.com_desktop_728x90-atf&cmd=bid&eidid5-sync.com=0&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
47fa83c42634790c68e1c352a9be81c173fdb70c8e0f459fd11da901925ac785

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
291 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6b03bc00b5&pos=threatpost.com_desktop_300x250-atf&cmd=bid&eidid5-sync.com=0&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
380bd23640c07e8589e197c629a8f74d073f8ea0d1eb13e4fa535a7faa45996f

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6b03bc00b5&pos=threatpost.com_desktop_300x600-atf&cmd=bid&eidid5-sync.com=0&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
a2f39e7093ae8158721d77ec51af1a7009b4e389ee231cd16fd42fae1c97babf

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
content-length
62
adreq
ads.servenobid.com/ 		548 B
606 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.servenobid.com/adreq?cb=3506
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.175.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-175-9.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
cd3767c9daaaaf6b31ba6dd8821d1cf09594ffdddb05a60b81d960aa4e2f44e9

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
content-encoding
gzip
amp-access-control-allow-source-origin
*
vary
accept-encoding
content-type
application/json
access-control-allow-origin
https://threatpost.com
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
adsct
t.co/i/ 		43 B
336 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=0ba5f3a7-82f1-4c3e-98cc-583d9ccc51ac&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-response-time
104
date
Thu, 10 Mar 2022 21:16:15 GMT
server
tsa_o
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
b3504ae8a77abddf761bb1b110cdb895280319d5fe01be76b052d72d03e345ac
content-length
43
pixel;r=1414796357;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2...
pixel.quantserve.com/ 		35 B
371 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=1414796357;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email;uht=2;fpan=1;fpa=P0-463493838-1646946975992;pbc=;ns=0;ce=1;qjs=1;qv=b4915a16-20220201183321;cm=;gdpr=0;us_privacy=1---;ref=;d=threatpost.com;je=0;sr=1600x1200x24;dst=0;et=1646946975992;tzo=0;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2022%2F01%2F28114907%2FMicro%2Ctype.article%2Ctitle.Microsoft%20Accounts%20Targeted%20by%20Russian-Themed%20Credential%20Harvesting%2Cdescription.Malicious%20emails%20warning%20Microsoft%20users%20of%20%22unusual%20sign-on%20activity%22%20from%20Russ%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fmicrosoft-accounts-targeted-russian-credential-harvesting
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
ao
capi-tier-2-us-east-2.connatix.com/tr/ Frame AE9B 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-2-us-east-2.connatix.com/tr/ao?v=154208
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.216.183.199 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-216-183-199.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
g
capi-tier-2-us-east-2.connatix.com/rtb/ Frame AE9B 		1 KB
965 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-2-us-east-2.connatix.com/rtb/g?v=154208
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.216.183.199 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-216-183-199.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
a48a2dd5c8d694af984a789271173ee9c7c22502c3fbf9e7c12423e33a9048c2

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
669
bid
c.amazon-adsystem.com/e/dtb/ 		23 B
492 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&pid=upeXAtLfLo59C&cb=1&ws=1600x1200&v=7.74.0&t=2000&slots=%5B%7B%22id%22%3A%22Amazon_400x225%22%2C%22mt%22%3A%22v%22%7D%5D&cfgv=1&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.119.176 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-119-176.fra60.r.cloudfront.net
Software
Server /
Resource Hash
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
via
1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA60-P1
x-amz-rid
HNS4593ZM9W2ACVAB1FV
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
23
x-amz-cf-id
-ODqmHwinGjDX7yqZo-2i4bYkjkOBeOq45FpDVnH5uwHZHSy5tlrPg==
ps
capi-tier-2-us-east-2.connatix.com/tr/ Frame AE9B 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-2-us-east-2.connatix.com/tr/ps?v=154208
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.216.183.199 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-216-183-199.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
1_th.jpg
img.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
289ca8f32c03ad695ffb8da0a83ae0b45caa5bd43c8d2b4af457caa3c94c4696

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
content-encoding
br
age
117178
etag
"HvyggPu0LLuXKYqtAH0leJWS2313YtVyJov3dCZ7DMo"
access-control-max-age
86400
fastly-io-info
ifsz=78470 idim=2560x1440 ifmt=jpeg ofsz=7523 odim=400x225 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
7122
adagio.js
script.4dex.io/ 		72 KB
23 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://script.4dex.io/adagio.js
Requested by
Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84f884ae3edcb8c05f55a2f69a0c8c5484885584acb5c9978572b9f51ad0277e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
126552
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-request-id
txcff83a73279e4968a086e-0062287ad6
x-amz-id-2
txcff83a73279e4968a086e-0062287ad6
last-modified
Wed, 09 Mar 2022 09:45:14 GMT
server
cloudflare
etag
W/"93ca984a268a88c3342d6faa613fdb18"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GL8kRuODVWlWXM%2B%2F53ZbSi47iPlEjYOUyPKtjEurxAJfZbaXv%2FCXnYGoVoH%2F5D2aYaT%2FvMp%2BuHEBfkPFXmfgJ%2B0Ul11Nm0QuN9KQi4TV0g%2F6l82uv5%2F7lufiCh1kuAZet%2BEl0Kv7jhEUXU3F"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=1800
access-control-allow-credentials
true
x-amz-version-id
1646819103449942
cf-ray
6e9f12087d199b43-FRA
access-control-allow-headers
Authorization
flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/ 		236 B
564 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
via
1.1 f49c99d2326b14738507e1c2ddcae1dc.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:05 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fd9-ec"
x-cache
Miss from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
236
x-amz-cf-id
CWJ4cXUbi9HkqizSgFDgx145gBfHfmcsGTCSVpvc6YzOZt_uJR1zqw==
fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:4e00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=11088c92
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
via
1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
last-modified
Wed, 02 Mar 2022 11:07:06 GMT
server
nginx
x-amz-cf-pop
FRA60-P2
etag
"621f4fda-12d68"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
77160
x-amz-cf-id
nFptmvEXYR2Bi25t1XcvEVZt9LZWQzfh6nW4oeMaWr_dwSQqHbyRqA==
v1
geo.ipify.org/api/ 		428 B
627 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://geo.ipify.org/api/v1?apiKey=at_riPAQYz3EiQ6JhsH05bmtozma13RA
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.140.160.2 Ogden, United States, ASN18450 (WEBNX, US),
Reverse DNS
threatintelligenceplatform.com
Software
nginx /
Resource Hash
f3de350a428af5c6cc90503d461eb9305555ca492d887c7f3299e6b585df75b0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:16 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Server
nginx
X-Frame-Options
SAMEORIGIN
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
no-cache, private
Transfer-Encoding
chunked
Connection
keep-alive
adsct
analytics.twitter.com/i/ 		31 B
459 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=0ba5f3a7-82f1-4c3e-98cc-583d9ccc51ac&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&tpx_cb=twttr.conversion.loadPixels
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-response-time
111
date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
server
tsa_o
strict-transport-security
max-age=631138519
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0
x-connection-hash
f516dc7ab9c28bb95b4ac9167c6eecbd402195daa7974938efe5275a78d2c4d6
content-type
application/javascript;charset=utf-8
content-length
57
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-35676203-21&cid=865144764.1646946976&jid=1593244679&_u=YEBAAEAAAAAAAC~&z=1302090576
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-35676203-21&cid=865144764.1646946976&jid=1593244679&_u=YEBAAEAAAAAAAC~&z=1302090576
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
prebid6.7.0-1.js
cds.connatix.com/p/plugins/ Frame CFD6 		456 KB
119 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
084885652dacd1b70a7979e7631caa6fe5985a5c1b872c28dd890d9ea39cec3d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
content-encoding
br
last-modified
Wed, 09 Feb 2022 14:06:45 GMT
age
813914
etag
"c647c6ead685f3c1b8ba4c8a5de1eb5a"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
121193
bridge3.503.0_en.html
imasdk.googleapis.com/js/core/ Frame 7413 		589 KB
191 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.503.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae01f81568274cd06b5147c59eddad07b73d10799cfc76b67223dfc30abfb95a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
195823
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
date
Thu, 10 Mar 2022 08:22:06 GMT
expires
Fri, 10 Mar 2023 08:22:06 GMT
cache-control
public, max-age=31536000
last-modified
Thu, 03 Mar 2022 18:56:31 GMT
content-type
text/html
age
46450
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
client.js
s0.2mdn.net/instream/video/ Frame AE9B 		44 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16746
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 10 Mar 2022 21:16:16 GMT
bridge3.503.0_en.html
imasdk.googleapis.com/js/core/ Frame 014A 		589 KB
191 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.503.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae01f81568274cd06b5147c59eddad07b73d10799cfc76b67223dfc30abfb95a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
195823
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
date
Thu, 10 Mar 2022 08:22:06 GMT
expires
Fri, 10 Mar 2023 08:22:06 GMT
cache-control
public, max-age=31536000
last-modified
Thu, 03 Mar 2022 18:56:31 GMT
content-type
text/html
age
46450
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bridge3.503.0_en.html
imasdk.googleapis.com/js/core/ Frame 4673 		589 KB
191 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.503.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ae01f81568274cd06b5147c59eddad07b73d10799cfc76b67223dfc30abfb95a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
195823
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
date
Thu, 10 Mar 2022 08:22:06 GMT
expires
Fri, 10 Mar 2023 08:22:06 GMT
cache-control
public, max-age=31536000
last-modified
Thu, 03 Mar 2022 18:56:31 GMT
content-type
text/html
age
46450
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 8606 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 20:22:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3228
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:22:28 GMT
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame ED2F 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 20:22:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3228
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:22:28 GMT
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 4257 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 20:22:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3228
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:22:28 GMT
playlist.m3u8
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/45a9267e-1ccf-4e21-a294-e74f49e1c273_/ Frame AE9B 		309 B
272 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/45a9267e-1ccf-4e21-a294-e74f49e1c273_/playlist.m3u8
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
content-encoding
gzip
last-modified
Thu, 25 Feb 2021 03:39:26 GMT
age
119658
etag
"8a966507b13615ecdc1330a4bc9dcfe1"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
164
0.m3u8
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/45a9267e-1ccf-4e21-a294-e74f49e1c273_/ Frame AE9B 		664 B
345 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/45a9267e-1ccf-4e21-a294-e74f49e1c273_/0.m3u8
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
356aea1e84019ba785c13fdb3e8fa8573bb002ed37c73c242a60bee731f2bafa

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
content-encoding
gzip
last-modified
Thu, 25 Feb 2021 03:39:25 GMT
age
119658
etag
"806173549d596d8f8b98b2f80a569319"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
259
cygnus
htlb.casalemedia.com/ Frame CFD6 		36 B
330 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=435871&v=8.1&ac=j&sd=1&nf=1&t=900&r=%7B%22id%22%3A%221cd5153c4eed75%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A1%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.7.0%22%2C%22userIds%22%3A%5B%22pubcid%22%5D%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%222c474c033463f6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%2C%22fl%22%3A%22x%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%5D%2C%22playerSize%22%3A%5B%5B400%2C225%5D%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22skip%22%3A1%2C%22skipmin%22%3A31%2C%22skipafter%22%3A5%2C%22placement%22%3A1%2C%22w%22%3A400%2C%22h%22%3A225%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221005%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2249e4b8c3-9a3f-4df6-8899-e90f91b01ff7%22%7D%5D%7D%5D%2C%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%7D
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.84.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-31-84-150.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c8b94a7e80a79cd62d64f7276e514417e2659849663996d90fec4e09ed5ee4c3

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
x-ak-initial-geo
CC:[DE], RC:[HE], CN:[EU], CIP:[217.114.215.131], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://threatpost.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
36
x-ak-client-geo
12
expires
Thu, 10 Mar 2022 21:16:16 GMT
mvo
tag.1rx.io/rmp/216475/0/ Frame CFD6 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/216475/0/mvo?z=1r&hbv=6.7,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.42 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
mvo
tag.1rx.io/rmp/216476/0/ Frame CFD6 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/216476/0/mvo?z=1r&hbv=6.7,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.42 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
avjp
teachingaids-d.openx.net/v/1.0/ Frame CFD6 		106 B
127 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=9719d380-16be-49be-a593-6fa2c157afe4&nocache=1646946976359&gdpr=0&pubcid=49e4b8c3-9a3f-4df6-8899-e90f91b01ff7&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22skippable%22%3Atrue%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22protocols%22%3A%5B5%2C2%2C3%2C6%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22maxduration%22%3A180%7D%7D%5D%7D&auid=540882779&vwd=400&vht=225&aumfs=250
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
via
1.1 google
server
OXGW/17.2.0
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
106
expires
Mon, 26 Jul 1997 05:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ Frame CFD6 		139 B
833 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
3fef9e04e60498e2a2c9daa0ee83ecd94b5e32d681e8f0a9babb898034adf718
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:16 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
20bef15a-449d-464a-9f62-9cdb57147b48
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
139
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
avjp
teachingaids-d.openx.net/v/1.0/ Frame CFD6 		106 B
127 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=91996414-3c7e-4c09-b52f-535c1cec619f&nocache=1646946976362&gdpr=0&pubcid=49e4b8c3-9a3f-4df6-8899-e90f91b01ff7&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22skippable%22%3Atrue%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22protocols%22%3A%5B5%2C2%2C3%2C6%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22maxduration%22%3A180%7D%7D%5D%7D&auid=540882778&vwd=400&vht=225&aumfs=250
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
via
1.1 google
server
OXGW/17.2.0
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
106
expires
Mon, 26 Jul 1997 05:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ Frame CFD6 		144 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
2fe24ebb4d5333ef883e9e30f37118946283f81e286afdb4b52fde0fc94b8eef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:16 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
ab9d4b62-673d-4456-b0e8-ae41f6d11562
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
144
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame CFD6 		0
59 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Thu, 10 Mar 2022 21:16:15 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
translator
hbopenbid.pubmatic.com/ Frame CFD6 		0
59 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Thu, 10 Mar 2022 21:16:15 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
mvo
tag.1rx.io/rmp/233148/0/ Frame CFD6 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/233148/0/mvo?z=1r&hbv=6.7,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.42 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
openrtb
ads.adaptv.advertising.com/rtb/ Frame CFD6 		0
215 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.122.136.79 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-122-136-79.eu-central-1.compute.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
c
prebid.a-mo.net/a/ Frame CFD6 		0
348 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Thu, 10 Mar 2022 21:16:16 GMT
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
server
envoy
x-envoy-upstream-service-time
247
vary
origin, Accept-Encoding
mvo
tag.1rx.io/rmp/233098/0/ Frame CFD6 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/233098/0/mvo?z=1r&hbv=6.7,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.42 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
cygnus
htlb.casalemedia.com/ Frame CFD6 		37 B
331 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=435870&v=8.1&ac=j&sd=1&nf=1&t=900&r=%7B%22id%22%3A%2227212f7ceb3429c%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A1%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.7.0%22%2C%22userIds%22%3A%5B%22pubcid%22%5D%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2228734d323f72e59%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%2C%22fl%22%3A%22x%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%5D%2C%22playerSize%22%3A%5B%5B400%2C225%5D%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22skip%22%3A1%2C%22skipmin%22%3A31%2C%22skipafter%22%3A5%2C%22placement%22%3A1%2C%22w%22%3A400%2C%22h%22%3A225%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221005%22%2C%22rid%22%3A%224b72ab60-7041-4b09-94b9-ebc8c3546b18%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2249e4b8c3-9a3f-4df6-8899-e90f91b01ff7%22%7D%5D%7D%5D%2C%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%7D
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.84.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-31-84-150.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0a0f7b434f868be40616c4d40c59796ee68072e0417b338473af031451574279

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
x-ak-initial-geo
CC:[DE], RC:[HE], CN:[EU], CIP:[217.114.215.131], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://threatpost.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
37
x-ak-client-geo
12
expires
Thu, 10 Mar 2022 21:16:16 GMT
0.mp4
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/45a9267e-1ccf-4e21-a294-e74f49e1c273_/ Frame AE9B 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/45a9267e-1ccf-4e21-a294-e74f49e1c273_/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
53e7b382748a03aeaa0857aba684ac2fa416f94cdb97566c117b85cab04f668d

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Range
bytes=0-1361

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
last-modified
Thu, 25 Feb 2021 03:39:25 GMT
age
119542
etag
"2f3380213f6c8a14ee62bd9174e0e3fc"
access-control-max-age
86400
content-type
video/mp4
Content-Range
bytes 0-1361/5230516
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
1362
0.mp4
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/45a9267e-1ccf-4e21-a294-e74f49e1c273_/ Frame AE9B 		620 KB
620 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/45a9267e-1ccf-4e21-a294-e74f49e1c273_/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d1e27d303d0f0a3a4e0d99f82c90672dd4a595383fb2f9fba89638eed26abc2b

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Range
bytes=1362-636340

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
last-modified
Thu, 25 Feb 2021 03:39:25 GMT
age
119542
etag
"2f3380213f6c8a14ee62bd9174e0e3fc"
access-control-max-age
86400
content-type
video/mp4
Content-Range
bytes 1362-636340/5230516
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
634979
g
capi-tier-2-us-east-2.connatix.com/rtb/ Frame AE9B 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-2-us-east-2.connatix.com/rtb/g?v=154208
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.216.183.199 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-216-183-199.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
web-vitals.umd.js
unpkg.com/web-vitals@2.1.4/dist/
Redirect Chain
  • https://unpkg.com/web-vitals
  • https://unpkg.com/web-vitals@2.1.4
  • https://unpkg.com/web-vitals@2.1.4/dist/web-vitals.umd.js
5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/web-vitals@2.1.4/dist/web-vitals.umd.js
Protocol
H2
Server
2606:4700::6810:7baf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
52cac1193a3683e35353723a38e01a9bcc0c5f9bf2be42d29c96905527c7923d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
age
892702
fly-request-id
01FX07QK97S1EG718AGVRWT1F2-fra
content-encoding
br
vary
Accept-Encoding
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
server
cloudflare
etag
W/"120b-0F8cYs4ysxGP6ebngBlASGivDqM"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6e9f120ccc559c07-FRA

Redirect headers

date
Thu, 10 Mar 2022 21:16:16 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
fly-request-id
01FT83NCR2B56DTMGTVPMWMSJ3
server
cloudflare
age
3849703
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
location
/web-vitals@2.1.4/dist/web-vitals.umd.js
cache-control
public, max-age=31536000
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6e9f120c7b899c07-FRA
access-control-allow-origin
*
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=436918474&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&dp=%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ul=en-us&de=UTF-8&dt=Microsoft%20Accounts%20Targeted%20by%20Russian-Themed%20Credential%20Harvesting%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAEABAAAAAC~&jid=2015938740&gjid=52636764&cid=865144764.1646946976&uid=30625287790357303784341966813391233075&tid=UA-63997723-2&_gid=1299625775.1646946976&_r=1&gtm=2wg370WZ7LJ3&cd14=no_locale&cd15=30625287790357303784341966813391233075&cd53=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F99.0.4844.51%20Safari%2F537.36&cd16=865144764.1646946976&z=1145499320
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
4284
date
Thu, 10 Mar 2022 20:04:52 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Thu, 10 Mar 2022 22:04:52 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00::210:ba20 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
c567d0068aa9d314d13047cf6af171cce476501aac5e5521bd2b2233b16fbce5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:16 GMT
Content-Encoding
gzip
Last-Modified
Wed, 09 Mar 2022 20:16:02 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=74268
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3073
js
www.googletagmanager.com/gtag/ 		89 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-9582686
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
03a3f5398aef1378ce76d1e24c6e73a942a2b42a378ca8e74150ad7d0fafb5dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36707
x-xss-protection
0
last-modified
Thu, 10 Mar 2022 21:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 10 Mar 2022 21:16:16 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
25 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-63997723-2&cid=865144764.1646946976&jid=2015938740&uid=30625287790357303784341966813391233075&gjid=52636764&_gid=1299625775.1646946976&_u=aEDAAEABAAAAAC~&z=255622888
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Thu, 10 Mar 2022 21:16:16 GMT
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
0.mp4
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/45a9267e-1ccf-4e21-a294-e74f49e1c273_/ Frame AE9B 		624 KB
625 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/0802c5c7-e1b1-4205-87e5-ab3d4feccb1f/45a9267e-1ccf-4e21-a294-e74f49e1c273_/0.mp4
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ce329cd4eec855a3382ff4539be2a54c34435aae94f94d8b14e972349470b5e5

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Range
bytes=636341-1275649

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
last-modified
Thu, 25 Feb 2021 03:39:25 GMT
age
119542
etag
"2f3380213f6c8a14ee62bd9174e0e3fc"
access-control-max-age
86400
content-type
video/mp4
Content-Range
bytes 636341-1275649/5230516
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
639309
js
www.googletagmanager.com/gtag/ 		171 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-YP1JLG57CH&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-9582686
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d39688d694f5488ae394bc24b2bf5f278cbb53d8368d9fd6b2163fba5c4155df
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
64518
x-xss-protection
0
expires
Thu, 10 Mar 2022 21:16:16 GMT
mq
capi-tier-2-us-east-2.connatix.com/tr/ Frame AE9B 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-2-us-east-2.connatix.com/tr/mq?v=154208
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.216.183.199 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-216-183-199.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Thu, 10 Mar 2022 21:16:15 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1646946976749&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3F_hsenc%3Dp2ANq...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D39138%26time%3D1646946976749%26url%3Dhttps%253A%252F%252Fthreatpost.com%252Fmicro...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1646946976749&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3F_hsenc%3Dp2ANq...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1646946976749&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3F_hsenc%3Dp2AN...
0
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1646946976749&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3F_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_content%3D206456747%26utm_source%3Dhs_email%26utm_medium%3Demail%26_hsmi%3D206456747&liSync=true&e_ipv6=AQIPptevaJiVPQAAAX91sIXyP8WvOaUqO3VJsok3sBKkWGBpz07B2bveePoH_5_YSd2TcNbC5gHA8elGqsf1PZ6EQ77lSA
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:16 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 5614AE94CC4847B1B988FFAB8B9BA973 Ref B: FRAEDGE1417 Ref C: 2022-03-10T21:16:17Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-proto
http/2
content-length
0
x-li-uuid
AAXZ47mOd+4XtDDUV3KFuA==
x-li-fabric
prod-ltx1

Redirect headers

date
Thu, 10 Mar 2022 21:16:16 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 41D48BCDF3E54B82BC600234D4FF04DC Ref B: FRAEDGE1313 Ref C: 2022-03-10T21:16:17Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1646946976749&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3F_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_content%3D206456747%26utm_source%3Dhs_email%26utm_medium%3Demail%26_hsmi%3D206456747&liSync=true&e_ipv6=AQIPptevaJiVPQAAAX91sIXyP8WvOaUqO3VJsok3sBKkWGBpz07B2bveePoH_5_YSd2TcNbC5gHA8elGqsf1PZ6EQ77lSA
x-li-proto
http/2
content-length
0
x-li-uuid
AAXZ47mLC5Wg50z8mg+EhQ==
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-63997723-2&cid=865144764.1646946976&jid=2015938740&_u=aEDAAEABAAAAAC~&z=1614414296
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-63997723-2&cid=865144764.1646946976&jid=2015938740&_u=aEDAAEABAAAAAC~&z=1614414296
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accoun...
9582686.fls.doubleclick.net/ Frame D422
Redirect Chain
  • https://9582686.fls.doubleclick.net/activityi;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-acco...
  • https://9582686.fls.doubleclick.net/activityi;dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=t...
1 KB
716 B 		Document
General
Check archive.org
Download Go to
Full URL
https://9582686.fls.doubleclick.net/activityi;dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F;u6=;u7=30625287790357303784341966813391233075-865144764.1646946976;u9=_microsoft-accounts-targeted-russian-credential-harvesting_178698_;~oref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-9582686
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f6.1e100.net
Software
cafe /
Resource Hash
cbdbc42844b93e9491e321c96f1c7e23e72b4615eab7e8d75b5c9e3bd2056b16
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 10 Mar 2022 21:16:17 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
691
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 10 Mar 2022 21:16:16 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://9582686.fls.doubleclick.net/activityi;dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F;u6=;u7=30625287790357303784341966813391233075-865144764.1646946976;u9=_microsoft-accounts-targeted-russian-credential-harvesting_178698_;~oref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
collect
www.google-analytics.com/g/ 		0
17 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-YP1JLG57CH&gtm=2oe370&_p=436918474&sr=1600x1200&ul=en-us&cid=865144764.1646946976&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&dt=Microsoft%20Accounts%20Targeted%20by%20Russian-Themed%20Credential%20Harvesting%20%7C%20Threatpost&sid=1646946976&sct=1&seg=0&en=page_view&_fv=1&_ss=1&ep.pageType=other&ep.businessType=b2c&ep.siteType=Default&ep.siteClass=Websites&ep.siteLocale=%5BNULL%5D&ep.pageName=websites%20%3E%20microsoft-accounts-targeted-russian-credential-harvesting%2F178698&ep.campaign=&ep.acCampaignId=&ep.omnitureVisitorId=30625287790357303784341966813391233075
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-YP1JLG57CH&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:16 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
integrator.js
adservice.google.de/adsid/ 		107 B
792 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		58 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1423848467349928&correlator=2639579878918375&eid=31061690%2C31063247%2C44758228&output=ldjh&gdfp_req=1&vrg=2022030701&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&sc=1&iu_parts=22404337467%3A21707124336%2Cthreatpost-970x250-ATF%2Cthreatpost-300x250-ATF%2Cthreatpost-300x600-ATF%2Cthreatpost-2x2-Skin%2Cthreatpost-AdX-Interstitial&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2%2C1x1&sfv=1-0-38&ecs=20220310&ists=1&fas=0%2C0%2C0%2C0%2C8&fsapi=false&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fmicrosoft-accounts-targeted-russian-credential-harvesting%252F178698%252F%26urlquery%3Dgoogfc%26contentid%3D178698%26category%3Dweb-security%26contenttags%3D&cookie_enabled=1&abxe=1&dt=1646946976991&lmt=1646946976&dlt=1646946974020&idt=1750&biw=1600&bih=1200&oid=2&adxs=436%2C1082%2C1082%2C0%2C-9&adys=8%2C166%2C1211%2C8%2C-9&ucis=1%7C2%7C3%7C4%7C5&adks=4166723991%2C1414505084%2C1356251026%2C3771495681%2C2643643476&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&frm=20&vis=1&scr_x=0&scr_y=0&psz=728x0%7C300x0%7C300x0%7C1600x0%7C0x-1&msz=728x0%7C300x0%7C300x0%7C1600x0%7C0x-1&fws=0%2C0%2C0%2C0%2C2&ohw=0%2C0%2C0%2C0%2C0&ga_vid=865144764.1646946976&ga_sid=1646946977&ga_hid=436918474&ga_fc=true&btvi=0%7C0%7C1%7C0%7C-1&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
3269e45f9b952b460e8a94f247c5ca2b41c3b685126bf9d36be21aa1d0953f9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11378
x-xss-protection
0
google-lineitem-id
5792876106,5794282999,5794835207,-2,-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138364533266,138364581378,138364525301,-2,-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		14 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022030701&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
307468c466035ab0e9176bb3e5d6c02edddca2dc2ed8268e906ffde723f0cccb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10632
x-xss-protection
0
container.html
59bf77f101e2a5c2e3c052a9c0f9547d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 8736 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://59bf77f101e2a5c2e3c052a9c0f9547d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Thu, 10 Mar 2022 21:16:17 GMT
expires
Fri, 10 Mar 2023 21:16:17 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
pubads_impl_page_level_ads_2022030701.js
securepubads.g.doubleclick.net/gpt/ 		36 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022030701.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022030701.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
sffe /
Resource Hash
a4ad8a4c4d23720b5cd68054e212751a2ad4a2bf8add55dbd817f1e0fd2bcded
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Mon, 07 Mar 2022 23:10:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
252320
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13463
x-xss-protection
0
last-modified
Mon, 07 Mar 2022 20:44:35 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Tue, 07 Mar 2023 23:10:57 GMT
s51978232091635
kaspersky.d3.sc.omtrdc.net/b/ss/kaspersky-single-suite/1/JS-2.22.3/ 		43 B
244 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kaspersky.d3.sc.omtrdc.net/b/ss/kaspersky-single-suite/1/JS-2.22.3/s51978232091635?AQB=1&ndh=1&pf=1&t=10%2F2%2F2022%2021%3A16%3A17%204%200&mid=30625287790357303784341966813391233075&aamlh=6&ce=UTF-8&ns=kaspersky&cdp=2&pageName=websites%20%3E%20microsoft-accounts-targeted-russian-credential-harvesting%2F178698&g=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5&cc=USD&ch=websites&server=threatpost.com&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=other&c3=b2c&v3=websites%20%3E%20microsoft-accounts-targeted-russian-credential-harvesting%2F178698&v9=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&c20=url&c29=v1%3As_code_single_suite.js%3AtrackPageView%20%3E%20sng.t%3Ap&c30=v1%3A20220221%3A286%3ANextGen%3A%5BNULL%5D&c31=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F&v44=D%3Dv3&c47=Default&v47=D%3Dc47&c51=Websites&c57=%5BNULL%5D&v57=D%3Dc57&c58=Microsoft%20Accounts%20Targeted%20by%20Russian-Themed%20Credential%20Harvesting%20%7C%20Threatpost&v71=v1%3APage%20View%3A%5BNULL%5D&v86=v1%3Ahs_email%3Aemail%3AThis%20Week%20in%20ReversingLabs%3A%5BNULL%5D%3A206456747&v113=30625287790357303784341966813391233075&v116=865144764.1646946976&v125=0.499502179518742_1646946975642&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&-g=myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&mcorgid=983502BE532960BE0A490D4C%40AdobeOrg&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-36-218-177.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:17 GMT
x-content-type-options
nosniff
x-c
main-1629.I879dac.M0-556
p3p
CP="This is not a P3P policy"
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Fri, 11 Mar 2022 21:16:17 GMT
server
jag
xserver
anedge-7f6b754cd4-6fgqg
etag
3536791702349316096-4619611001472227873
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Wed, 09 Mar 2022 21:16:17 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:16:17 GMT
dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targete...
adservice.google.com/ddm/fls/i/ Frame 6DE6 		1 KB
715 B 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/ddm/fls/i/dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F;u6=;u7=30625287790357303784341966813391233075-865144764.1646946976;u9=_microsoft-accounts-targeted-russian-credential-harvesting_178698_;~oref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email
Requested by
Host: 9582686.fls.doubleclick.net
URL: https://9582686.fls.doubleclick.net/activityi;dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F;u6=;u7=30625287790357303784341966813391233075-865144764.1646946976;u9=_microsoft-accounts-targeted-russian-credential-harvesting_178698_;~oref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email?
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
010792043e3dcbf986df59204a8fe6f2884dbe370082ac5dda69891b3336e15d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://9582686.fls.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 10 Mar 2022 21:16:17 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
692
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 93B4 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length
5046
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
date
Thu, 10 Mar 2022 19:20:37 GMT
expires
Fri, 10 Mar 2023 19:20:37 GMT
cache-control
public, max-age=31536000
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
content-type
text/html
age
6940
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame D3D0 		783 B
535 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
8aceba9e8cee57a5e42f954ff050f6baffbd87600ffe4092a9f859b55d490ed7
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-ryL4U01uQ14paToR9qV4ng' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy
require-corp
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires
Thu, 10 Mar 2022 21:16:17 GMT
date
Thu, 10 Mar 2022 21:16:17 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-ryL4U01uQ14paToR9qV4ng' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
513
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
sodar
pagead2.googlesyndication.com/pagead/ Frame D3D0 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022030701&jk=1423848467349928&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers
dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targete...
adservice.google.de/ddm/fls/i/ Frame 017D 		194 B
199 B 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/ddm/fls/i/dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F;u6=;u7=30625287790357303784341966813391233075-865144764.1646946976;u9=_microsoft-accounts-targeted-russian-credential-harvesting_178698_;~oref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email
Requested by
Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CIuhlsy7vPYCFQLeGwodVEAAdA;src=9582686;type=globalc;cat=globa0;ord=3959853156655;gtm=2od370;auiddc=925028702.1646946977;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F;u6=;u7=30625287790357303784341966813391233075-865144764.1646946976;u9=_microsoft-accounts-targeted-russian-credential-harvesting_178698_;~oref=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://adservice.google.com/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 10 Mar 2022 21:16:17 GMT
expires
Thu, 10 Mar 2022 21:16:17 GMT
cache-control
private, max-age=0
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
177
x-xss-protection
0
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
hbjI8xylHpjavQyfdphvo41Bfdkh_RgUM1b0sbpcRZI.js
pagead2.googlesyndication.com/bg/ Frame 93B4 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/hbjI8xylHpjavQyfdphvo41Bfdkh_RgUM1b0sbpcRZI.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
85b8c8f31ca51e98dabd0c9f76986fa38d417dd921fd18143356f4b1ba5c4592
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 09 Mar 2022 10:11:40 GMT
content-encoding
br
x-content-type-options
nosniff
age
126277
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13728
x-xss-protection
0
last-modified
Tue, 01 Mar 2022 17:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 09 Mar 2023 10:11:40 GMT
bl-92ee7c4-c5ba5efc.js
tagan.adlightning.com/math-aids-threatpost/ Frame B449 		42 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-92ee7c4-c5ba5efc.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.139.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-139-110.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b13a70bbf9440ad94f2108d762ca3db168fc275d6389538dfb0f032b18d5975f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 09 Mar 2022 23:37:00 GMT
content-encoding
gzip
age
77958
x-cache
Hit from cloudfront
content-length
17921
x-amz-meta-git_commit
92ee7c4
last-modified
Wed, 09 Mar 2022 22:36:37 GMT
server
AmazonS3
etag
"ad102c3990b861a93224b547049fd6a9"
x-amz-version-id
bVh6vHYGCZJSJO2e5ZulPSWfjYynPfxF
via
1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P4
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
4QCi8LhU544GsoPZXzs3ces38tYY-Vjzu6DiFAlXFpsuLbkjeOmHmQ==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame B449 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.139.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-139-110.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 05 Feb 2022 22:56:33 GMT
content-encoding
gzip
age
2845184
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P4
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
xfENWgHCrHHzur1fVVYhhAufiudDWy1MRmeVjEvr6NByx6A1XrwDiw==
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame B449 		152 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
61c79ef2330e73c9def8133c8a6838a9c2082add2fe515f939f6c3f90409c77d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
53827
x-xss-protection
0
server
cafe
etag
5856275162394999640
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 10 Mar 2022 21:16:17 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame B449 		117 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ec068031a38f2d97255ddf90e6d75a5538a3b0ea29510482d1909c5a1a10ad74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36343
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1646830771070120"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:16:17 GMT
bl-92ee7c4-c5ba5efc.js
tagan.adlightning.com/math-aids-threatpost/ Frame 519E 		42 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-92ee7c4-c5ba5efc.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.139.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-139-110.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b13a70bbf9440ad94f2108d762ca3db168fc275d6389538dfb0f032b18d5975f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 09 Mar 2022 23:37:00 GMT
content-encoding
gzip
age
77958
x-cache
Hit from cloudfront
content-length
17921
x-amz-meta-git_commit
92ee7c4
last-modified
Wed, 09 Mar 2022 22:36:37 GMT
server
AmazonS3
etag
"ad102c3990b861a93224b547049fd6a9"
x-amz-version-id
bVh6vHYGCZJSJO2e5ZulPSWfjYynPfxF
via
1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P4
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
JujJ4EuP1AktW1q4M_WULEu0rPKaSS99uGvn-P4IDEBvbvYjPJuzGg==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame 519E 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.139.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-139-110.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 05 Feb 2022 22:56:33 GMT
content-encoding
gzip
age
2845184
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P4
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
D_C0qtPmCZGeE74cdJKgF1_O1FLCE5dFmzV-2HdwtlZfYu1EXwiGJw==
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame 519E 		155 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
654b439253ed177cd570490cf72e6d38126dd6a03797b3a22f8628501c9387df
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54769
x-xss-protection
0
server
cafe
etag
3008405807741390265
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 10 Mar 2022 21:16:17 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 519E 		117 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ec068031a38f2d97255ddf90e6d75a5538a3b0ea29510482d1909c5a1a10ad74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36343
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1646830771070120"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:16:17 GMT
bl-92ee7c4-c5ba5efc.js
tagan.adlightning.com/math-aids-threatpost/ Frame 58A1 		42 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-92ee7c4-c5ba5efc.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.139.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-139-110.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b13a70bbf9440ad94f2108d762ca3db168fc275d6389538dfb0f032b18d5975f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 09 Mar 2022 23:37:00 GMT
content-encoding
gzip
age
77958
x-cache
Hit from cloudfront
content-length
17921
x-amz-meta-git_commit
92ee7c4
last-modified
Wed, 09 Mar 2022 22:36:37 GMT
server
AmazonS3
etag
"ad102c3990b861a93224b547049fd6a9"
x-amz-version-id
bVh6vHYGCZJSJO2e5ZulPSWfjYynPfxF
via
1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P4
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
i84hXuvhDzUGjm74WtQK1-TGrLUuqqaBRNEtjOsHsgckECKJnGGAyg==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame 58A1 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.139.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-139-110.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 05 Feb 2022 22:56:33 GMT
content-encoding
gzip
age
2845184
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 7bf0fe9eca07efaffe6363062053f386.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P4
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
RDxcGYEL0_3k1wTC_M2OPlbvLV6UA37Oou0mrDnJWwNYgf2nb4wiNA==
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame 58A1 		155 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e206e4b3b96e0033f6dbd6cf17e2458f118000c43ab90a5e17683b4ae3ecacc2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54688
x-xss-protection
0
server
cafe
etag
13898834563345567576
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 10 Mar 2022 21:16:17 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 58A1 		117 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ec068031a38f2d97255ddf90e6d75a5538a3b0ea29510482d1909c5a1a10ad74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36343
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1646830771070120"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:16:17 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 519E 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssyi5SGBdZlmLw__kCss7a7JQ9FpPTZhg8oRk4OpVu20RqqCKITbWGSzIxQDpTZbYqz2kqFx2Cp5pdzXGrrOnYwac8T02r8hJZ2E8AjvmeVgC-jYDBVEhc2TL_sh9SRVSaLfTu7wo69lM_4UChYPAtI2v0M7f8W5ykrnoyKJsZlZfJKR3HZ8xK-AzzyVEAXrXUOCGhwiCAaMNxFYjLJMhWpnIiD8ihWqTiydeDLXvAC51AMyiCMLriuqxAhc6SDDr_b6UZRxGk59fWx-_j1lGuOoDK7TNZCF4Z18LfOUMRdARyukW97mcZPOw1ND4-MEdv8N840&sai=AMfl-YQUfEdG_sqlxw_AL_q4L-TC6ZKrm67cRDXuK_luGtOM_DBqhmsTBITzpYRkVTzz-F54ZGl667xUqpcMNvkceqB6T6rEeT7EF7CEA-8gFUC02jnfCSmcTacBh6W7Y2LA&sig=Cg0ArKJSzKGPhZn3JhHkEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:17 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Thu, 10 Mar 2022 21:16:17 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 58A1 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsssXb0b2YO7IcF_sbxJEjUAG_VUSJUFYj6nJCrCI6OkoR3ZMND6gNOk46k1Qn-KZDxjZe8r7Zs-_1IxvQgAoK4bOEx7nQItGV5SNDtDYq8gIBTOfkE2hNGpI-pK9Hz0Pox4fV5krWeyqaF51cfC-VygKjrqag8H5IAohJ_hZB_YYXPCpN13SJuJfJXke24-MH_h5VL1nWYf6rwbqeYJUQE98QAUq1CvWahYyp6XQg6uIYDA7_mvqahSSOzRvg8lxNdPFM5D03Cnb0yP-5XVd-lmzkpsYVZ1G7GbhTpdyc89hPUzwYeoWxrgt1nJIw8tl9H6w-tW&sai=AMfl-YSxd_eDwpcmQ3Vgg_nMerqgUZ0L6ezRduHjZczdCUa5bGSge31hDjQTE7s5oPJEP9LqqPcLxYhRexYGoZ6tTXfKRse8J1DPZH9TrYZ_yikjJtVobnBBNGN4NUhdBerZ&sig=Cg0ArKJSzDGyORYtlmRvEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:17 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
view
securepubads.g.doubleclick.net/pcs/ Frame B449 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstcE-0WnKQdx_MXQ1a02VWZ2brREstn4LMa8WQ4VcT8juXdGH3DyozwE4sOdJlBPyPmwG3MX1OzZYkkjygOiiUgqIjkQ1su2LY4uiOneV7aFp_xXgA2t6YxqEmI9Jo_ccTmk-MCJbuIvX1veUYzdIQbYiHs9sFrLh0kwLir_UARNx6sTSeeK2MHmGzSEbQOOoEXtyjiUnV0b0QNvmliVeZVpfFQUFDfRab7wux2cGO838FBO6Axd5QgJmzYATnyUmmgCUlxmhLQzpowiWvrBj0Sw2Lt9NkWKoNwKdiJVinx9SZHebucP1F5aDubHPPo5K_47Qdt&sai=AMfl-YQpyo7dH8bZkkbGYTRbJvgAtyo805r8Kz52KAXKRJRq6RXjIuM-Sph3LXDC8QDo6Cel5493T0-_4KIEAZSGlKJPhOiMruvCHtF8M_UISWv96rCLNbe5jTa2PHoqxKjl&sig=Cg0ArKJSzKDZSHMETAtzEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/microsoft-accounts-targeted-russian-credential-harvesting/178698/?utm_campaign=This%20Week%20in%20ReversingLabs&utm_medium=email&_hsmi=206456747&_hsenc=p2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw&utm_content=206456747&utm_source=hs_email
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:17 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
truncated
/ Frame B449 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8d713e04531efe2242b16d8fe8fe69c1b95ef7fc99d4a85fdbb695f7fb5a5f91

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203030101/ Frame B449 		292 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203030101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7500593236707325&plah=threatpost.com&bust=31065566
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7aaca292221d94693d7393d6d84e9cd350483358fccd88c048c9706e002c8400
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
107532
x-xss-protection
0
server
cafe
etag
17717895501999580697
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Thu, 10 Mar 2022 21:16:17 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20220308/r20190131/ Frame EED2 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20220308/r20190131/zrt_lookup.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4502
x-xss-protection
0
date
Thu, 10 Mar 2022 00:08:55 GMT
expires
Thu, 24 Mar 2022 00:08:55 GMT
cache-control
public, max-age=1209600
age
76042
etag
4044455266028820542
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 519E 		210 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9078a8da2ef1c28c12e550b82caa0c1924de2ef49aacc471aab4318f948376f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 58A1 		211 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5b1ef120b8cafab218068320e792cfe2155df8a5e8f77b1992d86e202130def2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203070101/ Frame 519E 		294 KB
106 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203070101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7500593236707325&plah=threatpost.com&bust=31065574
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9b2768ec59412bbaf92b5ce4405dff00a4e08af74a4226ff5d930d5816d48310
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
108462
x-xss-protection
0
server
cafe
etag
546510563897486632
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Thu, 10 Mar 2022 21:16:18 GMT
sv
capi-tier-2-us-east-2.connatix.com/tr/ Frame AE9B 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-2-us-east-2.connatix.com/tr/sv?v=154208
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.216.183.199 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-216-183-199.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Thu, 10 Mar 2022 21:16:17 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
generate_204
tpc.googlesyndication.com/ Frame 93B4 		0
9 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?UMlKwQ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203080101/ Frame 58A1 		294 KB
106 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203080101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7500593236707325&plah=threatpost.com&bust=31065595
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
db2f97866b2059c564f5b8b3b53c5ff2835672c09ccff1ed22385bc2515a961b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
108393
x-xss-protection
0
server
cafe
etag
5707863004671953362
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Thu, 10 Mar 2022 21:16:18 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame B449 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv9MfdgzVg7uJ3xkPCuuzxAQWzgDj3k-QM9Vs3C9MMKOlsugaNkqSs7vR6gb7nBS8zTo9T-G3XzZd9mB7H6TikkfGxWB56_2fDFCA95ZjgCWWCNLO1D1_nlDALrqMRGcRJm-IT0HqBEcYaRdKSQ_p0ztjP9mOub8Wy3oZvNJTFc7zNWj9w0OsLtMJMrraeWXVkEvN91APNpwUgIe38DUdn2UUTj2CBju7h_7HcgbvB1ws2tMna-U1xV6cMk44YYKD7qt0t18SLlU8aZ1M-nzYKG7A4q_jCZysY9oIW1UR-BFtuc8CjQ4ilcm6pLHkcTEfkY4dwXQ6k&sai=AMfl-YRZfm2EKjWN-ZnSOGyN_3bRQwkdukF6JzeYQWhfs48ZxtLM9isoA5W--HI6pWHssG5A6y-Stg9ZIbt6p6savZpFqT6W4cc4ARORa9a1oA5QuM2ioFdlU7jdTuQsG5-b&sig=Cg0ArKJSzP9yeD4ImnUqEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Thu, 10 Mar 2022 21:16:18 GMT
cookie.js
partner.googleadservices.com/gampad/ Frame B449 		12 B
247 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=threatpost.com&callback=_gfp_s_&client=ca-pub-7500593236707325&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ Frame B449 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame B449 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame B3D7 		32 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
73db106d0237846f0e0ebb683af75de25b0f4ca921da823747473788ac1cef37
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Thu, 10 Mar 2022 21:16:18 GMT
server
cafe
content-length
12482
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
sodar
pagead2.googlesyndication.com/getconfig/ Frame B449 		14 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220308&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203030101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7500593236707325&plah=threatpost.com&bust=31065566
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
16114b450bf691dd524d3c0e2125de311faf6a254838b6078c0a45535806219b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10681
x-xss-protection
0
view
securepubads.g.doubleclick.net/pcs/ Frame 519E 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssfrQUXLcds6Onf5r669mOffk4HJM9kDJXdj2SSOVwq0nFE-vQwwFr75zRuODJ3i0dN2cXKeskAf524Ba0qxiSXBf0c3GCZIeeZVyp9mrUgYHvIx6kR66WJ2B1Zh5AdzcqgmWS0vYHXOEO_DleEBk5iV4i9fGLJx4ePB63z-9BFgP5p7ct_llR38JZCo-mkrHPf6tebX2d2V4c9W8M03NVkxFPf1Pg85MDYLjXxbtzOwnvmzcKf871oRvccXaSTzJw3Z8B2MGn4TQJ7yS9aNwD_N0JN_91xVy-KJLAc4JeOLbtGoXvD4Nrncvb_vr77r_8KFLP-QJE&sai=AMfl-YR9xOl_AOxuDr37wvL76IMlJzIOb3fapviIINfvpS-OnpizDyS9rXYFoqAagNQ-zIpTMHKEfeW9K21S0m3l161N_29Jbfx630vX0kaZTzdfolFb5z2DutVZxPqh99aX&sig=Cg0ArKJSzG-9aofkg6jMEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Thu, 10 Mar 2022 21:16:18 GMT
cookie.js
partner.googleadservices.com/gampad/ Frame 519E 		12 B
53 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=threatpost.com&callback=_gfp_s_&client=ca-pub-7500593236707325&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ Frame 519E 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 519E 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame FCB8 		32 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3d185748c9add785702fd1b8ecc0984e2913c715a5584deb0ebd48a080bf7de2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Thu, 10 Mar 2022 21:16:18 GMT
server
cafe
content-length
12443
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
sodar
pagead2.googlesyndication.com/getconfig/ Frame 519E 		13 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220308&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203070101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7500593236707325&plah=threatpost.com&bust=31065574
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
189474137e3d1b04badc67e2c55c9cb9f9875e3c01c77b2c300f6f1c64bc24ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10451
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ Frame B449 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:16:18 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 58A1 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvj1945kNdDok8XqoqDDcSSzT-er0czQDBBoE1s6POAtGhrBQbr2yIytUSMj3DWBrWDNh6ycsgEFrv0gpe-D3xPOQRTsMnD0flSOfid4VUPZZcCUtXg822Dr3H-IQqEMTXLCdXGTRojDq0Mn0uz1FSDwyawb2-SZdNS7Q-CT_Hit8RKrmIM6voIRRjrCR1_9F00XUqkTvBKHCV_L-oE9iFoZNbDelmQM2H32f7Ue2fNxLwCT-Wo9nXLk1C62gK8-EcrTy1Rif8zJQydubqcdk5iqatEmpclSgv0neTbrcAlqDh6qYV2l34c3FXkeF_NmHvgr8hm740&sai=AMfl-YTG015YlqSI3VaOktzj31bM9FDkXoxfCxAtJ6VfbVRe5OD-JRSZQDlf8QQ3hzgjLJidPkIsoaAz2pCc3uM8fJ_8TNx6c5Idqob-3smJ5d2z_gkODvSm61tklJImKcWW&sig=Cg0ArKJSzNu_yoxs_jxFEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Thu, 10 Mar 2022 21:16:18 GMT
cookie.js
partner.googleadservices.com/gampad/ Frame 58A1 		12 B
53 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=threatpost.com&callback=_gfp_s_&client=ca-pub-7500593236707325&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ Frame 58A1 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 58A1 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 1CB8 		27 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0c213878fbc1d369aaa1c9c7ffdd1269322371c74be124ff4809cd6cb6e8960f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Thu, 10 Mar 2022 21:16:18 GMT
server
cafe
content-length
11935
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
sodar
pagead2.googlesyndication.com/getconfig/ Frame 58A1 		14 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220308&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203080101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7500593236707325&plah=threatpost.com&bust=31065595
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7c9fb31b8fc71d7280f2de2d6a791d6c0febce4b95e3da5acc07d2d561092fbe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10736
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 519E 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:16:18 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame F48C 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length
5046
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
date
Thu, 10 Mar 2022 19:20:37 GMT
expires
Fri, 10 Mar 2023 19:20:37 GMT
cache-control
public, max-age=31536000
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
content-type
text/html
age
6941
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame FABD 		783 B
536 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
f7fa16318dc480af20d576dd448a1d5ecf4f2a1cfefd77622111817ac2a54194
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-WqlGlYlw43IF4l34AzEE9w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy
require-corp
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires
Thu, 10 Mar 2022 21:16:18 GMT
date
Thu, 10 Mar 2022 21:16:18 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-WqlGlYlw43IF4l34AzEE9w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
514
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 58A1 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:16:18 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 2CA7 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length
5046
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
date
Thu, 10 Mar 2022 19:20:37 GMT
expires
Fri, 10 Mar 2023 19:20:37 GMT
cache-control
public, max-age=31536000
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
content-type
text/html
age
6941
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame 390D 		783 B
535 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
38586ee391e065406aeb39b262d399bf32085d6724151d00f37f3b8e6b3eb8b2
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-4RD9OGiVrwHAgIlsarlu3Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy
require-corp
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires
Thu, 10 Mar 2022 21:16:18 GMT
date
Thu, 10 Mar 2022 21:16:18 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-4RD9OGiVrwHAgIlsarlu3Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
513
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
hbjI8xylHpjavQyfdphvo41Bfdkh_RgUM1b0sbpcRZI.js
pagead2.googlesyndication.com/bg/ Frame F48C 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/hbjI8xylHpjavQyfdphvo41Bfdkh_RgUM1b0sbpcRZI.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
85b8c8f31ca51e98dabd0c9f76986fa38d417dd921fd18143356f4b1ba5c4592
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 09 Mar 2022 10:11:40 GMT
content-encoding
br
x-content-type-options
nosniff
age
126278
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13728
x-xss-protection
0
last-modified
Tue, 01 Mar 2022 17:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 09 Mar 2023 10:11:40 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame FABD 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220308&jk=3023269658188208&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame D282 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length
5046
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
date
Thu, 10 Mar 2022 19:20:37 GMT
expires
Fri, 10 Mar 2023 19:20:37 GMT
cache-control
public, max-age=31536000
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
content-type
text/html
age
6941
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame 37A5 		783 B
535 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
7bfc2055694a04e00bedd6a25a1b130b96cc7a4c35309f36e46d9322ea29b028
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-Lk4XZtpD54ocWiwktLc+3w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy
require-corp
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires
Thu, 10 Mar 2022 21:16:18 GMT
date
Thu, 10 Mar 2022 21:16:18 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-Lk4XZtpD54ocWiwktLc+3w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
513
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
hbjI8xylHpjavQyfdphvo41Bfdkh_RgUM1b0sbpcRZI.js
pagead2.googlesyndication.com/bg/ Frame 2CA7 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/hbjI8xylHpjavQyfdphvo41Bfdkh_RgUM1b0sbpcRZI.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
85b8c8f31ca51e98dabd0c9f76986fa38d417dd921fd18143356f4b1ba5c4592
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 09 Mar 2022 10:11:40 GMT
content-encoding
br
x-content-type-options
nosniff
age
126278
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13728
x-xss-protection
0
last-modified
Tue, 01 Mar 2022 17:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 09 Mar 2023 10:11:40 GMT
adview
googleads.g.doubleclick.net/pagead/ Frame E031 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=C1vFUomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgSZA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Icwhgfh9eWNgw1dnfcLhAYCauLtjKGGu83GIftdfFhZCp1Hrx1mABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi03NTAwNTkzMjM2NzA3MzI1GAA&sigh=Q-Zc9DYN6Dk&uach_m=[UACH]&cid=CAQSPACNIrLMeFFLxzgtW8WbUcc73wCMHV1BOO6p-CwzqG65zatYkBQCMOxNqHOybYQQoVFJn8_gJ9cdMWedsxgB
Requested by
Host: marketing.reversinglabs.com
URL: https://marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Thu, 10 Mar 2022 21:16:18 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
winResponse
prod-rtb.ad4mat.net/ Frame E031 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prod-rtb.ad4mat.net/winResponse?a=1k63e8ewm22wy05mypa1ffsjj0nn0ndhpjsp80c3dn1yefj2aadfbkyyrbtan690gexm0505y40xwg9yz90qt8xrmqj17v021vgyvpmgsm8qpjhdmpdvfsw4p7vtkc2dnysb1y78yrwffjywsnnkqzcz6bjz4zbd34zphmvc7w1esgag7zbd1dqf66cxtvxdrhx0h6ahg5s0qzaqqe76b6k73mmksaewd9gskykder2wy9avjxt95atx6h70y614h004q8xn271s3ejpbrq6nvptp2mj8p3vf0x0xh33kwp2b8yg8zzcxkdsdwm3as1z2bfxdkhy6s7h2bsk0t06mpafbrja2eyw33s330bt8b993qf3y9dt03wzffh2qd71hzbs8rbeev5a0tjn6cks4wksr7fa4&b=YipqogADHzoKe7xJAA4JT0odpd8FLZqHNS-66A
Requested by
Host: marketing.reversinglabs.com
URL: https://marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type
image/gif
dr
as.ad4m.at/ad/ Frame E9CD 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/dr?ed=1hapaqsf06bc3s73kz1e4nnpvf42nc8ap3qrzg99fsedaa0agv2vze4vpnbcpvcghqqap7ry39trck3ee1fpft1p47nmr378cqs1pebjm4tkqekcye879p24j89vpymbttee6ccmp9sw1v06ca5dd60h637b9tjww4nk52k6h4fy1w1s01wbvxp4m0kchtecsf4d07bsjmv8frdfjxwv5yt6vy0n35dtfcxt070aa1shh1g92m05zvpt89afj2g0av6t727t6q4hqynn1jaa4pt6j1mqxfb9sgt6j28v0dp172vsb1ywcjds2nca74bh5spf5kscwrztjc0535je98akbwv6cma52mdmzbhfc7wc0h35pykfwp3hk5k0brjbjj1rhwkrzsd7522wxe6f7vh1gag6yvfnq1gndcyzdv9dhd4shpjg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%26client%3Dca-pub-7500593236707325%26adurl%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a33f82a5e2de17331a7b4c0b2aba9b677167db758599e93ea95acdc7022cbd34
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-type
text/html; charset=utf-8
strict-transport-security
max-age=86400; includeSubDomains; preload
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options
noopen
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection
1; mode=block
cross-origin-embedder-policy
unsafe-none
content-security-policy
block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy
same-origin
feature-policy
geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires
0
surrogate-control
no-store
pragma
no-cache
cross-origin-opener-policy
unsafe-none
via
1.1 google
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6e9f1217be6f9162-FRA
content-encoding
br
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220308/r20110914/client/ Frame E031 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220308/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:14:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
116
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1233
x-xss-protection
0
server
cafe
etag
16517525077337815633
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 24 Mar 2022 21:14:22 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame D950 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
date
Thu, 10 Mar 2022 05:53:44 GMT
expires
Fri, 11 Mar 2022 05:53:44 GMT
cache-control
public, max-age=86400
age
55354
etag
48472445140208031
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame E031 		117 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ec068031a38f2d97255ddf90e6d75a5538a3b0ea29510482d1909c5a1a10ad74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36343
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1646830771070120"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:16:18 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220308/r20110914/client/ Frame E031 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220308/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
fdecda5ee87b28e579c5b61ef0f86e7fff85c838ff0a06450feee13a5877ed0b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:09:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
381
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6397
x-xss-protection
0
server
cafe
etag
14404976697706490601
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 24 Mar 2022 21:09:57 GMT
l
www.google.com/ads/measurement/ Frame E031 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSAMbw7K4WKjs3hcyj9RPxwtk9pABPfTMOnxiofny52QxAeTi-rrsViaCOGlGASfjnyST55SwO08Xt66jE6b_RdjVJICg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers
adview
googleads.g.doubleclick.net/pagead/ Frame 5A99 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CE34FomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEmgNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z2HoM3n-MRq4g1XR3IDG0cSjrE8RO9U_VgCCZxKLLus0iKjKLBl0YAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItNzUwMDU5MzIzNjcwNzMyNRgA&sigh=NSpumQnm5eA&uach_m=[UACH]&cid=CAQSPACNIrLM3YraB3rSD1Eijg_9lExJFNrkzD6-U_-d0WkFPUTkv1tB8frKRJvIch7AepHeyXe64PFSk2QEaRgB
Requested by
Host: marketing.reversinglabs.com
URL: https://marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Thu, 10 Mar 2022 21:16:18 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
winResponse
prod-rtb.ad4mat.net/ Frame 5A99 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prod-rtb.ad4mat.net/winResponse?a=1hqkqg5xma7hn9t16e8ydnapq189s74t1pjt8kx0xz9k40vxb7sp4sy0k6q6mhzepyv92584degtckjt71kgf9v1neyanhnbjw846qsay57zz4ehw6f4p8x5s0swxmk2ey2e5tbqw52ec1z0bkya1f2wttbm3dcj347mtnqca9f05k0ymqg5688apbdh3qy5admq6s34qnw57gkahgpf1p48yyp6n1sxh2m2v8xcbgz8dkz6vv75gx3ffjnxnhac7frpg27bk7y50v6mmfpbnc3jbjtydgcmncykpr37zb57sqa6c9b15av8wpjdja56z6ke1z74fs7gg8gwa0sbcv186b1tpynaq08c4bc7yx2r053px57bd212sz1h9qc6h3zjt2sydd5c541gmaybn1fz5ejvm&b=YipqogAEC-kIEdKpAAjSPnnTbjdsmfcYSNxDXA
Requested by
Host: marketing.reversinglabs.com
URL: https://marketing.reversinglabs.com/e3t/Ctc/LV+113/cprv104/MW3ZKK6PP2QVt0W9j3C8nBcW3S9mTt4Gvjd9N2nfYyB3q3pBV1-WJV7CgRl-W4RwBG-4dJhzWW4MGtHf819Q58W7D83MK5MTj9qW8QJ7n-4mw33nW8sZ8kh90xgmXW1Jgxx67k_WFCW18QYBK5zbST5W8m4mv73S13DTN5wnSQdkKMVBW7PM2W665qrzsW5dLM8f61Cpl3N9bnV5qWhQZHW1dF3m-3NY7j4W2LLLst4k97S9W514lmz7cwxvLW2FYhnH4SgP16W8Nx5qh5cKyQNW6_K7Cw8g97g_N4zXhzzvpnyvW72ZrKb3j-0NLW3kp-g87BTBTFW64dgFX282wVMN4xC07Q8vBhKW4cMPJG1-b-sjW6K8-rR3RwNYbW4lVyFh3XsWp7W4zzKNd5tq_kgW7P445Y2jk9ttN3fNXbr46DpXW43kc7t7cx7jD3fqP1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type
image/gif
dr
as.ad4m.at/ad/ Frame 36ED 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/dr?ed=1jwxytvzdtfztg26m3yta04wqrr2hhkxx1mpvtb3rahhq1knh6aj7kj1qvt6q8pt8gmkms4aj4670zr4p92hw5f2a6bj2v5bbc34qftap4tan2b0zxfe55ab78y7cvjp6mrksjw7tn3d7xs9es5t6t9c2xv60mgba2vsg6s66gx5ewjh8zh7nxxa60q7ka68gw9jq5yvx1t2rmdn5hqf4qybtsnnmvp84mrav8x7f587tt5rkn07pzynk7fpkzd3w983aqk6yx027c7c0h4kb9thphv7vm5k4g70kc7y0v5apt493s1bwfn523yp520f5rk2dph25kycr1kp8tc3khxrdwj702dshjm9mnx5thmn1q5w3289zfqqkhvzy9zqke38dhzt1b6yyzk0ej8rbdhsg5d830rs8k9r2nbv8jn13f6gyrhv2&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%26client%3Dca-pub-7500593236707325%26adurl%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f61e477e31acf22782eb2acc7f716837d8613caef8d774047f45206d820a6856
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-type
text/html; charset=utf-8
strict-transport-security
max-age=86400; includeSubDomains; preload
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options
noopen
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection
1; mode=block
cross-origin-embedder-policy
unsafe-none
content-security-policy
block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy
same-origin
feature-policy
geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires
0
surrogate-control
no-store
pragma
no-cache
cross-origin-opener-policy
unsafe-none
via
1.1 google
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6e9f1217be729162-FRA
content-encoding
br
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220308/r20110914/client/ Frame 5A99 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220308/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:14:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
116
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1233
x-xss-protection
0
server
cafe
etag
16517525077337815633
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 24 Mar 2022 21:14:22 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 28FE 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
date
Thu, 10 Mar 2022 05:53:44 GMT
expires
Fri, 11 Mar 2022 05:53:44 GMT
cache-control
public, max-age=86400
age
55354
etag
48472445140208031
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 5A99 		117 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ec068031a38f2d97255ddf90e6d75a5538a3b0ea29510482d1909c5a1a10ad74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36343
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1646830771070120"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:16:18 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220308/r20110914/client/ Frame 5A99 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220308/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
fdecda5ee87b28e579c5b61ef0f86e7fff85c838ff0a06450feee13a5877ed0b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:09:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
381
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6397
x-xss-protection
0
server
cafe
etag
14404976697706490601
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 24 Mar 2022 21:09:57 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 390D 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220308&jk=1750612626987723&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220308/r20110914/client/ Frame 1CB8 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220308/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:14:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
116
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1233
x-xss-protection
0
server
cafe
etag
16517525077337815633
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 24 Mar 2022 21:14:22 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 1CB8 		117 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ec068031a38f2d97255ddf90e6d75a5538a3b0ea29510482d1909c5a1a10ad74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36343
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1646830771070120"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 10 Mar 2022 21:16:18 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220308/r20110914/client/ Frame 1CB8 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220308/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
fdecda5ee87b28e579c5b61ef0f86e7fff85c838ff0a06450feee13a5877ed0b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:09:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
381
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6397
x-xss-protection
0
server
cafe
etag
14404976697706490601
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 24 Mar 2022 21:09:57 GMT
l
www.google.com/ads/measurement/ Frame 1CB8 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTkpS262l1uVjTxDpvble2yEIjrnD1WD3yeAmzeN3l7bDaS8RA-JSEYAXYeDTI8pE0fPPZ9IfmCftJmXlh_S6XzUOkqpQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers
adview
googleads.g.doubleclick.net/pagead/ Frame 1CB8 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=Cx_G0omoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSgA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmryEqnFAFZsvOl6cPiKqV3l5gT68bmmG9oLZy6wO2CYHrZyaEBKTWgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItNzUwMDU5MzIzNjcwNzMyNRgA&sigh=naBVCsOu3Xg&uach_m=[UACH]&cid=CAQSPACNIrLMJX4HFiHnWEIHjGBRY-ztLa_QqFkJER50QEJiU4bG-1ZFhjIGl9Lz0AneJ1ZwZzG0gQKLs9ekLxgB
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Thu, 10 Mar 2022 21:16:18 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
winResponse
prod-rtb.ad4mat.net/ Frame 1CB8 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prod-rtb.ad4mat.net/winResponse?a=1h0y13wrsz5y732ekwkcbj7e6692bfsdjc5vj4v7mbwhk6r8wbfy497cc1p1gcem2576cged06cr6sqg15c70jnm849qd5g15weh7pqg22k35drcgj1kn35tc5erktjbnqk8eg7qn53ma4w1k0yxbep1cw5j3tv89m6c84vpfm7h97qd1380ep2kdq4ytxvyz8xy08172rzbzw8g99c4er2c57cawga9a13v81e42zv5wejh5vsq38q8zgtfavefrt28nqync8xh2dhwp9rb7711zdt2nc5947fmtnm2b8j3f40hgy1242jvyjfs93b81fqt8tz7hqhzr7ztjv4m3fvjs10b5fwer07p8ck0deqzf2qy9k5kqnykqqbbtxtg49e8zpmt8rc6atvwzcnhe9zzkww2y&b=YipqogAFDV8K4DLXAAa4ixcnQF_XVfeJSjC1MA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 10 Mar 2022 21:16:18 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type
image/gif
dr
as.ad4m.at/ad/ Frame 85E0 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/dr?ed=1g00gqb8xm6wfb8a3vy8c82p22ptbz0v91xbmpgqdktrpwnhq8hpjf5ek09tjn33xcgxj6jfrksn8aj4ww9b6t4p9y07zmme32re1k08bfbd4ehfmbgfq8kghdd06czxqxd3ysvf2c9grerq6hrdwdr57syq28afsv3w4w1vawjjenf95ve94dvv53606b1bafh6vyc6r460fg042jwe1tyrn2ka1vd50987gzs0nbmthkpkt2afcnpgyafsbx3jq111cv5e8zfrzp229jgc0wfhc5dc00gkedtcpybs48ej08ghstz50824w5baw5zjvfg30fg2d9zfjpx2merg26g3ct6c4jdmr01sekh7feaz84ged6y7sdgxvk1rskecx9yw3pbwt8ry1bfeww0gcsnk7ghtsf4gvjmnjxspq9pyfz5y1e62g&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%26client%3Dca-pub-7500593236707325%26adurl%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6842eeb2b3840ed24218c6720db56d407fd380f6e042b544343af69d30154e8d
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-type
text/html; charset=utf-8
strict-transport-security
max-age=86400; includeSubDomains; preload
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options
noopen
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection
1; mode=block
cross-origin-embedder-policy
unsafe-none
content-security-policy
block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy
same-origin
feature-policy
geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires
0
surrogate-control
no-store
pragma
no-cache
cross-origin-opener-policy
unsafe-none
via
1.1 google
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6e9f12183f835c50-FRA
content-encoding
br
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame FF2C 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
date
Thu, 10 Mar 2022 05:53:44 GMT
expires
Fri, 11 Mar 2022 05:53:44 GMT
cache-control
public, max-age=86400
age
55354
etag
48472445140208031
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame E031 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e2bea7e6d83b5f76327319571709551864df4297466b60f6e2626621b7666fa1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
dpixel
cms.quantserve.com/ Frame D950 		35 B
362 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEEYK8SpY5k3kuV-KiJYX7Cw&google_cver=1&google_push=AYg5qPIT9WquaIEVjalrsRTyCaohFuFHBOI3QCW-59U4hxj8RkaetYEVkgJ9HxA1uT-6ibqNQMaoZNkxCeh9HulYBvjvGqUoSM8
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
sync
odr.mookie1.com/t/v2/ Frame D950 		43 B
324 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEOudjX0sr4zy-4df4O0JFdU&google_push=AYg5qPJnSgvDmuJZaU4W1NFunGiJFuEgPeGN8rpCF31F2C6efuXQLLChWqIDlf1itRxz7FUq4c1GgmUqD9-t6KWyqWWQxCGkhcA&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
61.67.98.34.bc.googleusercontent.com
Software
Apache /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
via
1.1 google
server
Apache
p3p
CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif;charset=UTF-8
alt-svc
clear
content-length
43
x-application-context
application
expires
Thu, 01 Jan 1970 00:00:00 GMT
dds
rtb.openx.net/sync/ Frame D950 		43 B
350 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds?google_gid=CAESEMwMRSjNhn9zfjSEnkKclNk&google_cver=1&google_push=AYg5qPIHXWGRsElxqabiel3U-5lOCuLVIwJidbz4KBqTHWMVE--pDVihXw4g3HuMrqyIyBh4EsXmO506p1omEU6DIsUqthjcpQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
6ic0122cc7bia80eghnlupq9clp0m32q
pixel
cm.g.doubleclick.net/ Frame D950
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=XhjJ079LTCih5lhWGfEsow%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=XhjJ079LTCih5lhWGfEsow%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKaL1RPO58LbPF2jtWpbgg21tKQDi1BY2tEngE2P9LTRpAS1gZ7_wx2eJf3N8l8eVhC6HtpLoGTgmDw6WhFntR2VhT48Q
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=XhjJ079LTCih5lhWGfEsow%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKaL1RPO58LbPF2jtWpbgg21tKQDi1BY2tEngE2P9LTRpAS1gZ7_wx2eJf3N8l8eVhC6HtpLoGTgmDw6WhFntR2VhT48Q
date
Thu, 10 Mar 2022 21:16:18 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame D950
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEMXiGxemxKx5M3d-Ptkh_Ik&google_cver=1&google_push=AYg5qPJqCtWp2iizWJmo9fAALId221AUho5jXhuRGbVXflK9OB8Qx9vGgM9UBBwGWb2zMhZVAg4...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==&google_push=AYg5qPJqCtWp2iizWJmo9fAALId221AUho5jXhuRGbVXflK9OB8Qx9vGgM9UBBwGWb2zMhZVAg4a0QtpI4LJnoIgPt2EkuMOtA
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==&google_push=AYg5qPJqCtWp2iizWJmo9fAALId221AUho5jXhuRGbVXflK9OB8Qx9vGgM9UBBwGWb2zMhZVAg4a0QtpI4LJnoIgPt2EkuMOtA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==&google_push=AYg5qPJqCtWp2iizWJmo9fAALId221AUho5jXhuRGbVXflK9OB8Qx9vGgM9UBBwGWb2zMhZVAg4a0QtpI4LJnoIgPt2EkuMOtA
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
66ef90d06496cfd000aab8206f2b6221
Expires
0
pixel
cm.g.doubleclick.net/ Frame D950
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1&googl...
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AY...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCu...
0
0
trk
ag.innovid.com/ Frame D950 		43 B
296 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ag.innovid.com/trk?tid=11711&google_gid=CAESECgJGfOzoi0wwcopGAIFawk&google_cver=1&google_push=AYg5qPLfaUKXmONvqH2luPCY2OFgXxE-iYDg9oOpH9a0v8YxRrpLDdY6UlIMk9y5Vla1cIcm5QnpOAVr0WuT8hTez_oH43cSZaU
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d01c:1d8:8102:d28c:83ad:1b58:a2c4 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
cache-control
no-cache
content-type
image/gif
content-length
43
request-time
1
expires
-1
attr
cm.g.doubleclick.net/pixel/ Frame D950 		0
232 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IF072qwToJfH3fccLccsAeT_tQW6zjNDH6ZW0F84aPtA3A9vt564oDUwJLRJmZGMjlB-Z1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186316&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946977915&bpp=6&bdt=542&idt=184&shv=r20220308&mjsv=m202203030101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=2&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=666268707&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=3899870766&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42531397%2C44750774%2C31065566%2C44758226%2C31062930&oid=2&pvsid=3023269658188208&pem=380&tmod=1894020930&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.dxkj51v3e789&fsb=1&dtd=225
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
sodar
pagead2.googlesyndication.com/pagead/ Frame 37A5 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220308&jk=3868763332743951&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers
truncated
/ Frame 5A99 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
96286511eca09b0c91bc02d96d4763f76d8a5ede343a49e0a9d3c020376fee43

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
hbjI8xylHpjavQyfdphvo41Bfdkh_RgUM1b0sbpcRZI.js
pagead2.googlesyndication.com/bg/ Frame D282 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/hbjI8xylHpjavQyfdphvo41Bfdkh_RgUM1b0sbpcRZI.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
85b8c8f31ca51e98dabd0c9f76986fa38d417dd921fd18143356f4b1ba5c4592
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Wed, 09 Mar 2022 10:11:40 GMT
content-encoding
br
x-content-type-options
nosniff
age
126278
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13728
x-xss-protection
0
last-modified
Tue, 01 Mar 2022 17:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 09 Mar 2023 10:11:40 GMT
default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame 36ED 		81 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1jwxytvzdtfztg26m3yta04wqrr2hhkxx1mpvtb3rahhq1knh6aj7kj1qvt6q8pt8gmkms4aj4670zr4p92hw5f2a6bj2v5bbc34qftap4tan2b0zxfe55ab78y7cvjp6mrksjw7tn3d7xs9es5t6t9c2xv60mgba2vsg6s66gx5ewjh8zh7nxxa60q7ka68gw9jq5yvx1t2rmdn5hqf4qybtsnnmvp84mrav8x7f587tt5rkn07pzynk7fpkzd3w983aqk6yx027c7c0h4kb9thphv7vm5k4g70kc7y0v5apt493s1bwfn523yp520f5rk2dph25kycr1kp8tc3khxrdwj702dshjm9mnx5thmn1q5w3289zfqqkhvzy9zqke38dhzt1b6yyzk0ej8rbdhsg5d830rs8k9r2nbv8jn13f6gyrhv2&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%26client%3Dca-pub-7500593236707325%26adurl%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://as.ad4m.at/ad/dr?ed=1jwxytvzdtfztg26m3yta04wqrr2hhkxx1mpvtb3rahhq1knh6aj7kj1qvt6q8pt8gmkms4aj4670zr4p92hw5f2a6bj2v5bbc34qftap4tan2b0zxfe55ab78y7cvjp6mrksjw7tn3d7xs9es5t6t9c2xv60mgba2vsg6s66gx5ewjh8zh7nxxa60q7ka68gw9jq5yvx1t2rmdn5hqf4qybtsnnmvp84mrav8x7f587tt5rkn07pzynk7fpkzd3w983aqk6yx027c7c0h4kb9thphv7vm5k4g70kc7y0v5apt493s1bwfn523yp520f5rk2dph25kycr1kp8tc3khxrdwj702dshjm9mnx5thmn1q5w3289zfqqkhvzy9zqke38dhzt1b6yyzk0ej8rbdhsg5d830rs8k9r2nbv8jn13f6gyrhv2&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%26client%3Dca-pub-7500593236707325%26adurl%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age
870318
cross-origin-embedder-policy
unsafe-none
cf-polished
origSize=83581
surrogate-control
no-store
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=86400; includeSubDomains; preload
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
same-origin
expires
0
last-modified
Mon, 28 Feb 2022 19:31:00 GMT
server
cloudflare
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options
noopen
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type
text/css; charset=utf-8
vary
Accept-Encoding
cache-control
max-age=3600, must-revalidate, proxy-revalidate
cf-ray
6e9f121878065c50-FRA
cf-bgj
minify
r62eglto.js
ad4m.at/ Frame 36ED 		35 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/r62eglto.js
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1jwxytvzdtfztg26m3yta04wqrr2hhkxx1mpvtb3rahhq1knh6aj7kj1qvt6q8pt8gmkms4aj4670zr4p92hw5f2a6bj2v5bbc34qftap4tan2b0zxfe55ab78y7cvjp6mrksjw7tn3d7xs9es5t6t9c2xv60mgba2vsg6s66gx5ewjh8zh7nxxa60q7ka68gw9jq5yvx1t2rmdn5hqf4qybtsnnmvp84mrav8x7f587tt5rkn07pzynk7fpkzd3w983aqk6yx027c7c0h4kb9thphv7vm5k4g70kc7y0v5apt493s1bwfn523yp520f5rk2dph25kycr1kp8tc3khxrdwj702dshjm9mnx5thmn1q5w3289zfqqkhvzy9zqke38dhzt1b6yyzk0ej8rbdhsg5d830rs8k9r2nbv8jn13f6gyrhv2&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%26client%3Dca-pub-7500593236707325%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
533e8ab00e73a9a61f550b956a872f9091fe48b79b4072d87bdb07348af7f4bc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=tEZe3A==, md5=Jdq10Kok9oEWJwphx1gWLw==
date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23921
x-guploader-uploadid
ADPycds1S9GbOzl75swOIMTP1TgdW5VToJrXkAx5weMmg0b7-qhqoxLoMGYPaWNRe5vM0AjfXsXSWP1R5dQzER9hlP2KOLEwAA
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 26 Jan 2022 11:00:45 GMT
server
cloudflare
etag
W/"25dab5d0aa24f68116270a61c758162f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x99bS%2F1H6C2mpytkzCy5vqhKo3kcBcEIH4A7cHmXhUfbYFhNJa2VBbVAR4TKTRIWhZ3g9QzG0Hapvg8OovP9zYFqrvKvQ8FUkc%2B3qwkSVUdnXqpu9SOYhQEY5%2BQoRnQLItOEM20%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1643194845770575
content-type
application/javascript; charset=utf-8
expires
Thu, 10 Mar 2022 14:37:37 GMT
cache-control
public, max-age=3600, must-revalidate, stale-while-revalidate=300
x-goog-stored-content-length
11870
cf-ray
6e9f1218987e9162-FRA
cf-bgj
minify
default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame E9CD 		81 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1hapaqsf06bc3s73kz1e4nnpvf42nc8ap3qrzg99fsedaa0agv2vze4vpnbcpvcghqqap7ry39trck3ee1fpft1p47nmr378cqs1pebjm4tkqekcye879p24j89vpymbttee6ccmp9sw1v06ca5dd60h637b9tjww4nk52k6h4fy1w1s01wbvxp4m0kchtecsf4d07bsjmv8frdfjxwv5yt6vy0n35dtfcxt070aa1shh1g92m05zvpt89afj2g0av6t727t6q4hqynn1jaa4pt6j1mqxfb9sgt6j28v0dp172vsb1ywcjds2nca74bh5spf5kscwrztjc0535je98akbwv6cma52mdmzbhfc7wc0h35pykfwp3hk5k0brjbjj1rhwkrzsd7522wxe6f7vh1gag6yvfnq1gndcyzdv9dhd4shpjg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%26client%3Dca-pub-7500593236707325%26adurl%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://as.ad4m.at/ad/dr?ed=1hapaqsf06bc3s73kz1e4nnpvf42nc8ap3qrzg99fsedaa0agv2vze4vpnbcpvcghqqap7ry39trck3ee1fpft1p47nmr378cqs1pebjm4tkqekcye879p24j89vpymbttee6ccmp9sw1v06ca5dd60h637b9tjww4nk52k6h4fy1w1s01wbvxp4m0kchtecsf4d07bsjmv8frdfjxwv5yt6vy0n35dtfcxt070aa1shh1g92m05zvpt89afj2g0av6t727t6q4hqynn1jaa4pt6j1mqxfb9sgt6j28v0dp172vsb1ywcjds2nca74bh5spf5kscwrztjc0535je98akbwv6cma52mdmzbhfc7wc0h35pykfwp3hk5k0brjbjj1rhwkrzsd7522wxe6f7vh1gag6yvfnq1gndcyzdv9dhd4shpjg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%26client%3Dca-pub-7500593236707325%26adurl%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age
870318
cross-origin-embedder-policy
unsafe-none
cf-polished
origSize=83581
surrogate-control
no-store
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=86400; includeSubDomains; preload
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
same-origin
expires
0
last-modified
Mon, 28 Feb 2022 19:31:00 GMT
server
cloudflare
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options
noopen
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type
text/css; charset=utf-8
vary
Accept-Encoding
cache-control
max-age=3600, must-revalidate, proxy-revalidate
cf-ray
6e9f121878075c50-FRA
cf-bgj
minify
r62eglto.js
ad4m.at/ Frame E9CD 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/r62eglto.js
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1hapaqsf06bc3s73kz1e4nnpvf42nc8ap3qrzg99fsedaa0agv2vze4vpnbcpvcghqqap7ry39trck3ee1fpft1p47nmr378cqs1pebjm4tkqekcye879p24j89vpymbttee6ccmp9sw1v06ca5dd60h637b9tjww4nk52k6h4fy1w1s01wbvxp4m0kchtecsf4d07bsjmv8frdfjxwv5yt6vy0n35dtfcxt070aa1shh1g92m05zvpt89afj2g0av6t727t6q4hqynn1jaa4pt6j1mqxfb9sgt6j28v0dp172vsb1ywcjds2nca74bh5spf5kscwrztjc0535je98akbwv6cma52mdmzbhfc7wc0h35pykfwp3hk5k0brjbjj1rhwkrzsd7522wxe6f7vh1gag6yvfnq1gndcyzdv9dhd4shpjg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%26client%3Dca-pub-7500593236707325%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
533e8ab00e73a9a61f550b956a872f9091fe48b79b4072d87bdb07348af7f4bc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=tEZe3A==, md5=Jdq10Kok9oEWJwphx1gWLw==
date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
23921
x-guploader-uploadid
ADPycds1S9GbOzl75swOIMTP1TgdW5VToJrXkAx5weMmg0b7-qhqoxLoMGYPaWNRe5vM0AjfXsXSWP1R5dQzER9hlP2KOLEwAA
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 26 Jan 2022 11:00:45 GMT
server
cloudflare
etag
W/"25dab5d0aa24f68116270a61c758162f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iH1aGpsjh9pyQ1tygOC4f%2FwAxkJDmCog481sH3XJdQsLXUjNH7DOwBQhwNUZUxhK22fOnUz%2FNxoYsTv9XL63iLJeEXC6Lj%2FLglJKMQefKRq8g%2FCPxpZgPwd%2F1LeTHmfQ4mAXShI%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1643194845770575
content-type
application/javascript; charset=utf-8
expires
Thu, 10 Mar 2022 14:37:37 GMT
cache-control
public, max-age=3600, must-revalidate, stale-while-revalidate=300
x-goog-stored-content-length
11870
cf-ray
6e9f121898819162-FRA
cf-bgj
minify
pixel
cm.g.doubleclick.net/ Frame 28FE
Redirect Chain
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEEYK8SpY5k3kuV-KiJYX7Cw&google_cver=1&google_push=AYg5qPJxMzIy-jB0DIeVDMIZ-KRDuAlWNWyMzDA96urkNIu9kYkxm_KIGG...
  • https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPJxMzIy-jB0DIeVDMIZ-KRDuAlWNWyMzDA96urkNIu9kYkxm_KIGGk4LSBLdF4bW62U2c3GNhMlCjCK5jvgmITEH-N-2GJ1&google_hm=0ts_V5TErrf7...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPJxMzIy-jB0DIeVDMIZ-KRDuAlWNWyMzDA96urkNIu9kYkxm_KIGGk4LSBLdF4bW62U2c3GNhMlCjCK5jvgmITEH-N-2GJ1&google_hm=0ts_V5TErrf7fggM5IxfKA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPJxMzIy-jB0DIeVDMIZ-KRDuAlWNWyMzDA96urkNIu9kYkxm_KIGGk4LSBLdF4bW62U2c3GNhMlCjCK5jvgmITEH-N-2GJ1&google_hm=0ts_V5TErrf7fggM5IxfKA
pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
strict-transport-security
max-age=86400
expires
Fri, 04 Aug 1978 12:00:00 GMT
dds
rtb.openx.net/sync/ Frame 28FE 		43 B
135 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds?google_gid=CAESEMwMRSjNhn9zfjSEnkKclNk&google_cver=1&google_push=AYg5qPKecXGz8JkNB2ZbvuuSRiOD55U09hUpqF7Qf2RCT7hfp3lm00oRxZ1fHZAl9MfbRi9QQpxJaGDW8WIil_RVFQkE4p71Cl0o
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
9436dmq3h91bvgvdcvektb7ib3mt0stj
pixel
cm.g.doubleclick.net/ Frame 28FE
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2XnQexdERh23wJ-QDZNpxw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2XnQexdERh23wJ-QDZNpxw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLCydKehyIwlWe-5noHW7FLRRCPA9gGGzUVpg3czl21hyXkz4NLH1jq00TCaRwx7AHUQ1zd1fqoZvDA1T5jpVddXoW9_25s
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=2XnQexdERh23wJ-QDZNpxw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLCydKehyIwlWe-5noHW7FLRRCPA9gGGzUVpg3czl21hyXkz4NLH1jq00TCaRwx7AHUQ1zd1fqoZvDA1T5jpVddXoW9_25s
date
Thu, 10 Mar 2022 21:16:18 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame 28FE
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEMXiGxemxKx5M3d-Ptkh_Ik&google_cver=1&google_push=AYg5qPJ4gKDpfnqb52ZJopkcSHFlV9Zpwd6FzW79z3qy7BZfHs7BReR9uMDbRKkRz9RZHZxBgFW...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==&google_push=AYg5qPJ4gKDpfnqb52ZJopkcSHFlV9Zpwd6FzW79z3qy7BZfHs7BReR9uMDbRKkRz9RZHZxBgFWLjD2yBZFdafOnQ9nCVw0_HG8
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==&google_push=AYg5qPJ4gKDpfnqb52ZJopkcSHFlV9Zpwd6FzW79z3qy7BZfHs7BReR9uMDbRKkRz9RZHZxBgFWLjD2yBZFdafOnQ9nCVw0_HG8
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==&google_push=AYg5qPJ4gKDpfnqb52ZJopkcSHFlV9Zpwd6FzW79z3qy7BZfHs7BReR9uMDbRKkRz9RZHZxBgFWLjD2yBZFdafOnQ9nCVw0_HG8
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
66ef90d06496cfd000aab8206f2b6221
Expires
0
pixel
cm.g.doubleclick.net/ Frame 28FE
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1&googl...
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AY...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6...
0
0
trk
ag.innovid.com/ Frame 28FE 		43 B
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ag.innovid.com/trk?tid=11711&google_gid=CAESECgJGfOzoi0wwcopGAIFawk&google_cver=1&google_push=AYg5qPIzmLcxn8G7oj_VKmnIUvH7keh3fS451OU1wjc8byG5sXG_AlDnx2nFQUurUeGxyoV3hVPBS_6YPpHh3ODvKd1U19pjWlzW
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d01c:1d8:8102:d28c:83ad:1b58:a2c4 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
cache-control
no-cache
content-type
image/gif
content-length
43
request-time
0
expires
-1
pixel
cm.g.doubleclick.net/ Frame 28FE
Redirect Chain
  • https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESENXS9PUWpDazJhtU21vcWv8&google_cver=1&google_push=AYg5qPKzjJLHN6fHegEenKle...
  • https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKzjJLHN6fHegEenKleihlm5CLwP09T0XP3nd_blGRxYsrzVPiR6dAn_xHx8YSvoAxuXkIsMH-tu0PA3MseSn3RaEB3UoVhUA&google_hm=
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKzjJLHN6fHegEenKleihlm5CLwP09T0XP3nd_blGRxYsrzVPiR6dAn_xHx8YSvoAxuXkIsMH-tu0PA3MseSn3RaEB3UoVhUA&google_hm=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
server
GHC
p3p
CP="NOI DSP COR NID PSAo OUR IND"
location
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKzjJLHN6fHegEenKleihlm5CLwP09T0XP3nd_blGRxYsrzVPiR6dAn_xHx8YSvoAxuXkIsMH-tu0PA3MseSn3RaEB3UoVhUA&google_hm=
cache-control
no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
accept-ranges
none
content-length
0
expires
Wed, 09 Mar 2022 21:16:18 GMT
attr
cm.g.doubleclick.net/pixel/ Frame 28FE 		0
40 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KnmY0p2eKIx0dLxEa9CwaL3pCq5xgaterBQ7xlijO0bdvx6w0fzU8duLigywWkwJ-3ceL93A
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=280&slotname=7077012612&adk=2662501839&adf=776186307&pi=t.ma~as.7077012612&w=336&psa=0&format=336x280&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978028&bpp=4&bdt=574&idt=156&shv=r20220308&mjsv=m202203070101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=121935896&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1064&ady=256&biw=1600&bih=1200&isw=336&ish=280&ifk=2666232115&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C42531397%2C44750774%2C31065574%2C44760495%2C31062930&oid=2&pvsid=1750612626987723&pem=380&tmod=550167063&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.ddfi8itgsps&fsb=1&dtd=195
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame 85E0 		81 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1g00gqb8xm6wfb8a3vy8c82p22ptbz0v91xbmpgqdktrpwnhq8hpjf5ek09tjn33xcgxj6jfrksn8aj4ww9b6t4p9y07zmme32re1k08bfbd4ehfmbgfq8kghdd06czxqxd3ysvf2c9grerq6hrdwdr57syq28afsv3w4w1vawjjenf95ve94dvv53606b1bafh6vyc6r460fg042jwe1tyrn2ka1vd50987gzs0nbmthkpkt2afcnpgyafsbx3jq111cv5e8zfrzp229jgc0wfhc5dc00gkedtcpybs48ej08ghstz50824w5baw5zjvfg30fg2d9zfjpx2merg26g3ct6c4jdmr01sekh7feaz84ged6y7sdgxvk1rskecx9yw3pbwt8ry1bfeww0gcsnk7ghtsf4gvjmnjxspq9pyfz5y1e62g&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%26client%3Dca-pub-7500593236707325%26adurl%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://as.ad4m.at/ad/dr?ed=1g00gqb8xm6wfb8a3vy8c82p22ptbz0v91xbmpgqdktrpwnhq8hpjf5ek09tjn33xcgxj6jfrksn8aj4ww9b6t4p9y07zmme32re1k08bfbd4ehfmbgfq8kghdd06czxqxd3ysvf2c9grerq6hrdwdr57syq28afsv3w4w1vawjjenf95ve94dvv53606b1bafh6vyc6r460fg042jwe1tyrn2ka1vd50987gzs0nbmthkpkt2afcnpgyafsbx3jq111cv5e8zfrzp229jgc0wfhc5dc00gkedtcpybs48ej08ghstz50824w5baw5zjvfg30fg2d9zfjpx2merg26g3ct6c4jdmr01sekh7feaz84ged6y7sdgxvk1rskecx9yw3pbwt8ry1bfeww0gcsnk7ghtsf4gvjmnjxspq9pyfz5y1e62g&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%26client%3Dca-pub-7500593236707325%26adurl%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age
870318
cross-origin-embedder-policy
unsafe-none
cf-polished
origSize=83581
surrogate-control
no-store
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=86400; includeSubDomains; preload
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
same-origin
expires
0
last-modified
Mon, 28 Feb 2022 19:31:00 GMT
server
cloudflare
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options
noopen
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type
text/css; charset=utf-8
vary
Accept-Encoding
cache-control
max-age=3600, must-revalidate, proxy-revalidate
cf-ray
6e9f1218c8755c50-FRA
cf-bgj
minify
r62eglto.js
ad4m.at/ Frame 85E0 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/r62eglto.js
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1g00gqb8xm6wfb8a3vy8c82p22ptbz0v91xbmpgqdktrpwnhq8hpjf5ek09tjn33xcgxj6jfrksn8aj4ww9b6t4p9y07zmme32re1k08bfbd4ehfmbgfq8kghdd06czxqxd3ysvf2c9grerq6hrdwdr57syq28afsv3w4w1vawjjenf95ve94dvv53606b1bafh6vyc6r460fg042jwe1tyrn2ka1vd50987gzs0nbmthkpkt2afcnpgyafsbx3jq111cv5e8zfrzp229jgc0wfhc5dc00gkedtcpybs48ej08ghstz50824w5baw5zjvfg30fg2d9zfjpx2merg26g3ct6c4jdmr01sekh7feaz84ged6y7sdgxvk1rskecx9yw3pbwt8ry1bfeww0gcsnk7ghtsf4gvjmnjxspq9pyfz5y1e62g&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%26client%3Dca-pub-7500593236707325%26adurl%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
533e8ab00e73a9a61f550b956a872f9091fe48b79b4072d87bdb07348af7f4bc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=tEZe3A==, md5=Jdq10Kok9oEWJwphx1gWLw==
date
Thu, 10 Mar 2022 21:16:18 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
24483
x-guploader-uploadid
ADPycdviqDG4pUKeh2LDqLvnTibOls0XFQmGbFwROfkH8x_ZgIIZzugSejuDErOedu04o73ZZ4eYasNu5fDuE0-WPLI
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 26 Jan 2022 11:00:45 GMT
server
cloudflare
etag
W/"25dab5d0aa24f68116270a61c758162f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o3%2Br6QHwcS2kgxGpU7HJIQfr0S1bW5Y%2B%2FHfke6xLFjdoKRcVre3dTrzh5dFqsbETXI89QY2X1LYinYf2lGfCaFn%2FjElU4jL8fH%2FyFt7Z4%2ByQpUumS00Q7xUFkSFtkUZl6R7nSo8%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1643194845770575
content-type
application/javascript; charset=utf-8
expires
Thu, 10 Mar 2022 14:28:15 GMT
cache-control
public, max-age=3600, must-revalidate, stale-while-revalidate=300
x-goog-stored-content-length
11870
cf-ray
6e9f1218c8765c50-FRA
cf-bgj
minify
truncated
/ Frame 1CB8 		208 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4a1a2e5f372c06d87f8ab2baf759b42835353e7ed5410d6983584d9d7e0b3d87

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
pixel
cm.g.doubleclick.net/ Frame FF2C
Redirect Chain
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEEYK8SpY5k3kuV-KiJYX7Cw&google_cver=1&google_push=AYg5qPKlz8__CmVF0Jwv-DGetsgIdav7U40d8OEfhu_z5X8kA8S7mdo6F9...
  • https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPKlz8__CmVF0Jwv-DGetsgIdav7U40d8OEfhu_z5X8kA8S7mdo6F9zDzOMYpddsgHG4rcK2oWMl-D-tJ761mluy8mr87hCc&google_hm=0ts_V5TErrf7...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPKlz8__CmVF0Jwv-DGetsgIdav7U40d8OEfhu_z5X8kA8S7mdo6F9zDzOMYpddsgHG4rcK2oWMl-D-tJ761mluy8mr87hCc&google_hm=0ts_V5TErrf7fggM5IxfKA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPKlz8__CmVF0Jwv-DGetsgIdav7U40d8OEfhu_z5X8kA8S7mdo6F9zDzOMYpddsgHG4rcK2oWMl-D-tJ761mluy8mr87hCc&google_hm=0ts_V5TErrf7fggM5IxfKA
pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
strict-transport-security
max-age=86400
expires
Fri, 04 Aug 1978 12:00:00 GMT
dds
rtb.openx.net/sync/ Frame FF2C 		43 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds?google_gid=CAESEMwMRSjNhn9zfjSEnkKclNk&google_cver=1&google_push=AYg5qPKRSOfrJYiGoZ9B9nZR2qqbzhqtniHZaleYMZOsKCD2O_aFRnoLhJzM07lcIr873hDxzjBk79-SFIvUUUTgklG4QHYBMgXk
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
ocb7lvoqe7081kl3g4a40qcbl6pgfb2n
pixel
cm.g.doubleclick.net/ Frame FF2C
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=SbFH4vmtSVOkh1Yc4Oc_ow%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=SbFH4vmtSVOkh1Yc4Oc_ow%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPItR7Mr6BNQF2PkunVOb5LKyjEQ2v57tyv44mPcYeI3PvLS2UvNIy-XMcxeP3yygDSNCBCjq1EIKvA73oRM5K-GEgBBgHpG
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=SbFH4vmtSVOkh1Yc4Oc_ow%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPItR7Mr6BNQF2PkunVOb5LKyjEQ2v57tyv44mPcYeI3PvLS2UvNIy-XMcxeP3yygDSNCBCjq1EIKvA73oRM5K-GEgBBgHpG
date
Thu, 10 Mar 2022 21:16:19 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame FF2C
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEMXiGxemxKx5M3d-Ptkh_Ik&google_cver=1&google_push=AYg5qPKaC7WjCMepPsYIzGFbDM--KDpzsGBN_WYyuiUcc4CT7jqvp2DvATz6mtUJiO2GR4PbuyQ...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==&google_push=AYg5qPKaC7WjCMepPsYIzGFbDM--KDpzsGBN_WYyuiUcc4CT7jqvp2DvATz6mtUJiO2GR4PbuyQYWLeSNr7OaxePYvpEUl1h25X0
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==&google_push=AYg5qPKaC7WjCMepPsYIzGFbDM--KDpzsGBN_WYyuiUcc4CT7jqvp2DvATz6mtUJiO2GR4PbuyQYWLeSNr7OaxePYvpEUl1h25X0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==&google_push=AYg5qPKaC7WjCMepPsYIzGFbDM--KDpzsGBN_WYyuiUcc4CT7jqvp2DvATz6mtUJiO2GR4PbuyQYWLeSNr7OaxePYvpEUl1h25X0
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
66ef90d06496cfd000aab8206f2b6221
Expires
0
pixel
cm.g.doubleclick.net/ Frame FF2C
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJ...
0
0
trk
ag.innovid.com/ Frame FF2C 		43 B
296 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ag.innovid.com/trk?tid=11711&google_gid=CAESECgJGfOzoi0wwcopGAIFawk&google_cver=1&google_push=AYg5qPJnx3F7buaV4wcBckbcxwuJbCj5PouyCmhUWx7DSw6Dpy1PL4b3cPtEGmRa3lS1NFbbHTqrgNyJvOSdsy-Awlyk5z6FdTs
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d01c:1d8:8102:d28c:83ad:1b58:a2c4 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
cache-control
no-cache
content-type
image/gif
content-length
43
request-time
0
expires
-1
pixel
cm.g.doubleclick.net/ Frame FF2C
Redirect Chain
  • https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESENXS9PUWpDazJhtU21vcWv8&google_cver=1&google_push=AYg5qPIOrTwCwouM3Ootn-Fy...
  • https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIOrTwCwouM3Ootn-Fy3JZOLx3zxqnWHz_eAn1ItnSyisS7IbUD8D7WzZwwllwnaWgL7uRmosrJgZ7bzmm8i_qVvBZk6MNv&google_hm=
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIOrTwCwouM3Ootn-Fy3JZOLx3zxqnWHz_eAn1ItnSyisS7IbUD8D7WzZwwllwnaWgL7uRmosrJgZ7bzmm8i_qVvBZk6MNv&google_hm=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
server
GHC
p3p
CP="NOI DSP COR NID PSAo OUR IND"
location
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIOrTwCwouM3Ootn-Fy3JZOLx3zxqnWHz_eAn1ItnSyisS7IbUD8D7WzZwwllwnaWgL7uRmosrJgZ7bzmm8i_qVvBZk6MNv&google_hm=
cache-control
no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
accept-ranges
none
content-length
0
expires
Wed, 09 Mar 2022 21:16:18 GMT
attr
cm.g.doubleclick.net/pixel/ Frame FF2C 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JhmlCgIH8QCsMVJZWjpFct2DQSaIZ_1GqjbXk4l4zJKb7IjINk_c6oUk6mKjOC8NNtUjUuaQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=600&slotname=7785652766&adk=2248810365&adf=776186306&pi=t.ma~as.7785652766&w=300&psa=0&format=300x600&url=https%3A%2F%2Fthreatpost.com%2Fmicrosoft-accounts-targeted-russian-credential-harvesting%2F178698%2F%3Futm_campaign%3DThis%2520Week%2520in%2520ReversingLabs%26utm_medium%3Demail%26_hsmi%3D206456747%26_hsenc%3Dp2ANqtz-942AOTfDVyVYrV2CjytSl28gcEgZVJTRh9eC5PxGQjQV0ef0SbjlXQMYhKG9DgbcgWrnv7M5myOoHRhxB7qBGVPyxUMw%26utm_content%3D206456747%26utm_source%3Dhs_email&ea=0&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1646946978070&bpp=5&bdt=587&idt=134&shv=r20220308&mjsv=m202203080101&ptt=9&saldr=aa&cookie=ID%3D9b3d556ce1e6b56a-22285f7059cd0019%3AT%3D1646946977%3AS%3DALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ&correlator=4679670721005&frm=23&ife=4&pv=1&ga_vid=865144764.1646946976&ga_sid=1646946978&ga_hid=2097665782&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=1581&biw=1600&bih=1200&isw=300&ish=600&ifk=3855339576&scr_x=0&scr_y=0&eid=44759837%2C42531398%2C44750774%2C31065595%2C31062930&oid=2&pvsid=3868763332743951&pem=380&tmod=1051841335&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C600&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.owji1qb53zbh&btvi=1&fsb=1&dtd=221
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
generate_204
tpc.googlesyndication.com/ Frame F48C 		0
9 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?53y37g
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
gen_204
pagead2.googlesyndication.com/pagead/ 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022030701&jk=1423848467349928&bg=!nZ6lntrNAAb7UztL-1M7ACkAdvg8WtOJUjBw5XjpEBpJkG_5tLc2faJMuqxzoIwfWTkLuWaKeHKjZAIAAAMhUgAAAAFoAQcKAGCURAznLU2aKFcRBCp9gSiDDmXX255C2cNfokw-vGhNqTmv8sXnKvMn3slQKB3pMDrl0E_rVtmCVGfQAUGuyVUKtotxCLaJCyQX_pHzi-Tm0Gmev6ObCh7md8LbC_DkLoyZAsHRf1rHcrPXgfyOTMW9wpIRZfegX7l507sZM312CXV5zPwxAZOYYAtzXJgTFZ_2HN6A54__Vir9g6ZbOOYUTfwdRKbvaIxub0UMAD2zQtcnSdFJ-2IyGSHDzlcSaDrBLXR5H274XddMsxyDKjsBn-dT0vOU75e8-HyBQJhhugrBtIi5L2g17sXT_06GjWHQx5CcSaZd2nEkcmHZ9VYKHLzfFoac34CZZEL40GubjW8DzLdmzw99Mm5geRs6IF4zLKum4hxT-_o-A45o9FoSX4B4C1wOA-Uj0O6kwJfK4k3LMANzKNkAWJ9F1HONmbsfiwPSQiSK8-xlgl_fbG90kxdxVmqv6PPbZ9K0Nf3jzvA4mao5gVy2orZGiPEHDZ2vEVE_tK3HR3ktfgIKEcHtnETktSWapOqPl5yzByoM8fcIeWV66HCxozNIOGTaRjaU4t6t62O0WDlGzOPTriajgISAaOzmOdycp64-2JgDhV-geQOEXp9eHGRDF1FSvIDYzPvKs9QyAxGsSVxGksBxbGD6oTFA_VaWYpiF5KeAk-TFwYLgJnFwlPuU6H02uLLq1MzD8nQhDuraxFbNIPJ0a6_qDQICWsxjxWhxKnqa9AwuXGtNWFtUa5ssPlDdcAefD8LC8QuF62wMhbQwnuvMuYzirXLEEYJG7bvwnG_j1WBeDmNzSQFnsSLkB0dxJGglPq4XbAEK-R1qQKUCqtR4VGIUDRWo2KKpvcQ-VQrFQMc_MNRlv4iZo3NordRv9yu14z6pzeHb8VsRa9sLDfQGVLsw6kFV6PrOiv-aRifxNRsn9R1GLXhhAQKXzTazuC2GrqU0G4aPv_H9-rm-BcQ2fzVPsB7X2Fn2NwEg4tC76G_aRAyU81lWQuOl6sQ0aLgxjY0XQMY1XQJK8AAj9KS9E1sTfj2ms_I-E7Wzwkepx49247Q
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adchoices_default.png
static-de.ad4mat.net/ads/img/ad_markers_folder/ Frame E9CD 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static-de.ad4mat.net/ads/img/ad_markers_folder/adchoices_default.png
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:71b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=v7nNsg==, md5=eUyE0w4hPsahRNZCFfB1UQ==
date
Thu, 10 Mar 2022 21:16:18 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3851260
x-guploader-uploadid
ADPycdvuqSd5z7x-P6zciDvJguhfevnTZzPv-sFvdv4VVTj2cCVUndir5fZqBzjNPOlq80uW-sAFhIkV33WDoT1aRSnwIseHrQ
x-goog-storage-class
STANDARD
x-goog-custom-time
1970-01-01T00:00:00Z
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3262
x-goog-meta-
last-modified
Wed, 09 Jun 2021 12:35:14 GMT
server
cloudflare
etag
"794c84d30e213ec6a144d64215f07551"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Tzyl7Ylvh%2B7Y5FiZWRHjQiHIOafcbjzIlytVoTr32Eips894yFo%2FWYWngFxRrRtC7Z8tZA642akd2yot3Lsx80oPaZWWLVsqhg0BDLLRkIXCQtt3bbIMH4zUB4I1SDfVBlVdXp8z0ZF7ELey2kLYj5I"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1623242114099744
content-type
image/png
cache-control
public, max-age=31536000, immutable
x-goog-stored-content-length
3262
accept-ranges
bytes
cf-ray
6e9f1219efbe68fd-FRA
expires
Wed, 25 Jan 2023 07:28:38 GMT
adchoices_default.png
static-de.ad4mat.net/ads/img/ad_markers_folder/ Frame 36ED 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static-de.ad4mat.net/ads/img/ad_markers_folder/adchoices_default.png
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:71b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=v7nNsg==, md5=eUyE0w4hPsahRNZCFfB1UQ==
date
Thu, 10 Mar 2022 21:16:18 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3851260
x-guploader-uploadid
ADPycdvuqSd5z7x-P6zciDvJguhfevnTZzPv-sFvdv4VVTj2cCVUndir5fZqBzjNPOlq80uW-sAFhIkV33WDoT1aRSnwIseHrQ
x-goog-storage-class
STANDARD
x-goog-custom-time
1970-01-01T00:00:00Z
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3262
x-goog-meta-
last-modified
Wed, 09 Jun 2021 12:35:14 GMT
server
cloudflare
etag
"794c84d30e213ec6a144d64215f07551"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sC9cHwB2oMcffdjMG%2BM4jYW7ZAQR0M8OPfO30U%2FBK3Q1ovBgRR403IQsec6A1bq1muHJ%2F5IE1i4ljqxkOcXuISCld5H9Lm5vmzXQ2Z7akOUJMOuBOwM2gOtnipmcDCzODl%2FNBBILMge6Jndcg6JrqOBr"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1623242114099744
content-type
image/png
cache-control
public, max-age=31536000, immutable
x-goog-stored-content-length
3262
accept-ranges
bytes
cf-ray
6e9f1219efbf68fd-FRA
expires
Wed, 25 Jan 2023 07:28:38 GMT
frame.html
ad4m.at/ Frame 96FE 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/frame.html
Requested by
Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d12a71cd626ac8f0fc91e6f1b98280cfb49fd724f2dcc118d192adff9a0154b4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-type
text/html; charset=utf-8
x-guploader-uploadid
ADPycdtpjC_BIP2JYJZvmIEVoowNNyTqNe6BE0JRdKJ1uhQ6k3Yfe6DPCN0GjBPS_zYil04QuBTjwG5dQACzvgbqPw78EHDYzg
x-goog-generation
1588777770164783
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
1681
x-goog-meta-
x-goog-custom-time
1970-01-01T00:00:00Z
content-language
en
x-goog-hash
crc32c=iTDHew== md5=c2ZaqCqAXxKd4MgeeQDU8g==
x-goog-storage-class
MULTI_REGIONAL
expires
Thu, 10 Mar 2022 22:16:18 GMT
cache-control
public, max-age=3600
age
1396623
last-modified
Wed, 06 May 2020 15:09:30 GMT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
HIT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lw1ch8WoXi3Qp9zefrjF0Qk4gGsuHJuAIV3c75dlHRXtL%2BAwE1zru3iw62IIvoGW0xOiTBnW6tbRa9vmJxqS9s5hcnbbh%2B6APOUZrSRx%2BOy%2BWAvCK%2FyCHZSyod7O44NOnciS6dw%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
server
cloudflare
cf-ray
6e9f1219aa1b5c50-FRA
content-encoding
br
frame.html
ad4m.at/ Frame E012 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/frame.html
Requested by
Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d12a71cd626ac8f0fc91e6f1b98280cfb49fd724f2dcc118d192adff9a0154b4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-type
text/html; charset=utf-8
x-guploader-uploadid
ADPycdtpjC_BIP2JYJZvmIEVoowNNyTqNe6BE0JRdKJ1uhQ6k3Yfe6DPCN0GjBPS_zYil04QuBTjwG5dQACzvgbqPw78EHDYzg
x-goog-generation
1588777770164783
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
1681
x-goog-meta-
x-goog-custom-time
1970-01-01T00:00:00Z
content-language
en
x-goog-hash
crc32c=iTDHew== md5=c2ZaqCqAXxKd4MgeeQDU8g==
x-goog-storage-class
MULTI_REGIONAL
expires
Thu, 10 Mar 2022 22:16:18 GMT
cache-control
public, max-age=3600
age
1396623
last-modified
Wed, 06 May 2020 15:09:30 GMT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
HIT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JpQXePLBj%2B2A%2F4vKomrBvYvYbyMgklmyivrBYz8062JDuWeePXf%2BJFNEw%2FKKFt2tsVVQVZ%2BECfCscI%2BmmwJsX2MgdLk09Rj%2FLhSe22f1q%2FKzV4Kc37bymFOHU%2B4DP0XX4raIfQk%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
server
cloudflare
cf-ray
6e9f1219ba2c5c50-FRA
content-encoding
br
adchoices_default.png
static-de.ad4mat.net/ads/img/ad_markers_folder/ Frame 85E0 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static-de.ad4mat.net/ads/img/ad_markers_folder/adchoices_default.png
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:71b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=v7nNsg==, md5=eUyE0w4hPsahRNZCFfB1UQ==
date
Thu, 10 Mar 2022 21:16:18 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3851260
x-guploader-uploadid
ADPycdvuqSd5z7x-P6zciDvJguhfevnTZzPv-sFvdv4VVTj2cCVUndir5fZqBzjNPOlq80uW-sAFhIkV33WDoT1aRSnwIseHrQ
x-goog-storage-class
STANDARD
x-goog-custom-time
1970-01-01T00:00:00Z
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3262
x-goog-meta-
last-modified
Wed, 09 Jun 2021 12:35:14 GMT
server
cloudflare
etag
"794c84d30e213ec6a144d64215f07551"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=am0A9UvuKAxUQPT1F9giFSQX4tC3MuvgLHX2LO2DBeEZ%2Bg4bqgP6kyKeCL1X7ADTxAeDeD8adLPBB3hEDZtVRgaG05WnV6zNe3tqwCXNW188ZL4wi%2B83FPPDJHNiDEAEs2ZyZlXQDOFyiUXlrxmAPZtw"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1623242114099744
content-type
image/png
cache-control
public, max-age=31536000, immutable
x-goog-stored-content-length
3262
accept-ranges
bytes
cf-ray
6e9f1219efc068fd-FRA
expires
Wed, 25 Jan 2023 07:28:38 GMT
generate_204
tpc.googlesyndication.com/ Frame 2CA7 		0
9 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?TndIcA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
frame.html
ad4m.at/ Frame A435 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/frame.html
Requested by
Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d12a71cd626ac8f0fc91e6f1b98280cfb49fd724f2dcc118d192adff9a0154b4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-type
text/html; charset=utf-8
x-guploader-uploadid
ADPycdtpjC_BIP2JYJZvmIEVoowNNyTqNe6BE0JRdKJ1uhQ6k3Yfe6DPCN0GjBPS_zYil04QuBTjwG5dQACzvgbqPw78EHDYzg
x-goog-generation
1588777770164783
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
1681
x-goog-meta-
x-goog-custom-time
1970-01-01T00:00:00Z
content-language
en
x-goog-hash
crc32c=iTDHew== md5=c2ZaqCqAXxKd4MgeeQDU8g==
x-goog-storage-class
MULTI_REGIONAL
expires
Thu, 10 Mar 2022 22:16:18 GMT
cache-control
public, max-age=3600
age
1396623
last-modified
Wed, 06 May 2020 15:09:30 GMT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
HIT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Msr55OvxOfDIJo6fZTX0MYyQY6qmVyce2MTSBqroG4RFSmjH%2FyXnztuEh0TyA6%2B5dtFY4boqKnBhwH3v47nJBP0jij0qJd7nFLQWd6mqxcmvKMe6KSP%2BOfc0UKunSaakoeinkqQ%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
server
cloudflare
cf-ray
6e9f1219ba475c50-FRA
content-encoding
br
generate_204
tpc.googlesyndication.com/ Frame D282 		0
9 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?GcX28g
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
rs
ad4m.at/ Frame E9CD 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/rs
Requested by
Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
66e3c287882bd1ea6ec5b6ebd27f0bdea61cf13b6eb0beb7b39db7286a8920de

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
application/json

Response headers

cf-ray
6e9f121abc679214-FRA
date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p%2BsyEmXrOkbo%2B5hMxoS%2B5BOIEV3fV2Nl2Vtwb%2BG7DQvD2yO6v2GTG%2F872Ru5cQDaIykJiZgJ7yjqIxoMwVTwq5bRLx4ZwOHmIBpFRgixsMqtAsaw5aI1yqeIDnPS8mYlQLkaHrc%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain
access-control-allow-origin
https://as.ad4m.at
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
access-control-allow-credentials
true
content-encoding
br
x-backend-server
aa-reachservice-group-europe-west1-bjhb
rs
ad4m.at/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/rs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://as.ad4m.at
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-type
text/plain
content-length
24
access-control-allow-origin
https://as.ad4m.at
access-control-allow-credentials
true
access-control-max-age
1800
access-control-allow-methods
GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-headers
content-type
allow
HEAD,POST,GET,OPTIONS
x-backend-server
aa-reachservice-group-europe-west1-bjhb
via
1.1 google
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7CPAPgPzkdOgPC3SzplKLDzyyXnsM7Yza6d8jH3WLMadB%2FlIBnU%2F9wu4biFNoqIrU4Re23UH%2BVZwcdUBIZi%2FtXFJxk88WYD6xeijckP8WwYk9MpYAnGVssHyN1lvTItWXcDdcuM%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6e9f121a6c089214-FRA
rs
ad4m.at/ Frame 36ED 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/rs
Requested by
Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd0a316e35f5b2e7923e88936bf7de05526e72fda0b7da2b03c46d0e639a50f4

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
application/json

Response headers

cf-ray
6e9f121abc699214-FRA
date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JwZhwAGRJpztQdh8RlfqZ2Lrjh6cXXDQh8d8EDQoyIHt9LRq5LQEPl7oLjyhmCAHyaJfFCPNLL85Vt%2BFg6%2BqBQvkjM9USG2%2F8n0CCzmHhb%2Fhzb41iXutnA9O3Z07nV1VLoJNxeM%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain
access-control-allow-origin
https://as.ad4m.at
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
access-control-allow-credentials
true
content-encoding
br
x-backend-server
aa-reachservice-group-europe-west1-bjhb
rs
ad4m.at/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/rs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://as.ad4m.at
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-type
text/plain
content-length
24
access-control-allow-origin
https://as.ad4m.at
access-control-allow-credentials
true
access-control-max-age
1800
access-control-allow-methods
GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-headers
content-type
allow
HEAD,POST,GET,OPTIONS
x-backend-server
aa-reachservice-group-europe-west1-bjhb
via
1.1 google
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ha10CmiKAdnWOWif%2FqTOB63itGDqHqIkLIhBKEW7fsO6CKvOzundFNVss59HLyyV%2Feo5tvvjoFbv5Ss5dectuTY5R7QcB768WOmplZUY37vNHEU6CaRvWwcSrpujUfEvlPjmqPA%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6e9f121a6c049214-FRA
rs
ad4m.at/ Frame 85E0 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/rs
Requested by
Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ee9907f608e1977b5aa325d6021ae8acbfeb9bcc279d2cb89b9ce838fd3ea9b7

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
application/json

Response headers

cf-ray
6e9f121abc6b9214-FRA
date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bdeVvRiP7PrbxmQl8UBQkLp10SVW5VZyJUo7oLAGHVjzZqdNFrCN54THpAeNy2Z1kzA2W5A%2B2UOy0TnDabscg5UWuc8ZMHlID4qA%2BC33Ic7M9OEZ3%2FtOFIPfuEPu1jmqMlklsoY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain
access-control-allow-origin
https://as.ad4m.at
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
access-control-allow-credentials
true
content-encoding
br
x-backend-server
aa-reachservice-group-europe-west1-bjhb
rs
ad4m.at/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/rs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://as.ad4m.at
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 10 Mar 2022 21:16:18 GMT
content-type
text/plain
content-length
24
access-control-allow-origin
https://as.ad4m.at
access-control-allow-credentials
true
access-control-max-age
1800
access-control-allow-methods
GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-headers
content-type
allow
HEAD,POST,GET,OPTIONS
x-backend-server
aa-reachservice-group-europe-west1-bjhb
via
1.1 google
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ol7ZMsM3yPLyknfKtRUrNJWSKVVWmEAIoYDWHapo4vmm%2FG1OHd4EJ1iYDXHJD3OZjW2QbKy6Kx0BwST3KkiR%2BvYGMsy%2FTnL0rJ6vZqhaWP4Lm3bklO0gOCV57LjJywkzbt4ehhM%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6e9f121a6c109214-FRA
rar
as.ad4m.at/ad/ Frame 3C52 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Requested by
Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf2dea74c2167f9b90ec423d1423652280593f68efab42a5559a63cd3eb7f6db
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://as.ad4m.at/ad/dr?ed=1g00gqb8xm6wfb8a3vy8c82p22ptbz0v91xbmpgqdktrpwnhq8hpjf5ek09tjn33xcgxj6jfrksn8aj4ww9b6t4p9y07zmme32re1k08bfbd4ehfmbgfq8kghdd06czxqxd3ysvf2c9grerq6hrdwdr57syq28afsv3w4w1vawjjenf95ve94dvv53606b1bafh6vyc6r460fg042jwe1tyrn2ka1vd50987gzs0nbmthkpkt2afcnpgyafsbx3jq111cv5e8zfrzp229jgc0wfhc5dc00gkedtcpybs48ej08ghstz50824w5baw5zjvfg30fg2d9zfjpx2merg26g3ct6c4jdmr01sekh7feaz84ged6y7sdgxvk1rskecx9yw3pbwt8ry1bfeww0gcsnk7ghtsf4gvjmnjxspq9pyfz5y1e62g&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%26client%3Dca-pub-7500593236707325%26adurl%3D

Response headers

date
Thu, 10 Mar 2022 21:16:19 GMT
content-type
text/html; charset=utf-8
strict-transport-security
max-age=86400; includeSubDomains; preload
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options
noopen
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection
1; mode=block
cross-origin-embedder-policy
unsafe-none
content-security-policy
block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy
same-origin
feature-policy
geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires
0
surrogate-control
no-store
pragma
no-cache
cross-origin-opener-policy
unsafe-none
via
1.1 google
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6e9f121b0cb45c50-FRA
content-encoding
br
rar
as.ad4m.at/ad/ Frame 62CD 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Requested by
Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c824cef6b855bf575b4c6a0564cf50f40da1e47fb7b58b8903ca32d3758b49e
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://as.ad4m.at/ad/dr?ed=1hapaqsf06bc3s73kz1e4nnpvf42nc8ap3qrzg99fsedaa0agv2vze4vpnbcpvcghqqap7ry39trck3ee1fpft1p47nmr378cqs1pebjm4tkqekcye879p24j89vpymbttee6ccmp9sw1v06ca5dd60h637b9tjww4nk52k6h4fy1w1s01wbvxp4m0kchtecsf4d07bsjmv8frdfjxwv5yt6vy0n35dtfcxt070aa1shh1g92m05zvpt89afj2g0av6t727t6q4hqynn1jaa4pt6j1mqxfb9sgt6j28v0dp172vsb1ywcjds2nca74bh5spf5kscwrztjc0535je98akbwv6cma52mdmzbhfc7wc0h35pykfwp3hk5k0brjbjj1rhwkrzsd7522wxe6f7vh1gag6yvfnq1gndcyzdv9dhd4shpjg&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%26client%3Dca-pub-7500593236707325%26adurl%3D

Response headers

date
Thu, 10 Mar 2022 21:16:19 GMT
content-type
text/html; charset=utf-8
strict-transport-security
max-age=86400; includeSubDomains; preload
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options
noopen
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection
1; mode=block
cross-origin-embedder-policy
unsafe-none
content-security-policy
block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy
same-origin
feature-policy
geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires
0
surrogate-control
no-store
pragma
no-cache
cross-origin-opener-policy
unsafe-none
via
1.1 google
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6e9f121b2ce05c50-FRA
content-encoding
br
rar
as.ad4m.at/ad/ Frame DCF6 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Requested by
Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
beff8d5769ba68eaa43d7713cbdf15cf9b6cf7cdff4dd1c3a0a012d70a939518
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://as.ad4m.at/ad/dr?ed=1jwxytvzdtfztg26m3yta04wqrr2hhkxx1mpvtb3rahhq1knh6aj7kj1qvt6q8pt8gmkms4aj4670zr4p92hw5f2a6bj2v5bbc34qftap4tan2b0zxfe55ab78y7cvjp6mrksjw7tn3d7xs9es5t6t9c2xv60mgba2vsg6s66gx5ewjh8zh7nxxa60q7ka68gw9jq5yvx1t2rmdn5hqf4qybtsnnmvp84mrav8x7f587tt5rkn07pzynk7fpkzd3w983aqk6yx027c7c0h4kb9thphv7vm5k4g70kc7y0v5apt493s1bwfn523yp520f5rk2dph25kycr1kp8tc3khxrdwj702dshjm9mnx5thmn1q5w3289zfqqkhvzy9zqke38dhzt1b6yyzk0ej8rbdhsg5d830rs8k9r2nbv8jn13f6gyrhv2&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%26client%3Dca-pub-7500593236707325%26adurl%3D

Response headers

date
Thu, 10 Mar 2022 21:16:19 GMT
content-type
text/html; charset=utf-8
strict-transport-security
max-age=86400; includeSubDomains; preload
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options
noopen
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection
1; mode=block
cross-origin-embedder-policy
unsafe-none
content-security-policy
block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy
same-origin
feature-policy
geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires
0
surrogate-control
no-store
pragma
no-cache
cross-origin-opener-policy
unsafe-none
via
1.1 google
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6e9f121b3d015c50-FRA
content-encoding
br
default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame 62CD 		81 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age
870319
cross-origin-embedder-policy
unsafe-none
cf-polished
origSize=83581
surrogate-control
no-store
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=86400; includeSubDomains; preload
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
same-origin
expires
0
last-modified
Mon, 28 Feb 2022 19:31:00 GMT
server
cloudflare
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options
noopen
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type
text/css; charset=utf-8
vary
Accept-Encoding
cache-control
max-age=3600, must-revalidate, proxy-revalidate
cf-ray
6e9f121b8dbd5c50-FRA
cf-bgj
minify
D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
assets.ad4m.at/logo/ Frame 62CD 		53 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/logo/D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7cdf71044448cb736733f5163fff96081d51ba4101567d61d22ee5998a7a399

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=V11ayA==, md5=Cid9We/KA2mmmDZF4nNlng==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
88854
cf-polished
origFmt=png, origSize=115129
x-guploader-uploadid
ADPycdt5m8MKfD8vivYxNQwLE6DOSGX1MOqECeVQ0m6Ix2n06edxj0i5MJfOMS52yU13g4a-xWPiuWkj9n3rnb2_0lk
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
54564
last-modified
Tue, 09 Feb 2021 15:11:24 GMT
server
cloudflare
etag
"0a277d59efca0369a6983645e273659e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1ZTAu3OZ5Gz5a7E9P1d3%2BueyyrOG4AWffPHjfN2LPURhlriK%2BHS%2FQ71SbG2BlbStCXXMc%2B4uAktXW7IJvsSqR4lQkmjcWgp9Z40TpHCha1ULsdYgVxQqoZfobihYWRSFMz0wJJ0I6Nec175l"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1612883484779402
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
115129
accept-ranges
bytes
cf-ray
6e9f121ba83f9162-FRA
cf-bgj
imgq:85,h2pri
26828D6A2B7AB8CBF0BD7B12A4C4174B36788EB53D97F67629064D2A25EF1C665B2713B39242B63E13EAC36EB9351683292AFEA0E72E0EB1131F26ACCAD28AC2
assets.ad4m.at/product_image/ Frame 62CD 		31 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/product_image/26828D6A2B7AB8CBF0BD7B12A4C4174B36788EB53D97F67629064D2A25EF1C665B2713B39242B63E13EAC36EB9351683292AFEA0E72E0EB1131F26ACCAD28AC2
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1189ccbd0346d7aeb090d8769592e0285599a29122ffd5a0a0ce9c039412387c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=UIcfng==, md5=WdNWx4gdrvbwTy1Z36jlTw==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
89320
cf-polished
qual=85, origFmt=jpeg, origSize=80186
x-guploader-uploadid
ADPycdtMiDMR6CTBCd0M2t_7zYcqs-C8CQN3LcS61HAk7i6EfXAJ7JCff4t9M_lJ1Z9hRlbvercNd0VC-O1r3oflEmg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
31900
last-modified
Wed, 10 Feb 2021 09:05:09 GMT
server
cloudflare
etag
"59d356c7881daef6f04f2d59dfa8e54f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2wavEH8%2F1V%2BCqrTfnwX46gxVpCZrNxqA0IPan7f996ER2Y0zBQm9Lk719sF453zgD3lROl924BI86fvQRYgLfv%2Bqg4NdpkR%2FyBwnX%2BPM%2BRbloRSbbuwp6QIy%2FtKnHlhhQGkt79u0HaPgEUoG"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1612947909004757
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
80186
accept-ranges
bytes
cf-ray
6e9f121ba8469162-FRA
cf-bgj
imgq:85,h2pri
/
partner.o2online.de/a/ Frame 62CD
Redirect Chain
  • https://www.telefonica-partner.de/tpv.php?t=117679V1226132702M&subid=oneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
  • https://www.lead-alliance.net/tpv.php?t=117679V1226132702M&subid=oneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
  • https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022031022161965414948587X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuidDOoHe9M...
49 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022031022161965414948587X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022031022161965414948587X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
HTTP/1.1
Server
78.46.85.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
nonstopads1.sunbonet.de
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:19 GMT
X-NODEIP
78.46.85.162
Server
nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy
https://www.nonstoppartner.net/
P3P
policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=10
Content-Length
49

Redirect headers

location
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022031022161965414948587X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022031022161965414948587X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
nginx
x-xss-protection
1; mode=block
content-type
text/html; charset=UTF-8
DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
assets.ad4m.at/logo/ Frame 62CD 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/logo/DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5eeedf9055f9efab9127642b4c44135be9f404caa7ce08e51a5ea734dfd28828

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=euqM8A==, md5=F0uw3DVkfiBLCaoSCWVgSg==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
83872
cf-polished
origFmt=png, origSize=24833
x-guploader-uploadid
ADPycdt7lqoBLs6A7lt4z1LHRQjUnt97U0x1N__X7KzRNCe-7r9zQWKMhUYRwEyVhCW5PVPogsGGar3TruW0x7AivEM
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
9258
last-modified
Tue, 09 Feb 2021 15:11:57 GMT
server
cloudflare
etag
"174bb0dc35647e204b09aa120965604a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z%2FPfW9gMmPYOSzmFb7AKUQllkSsKotDo3P38sENupuD5nyz149sgWhheFsPDbK%2BCDdzqCont%2F8YOAEnMCjqyFCzGOE%2F92XCW0z1mRdC5dg4FaAz9XbR5sut8ivDfr06DD8eSdrx3%2FtsFycWf"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1612883517528266
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
24833
accept-ranges
bytes
cf-ray
6e9f121ba84b9162-FRA
cf-bgj
imgq:85,h2pri
4DE97418EB5F5BE9A71C11FD95916F9836DEEEC46AE84ACFA7D2376456F7A7C74F106F12C1A70D7E3A981D479BA3AF50577133602BE1F8B4B02B50A143BD72D1
assets.ad4m.at/product_image/ Frame 62CD 		19 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/product_image/4DE97418EB5F5BE9A71C11FD95916F9836DEEEC46AE84ACFA7D2376456F7A7C74F106F12C1A70D7E3A981D479BA3AF50577133602BE1F8B4B02B50A143BD72D1
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff52cd6fa87197e500ac404574525aeeb1b9d184f90a74e19197f6fc159e6107

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=JbWtsw==, md5=JJTrR/gVHMvTHm8bHvL8+Q==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
83912
cf-polished
qual=85, origFmt=jpeg, origSize=136162
x-guploader-uploadid
ADPycdsT2vot02Wqehz1BTC9GUC1OIFHHqz_C2cFE4Vz1HXKTj7uw6AJI5bGKSvmQuxcsxSbN-GkXfmSU9rcaDbmjvI
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
19842
last-modified
Thu, 21 Oct 2021 09:14:42 GMT
server
cloudflare
etag
"2494eb47f8151ccbd31e6f1b1ef2fcf9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p0Flf04upuct90VLyP6MB6Ah5tNQqXWo5ik%2F5xUVBSvxOGHDUlDD%2F6vUIxX5PcmCCMbbYKl6vTngas27oAZ%2BoO16mTPqXMH7CGTaylSv4JKR3O905icVJ2lBunjFzWVVGSqNl4Id050bC%2Ftr"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1634807682206403
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
136162
accept-ranges
bytes
cf-ray
6e9f121ba84c9162-FRA
cf-bgj
imgq:85,h2pri
/
partner.blau.de/a/ Frame 62CD
Redirect Chain
  • https://www.telefonica-partner.de/tpv.php?t=117663V1225131106M&subid=oneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
  • https://www.lead-alliance.net/tpv.php?t=117663V1225131106M&subid=oneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
  • https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=117663&s_id=2022031022161965414948595X117663V1225131106MSoneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuidDOoHe9Mi4...
49 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=117663&s_id=2022031022161965414948595X117663V1225131106MSoneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
HTTP/1.1
Server
46.4.41.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
nonstopads2.sunbonet.de
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:19 GMT
X-NODEIP
46.4.41.145
Server
nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy
https://www.nonstoppartner.net/
P3P
policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=10
Content-Length
49

Redirect headers

location
https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=117663&s_id=2022031022161965414948595X117663V1225131106MSoneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
nginx
x-xss-protection
1; mode=block
content-type
text/html; charset=UTF-8
C46E36494CD11571AD6096436563A935A4EF86E9E013CC4B9F0AD882C02907C50D011AD030C69BCB573604CFA07F783CB4ADC16C72A9B72EB614A2172586C052
assets.ad4m.at/logo/ Frame 62CD 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/logo/C46E36494CD11571AD6096436563A935A4EF86E9E013CC4B9F0AD882C02907C50D011AD030C69BCB573604CFA07F783CB4ADC16C72A9B72EB614A2172586C052
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dded8f8315bfa1c937330c6d23a5883248d37e189635b093e93e096e594ad5d9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=E3pl4w==, md5=aKDSgUdJtYIMnFy3kSz8CQ==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
91777
cf-polished
origFmt=png, origSize=59160
x-guploader-uploadid
ADPycdseVJ947GLODqDB0FnxrxPzEueFe0428y8-yHsb-dySYH24bbK9oXJsKWiukTJysEyDG1gCQ4iLlAZyL99KDM4
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
39746
last-modified
Wed, 12 Feb 2020 10:33:43 GMT
server
cloudflare
etag
"68a0d2814749b5820c9c5cb7912cfc09"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cQs74IiO4%2BsJFC%2FKPrAh92jsFFoWAkob8s%2FlTcLSi3aOt%2BvDzlIChUCWxB4C44NNvhGEJ6SP%2F5ZZ%2BivzskQ3Kd294AxxO%2F%2BfERPfah6xWTMhkbTjMJGupWMTSJwbCo0%2BZ8UBNu%2FqZQvlF0m2"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1581503623525394
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
59160
accept-ranges
bytes
cf-ray
6e9f121ba8429162-FRA
cf-bgj
imgq:85,h2pri
3A1416EE928727CAA262D55B41C53B838E063DB8190E91AD28C25ED5A196521B7E995F4FF8A87D4E3E3AE2959912A928F43AB1C2988064014D978C88D75E9BD5
assets.ad4m.at/product_image/ Frame 62CD 		381 KB
382 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/product_image/3A1416EE928727CAA262D55B41C53B838E063DB8190E91AD28C25ED5A196521B7E995F4FF8A87D4E3E3AE2959912A928F43AB1C2988064014D978C88D75E9BD5
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9003fef55e3576f4a0a0238398fe166e7ee41975e55dd3ba079066eea0fb291d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=7K8YCA==, md5=h7XbqynNpVDqQyWo3WfcwA==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
85946
cf-polished
origFmt=png, origSize=609525
x-guploader-uploadid
ADPycdvQY3AYfNTDaTpk3n2zuRcDIYgJuK4xpOwIvE46qyVFuvhGuu61_N5pzBNOLwnUti9QR2vu0UWIXZvR4QRv7-s
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
390038
last-modified
Wed, 23 Feb 2022 15:34:53 GMT
server
cloudflare
etag
"87b5dbab29cda550ea4325a8dd67dcc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xFpfIBKGVjn%2BpwAgn8Iv3cS0wuOamoOY91BUfIenhAQCTlVK%2FiH3BOr3YRWOgtAwQfq5KXSwOEDXn2WjZlHA6beYxw44ee68THHyCVMHNFUzhLipwn%2BLopqS3fUrVZEsgS35%2BUkbKt4aB9BZ"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1645630493382906
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
609525
accept-ranges
bytes
cf-ray
6e9f121ba8459162-FRA
cf-bgj
imgq:85,h2pri
cshow.php
www.awin1.com/ Frame 62CD 		43 B
704 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.awin1.com/cshow.php?s=2480620&v=14363&q=359541&r=412871&pv=1&pref3=oneidY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Troneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd={{IAB_CONSENT_PD}
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C37798%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUVpVhxH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=728&d=90&e=DOoHe9Mi4qSYkvuu9_8QOombj-IA9O9k&g=39c26495e46f34ba43f722afb85675a5%2F11684290002333236940&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978999&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1gh0hk3emz2fpvzcy55w50ykaajnhqstfabrpyxne46enz5ztjpg13p5a8p5kgtg52fgmjaq118eemzpgymzabxmxndagv37ptvanmydk0fr4q7d7fv0n3jkjyg22masmv9yd0s7t5zqvw80h6mnj5a7dr26r3xpgzd2zayvvfqz0jvc020r0qaqq563e6mjp7d7r4zxf3yanf6bntry9rtvja40w96h4y9a0xhks7w90rc6eparptc0d7kg68j9d0ajgp4qt7fdjc5g46wg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCxy3zomoqYrq-DMn47gPPkrigCpDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpAoUKYu0AcLI-qAMBqgScA0_Qc99tjzMrzJsUIaotijIuYQdAfoP6lh6AW_C5uGR76dVKdbdSsIqfs9ZG9o3hKhMHv0az5_qlwWopYCL9IrzPTjoHs-Td53Z-0DjRbQZ5Nymb_gefcQnogBrCCanAp1IYo2cZ2O6nh_-clSf3LheglTD9NjxijzY0frXSoJZ4tCSZ-D9QfxmXPWmSVUliFUBrxqKNtxd7RV4OJszKf4k3wWladKX3eqoiWs52CJTrL1BXC_EqXvMStiZHkqv-k6KnHPGWiFEcK7SgF455-fBI71mRsNEKQ5a-SVXR1UsZgb9waXHXubIxD-rzqkV6JuxgyExyeYAk8YsF8BrmQezjAKBthKT5jYfRued2QcezcUWlB7D3bkkqVbV0Matc51ksvSQfCt8q6NIVuzD_8hvDVB2h5n2DAYfkvW6K-EXwLrkRDO3QmKPxRU6qvFNJ0hm59mq-a2PI8DCYMSblg4PPn6mp1nEnxYDPKW5MXkZ6fnL8Y84AEy-E_iOoRB_xp4tz87mOshZpBnlzc7PB7C_LCDpaco10h5EczBaABqPh6Ov57OTX9wGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0VO-IwA8yo5gyXq7u1d62tn1idXg%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-239-217.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:19 GMT
Strict-Transport-Security
max-age=86400
P3P
policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control
no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set
default
Node
Helix
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
0
default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame DCF6 		81 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age
870319
cross-origin-embedder-policy
unsafe-none
cf-polished
origSize=83581
surrogate-control
no-store
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=86400; includeSubDomains; preload
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
same-origin
expires
0
last-modified
Mon, 28 Feb 2022 19:31:00 GMT
server
cloudflare
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options
noopen
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type
text/css; charset=utf-8
vary
Accept-Encoding
cache-control
max-age=3600, must-revalidate, proxy-revalidate
cf-ray
6e9f121b8dc65c50-FRA
cf-bgj
minify
D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
assets.ad4m.at/logo/ Frame DCF6 		53 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/logo/D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7cdf71044448cb736733f5163fff96081d51ba4101567d61d22ee5998a7a399

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=V11ayA==, md5=Cid9We/KA2mmmDZF4nNlng==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
88854
cf-polished
origFmt=png, origSize=115129
x-guploader-uploadid
ADPycdt5m8MKfD8vivYxNQwLE6DOSGX1MOqECeVQ0m6Ix2n06edxj0i5MJfOMS52yU13g4a-xWPiuWkj9n3rnb2_0lk
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
54564
last-modified
Tue, 09 Feb 2021 15:11:24 GMT
server
cloudflare
etag
"0a277d59efca0369a6983645e273659e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8RFaYdte3Uhm5jSt%2BoHout7tmfJPyAo3PvXu%2BP5I8fwvvRXS0rpknJbPjrIVjcd1JVPpsc%2Bbd0uXH%2Ba0v9LcN72z58fmDP6qODN1tcRM3HY9KMCqdjsvMplScyN%2FOjochvi8QhX8OvHvAws9"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1612883484779402
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
115129
accept-ranges
bytes
cf-ray
6e9f121bc88d9162-FRA
cf-bgj
imgq:85,h2pri
C0E2E65BC4D69E2C5F9D514A5041B6B0AE0E5BB863260C3B30D59861DF186AFE1011A812913038724AE6F6D9126CEA97123592CC0CACE3B08B0DF96C2064CD70
assets.ad4m.at/ Frame DCF6 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/C0E2E65BC4D69E2C5F9D514A5041B6B0AE0E5BB863260C3B30D59861DF186AFE1011A812913038724AE6F6D9126CEA97123592CC0CACE3B08B0DF96C2064CD70
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
34be38d133fe32063b42903021ab00b51e6ba9190777a9a331a323295e8cc4b9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=Pv/FNg==, md5=webz2VYvtsFrTnTrxC/AHQ==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
86012
cf-polished
qual=85, origFmt=jpeg, origSize=44231
x-guploader-uploadid
ADPycdu_Itw9XBTVx5njMDXyOorNarNdTl-_DegJ0gIIvbhj1nc_Hz7NlUMErQ653X8KK7xnInFtGM-MImGn5Am6UeQDUgaWfQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
18262
last-modified
Wed, 05 Feb 2020 14:11:28 GMT
server
cloudflare
etag
"c1e6f3d9562fb6c16b4e74ebc42fc01d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PyFZ%2FCLZxFO6pOqGFtVXi0ESks3%2FmqnTUXumq2hn8ZbdYzWNO9RHc2rNrbGo%2BjdUDq28XUCepY72KMal8YqJrqpIWzgY%2B7MCEhs%2F1x0oOQiCg9m%2FvBANfQRYlhPTqJufEIPZLHL7GpNlS35%2B"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1580911888990293
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
44231
accept-ranges
bytes
cf-ray
6e9f121ba84d9162-FRA
cf-bgj
imgq:85,h2pri
/
partner.o2online.de/a/ Frame DCF6
Redirect Chain
  • https://www.telefonica-partner.de/tpv.php?t=117679V1226132702M&subid=oneid3bgFpf14UB63a7HrHAtEt997f8TWTReadoneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
  • https://www.lead-alliance.net/tpv.php?t=117679V1226132702M&subid=oneid3bgFpf14UB63a7HrHAtEt997f8TWTReadoneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
  • https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022031022161965414948591X117679V1226132702MSoneid3bgFpf14UB63a7HrHAtEt997f8TWTReadoneid__asuidlWBR-OZ...
49 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022031022161965414948591X117679V1226132702MSoneid3bgFpf14UB63a7HrHAtEt997f8TWTReadoneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022031022161965414948591X117679V1226132702MSoneid3bgFpf14UB63a7HrHAtEt997f8TWTReadoneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
HTTP/1.1
Server
78.46.85.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
nonstopads1.sunbonet.de
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:19 GMT
X-NODEIP
78.46.85.162
Server
nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy
https://www.nonstoppartner.net/
P3P
policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=10
Content-Length
49

Redirect headers

location
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022031022161965414948591X117679V1226132702MSoneid3bgFpf14UB63a7HrHAtEt997f8TWTReadoneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022031022161965414948591X117679V1226132702MSoneid3bgFpf14UB63a7HrHAtEt997f8TWTReadoneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
nginx
x-xss-protection
1; mode=block
content-type
text/html; charset=UTF-8
DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
assets.ad4m.at/logo/ Frame DCF6 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/logo/DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5eeedf9055f9efab9127642b4c44135be9f404caa7ce08e51a5ea734dfd28828

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=euqM8A==, md5=F0uw3DVkfiBLCaoSCWVgSg==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
83872
cf-polished
origFmt=png, origSize=24833
x-guploader-uploadid
ADPycdt7lqoBLs6A7lt4z1LHRQjUnt97U0x1N__X7KzRNCe-7r9zQWKMhUYRwEyVhCW5PVPogsGGar3TruW0x7AivEM
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
9258
last-modified
Tue, 09 Feb 2021 15:11:57 GMT
server
cloudflare
etag
"174bb0dc35647e204b09aa120965604a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s57MWpYlZ8ueD87w%2BW2qLSL6HIwewgL6VIefKoa6gDxIBkkAL1HiSDnhyC2NCsoNvkchxeYEPZyPhwQYZ9xHgeSenSbfMTX9%2FiwEinfi%2Bq%2FrdLwNmTBCFe04Xj%2FEsG0aq0i9ybW9WihVd6%2B5"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1612883517528266
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
24833
accept-ranges
bytes
cf-ray
6e9f121bc8889162-FRA
cf-bgj
imgq:85,h2pri
0AC0DD533161B07A3BB2D72DC66FF10DF997383C63884E78FDBEF4BEDA8ED904DC259BD68D098814FB574FED8B566E90A3C1272EA9C368275203F9D628BB015E
assets.ad4m.at/product_image/ Frame DCF6 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/product_image/0AC0DD533161B07A3BB2D72DC66FF10DF997383C63884E78FDBEF4BEDA8ED904DC259BD68D098814FB574FED8B566E90A3C1272EA9C368275203F9D628BB015E
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
769996a987ead923de78ded8af9ebbc0125bfdca436dfadfdc9755fd54270371

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=1aKs/g==, md5=nBaxji7Rcg1LrHhoV5P3TA==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
97837
cf-polished
qual=85, origFmt=jpeg, origSize=84530
x-guploader-uploadid
ADPycdsDh8V-kleKhi_L5OQzn5QrDdgLWR9W4fNIAdOj9TX3vmrvxha4qh6_ZywO-C3owSNMoj54sPFqQRxCs0bwHO4
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
19022
last-modified
Wed, 10 Nov 2021 15:00:52 GMT
server
cloudflare
etag
"9c16b18e2ed1720d4bac78685793f74c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xXmlh0guDmztVyBBIL%2BG%2FpWesUPu2dV%2B7zaVAI1wEGbpqQlPUeG%2BVZuA3iOiiDu3jRKyC%2FTZeXoMVfwGChHaCpn8vnwVBwMbXZ2xtVC61%2BoweNUDU%2BfRD7rRWjaxz1RMAZZIi%2FRSI2r29koW"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1636556452656256
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
84530
accept-ranges
bytes
cf-ray
6e9f121bc8869162-FRA
cf-bgj
imgq:85,h2pri
/
partner.blau.de/a/ Frame DCF6
Redirect Chain
  • https://www.telefonica-partner.de/tpv.php?t=113752V1225131106M&subid=oneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
  • https://www.lead-alliance.net/tpv.php?t=113752V1225131106M&subid=oneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
  • https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022031022161965414948593X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidlWBR-OZnz...
49 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022031022161965414948593X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
HTTP/1.1
Server
46.4.41.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
nonstopads2.sunbonet.de
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:19 GMT
X-NODEIP
46.4.41.145
Server
nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy
https://www.nonstoppartner.net/
P3P
policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=10
Content-Length
49

Redirect headers

location
https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022031022161965414948593X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
nginx
x-xss-protection
1; mode=block
content-type
text/html; charset=UTF-8
C46E36494CD11571AD6096436563A935A4EF86E9E013CC4B9F0AD882C02907C50D011AD030C69BCB573604CFA07F783CB4ADC16C72A9B72EB614A2172586C052
assets.ad4m.at/logo/ Frame DCF6 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/logo/C46E36494CD11571AD6096436563A935A4EF86E9E013CC4B9F0AD882C02907C50D011AD030C69BCB573604CFA07F783CB4ADC16C72A9B72EB614A2172586C052
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dded8f8315bfa1c937330c6d23a5883248d37e189635b093e93e096e594ad5d9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=E3pl4w==, md5=aKDSgUdJtYIMnFy3kSz8CQ==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
91777
cf-polished
origFmt=png, origSize=59160
x-guploader-uploadid
ADPycdseVJ947GLODqDB0FnxrxPzEueFe0428y8-yHsb-dySYH24bbK9oXJsKWiukTJysEyDG1gCQ4iLlAZyL99KDM4
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
39746
last-modified
Wed, 12 Feb 2020 10:33:43 GMT
server
cloudflare
etag
"68a0d2814749b5820c9c5cb7912cfc09"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Hfz7szGvftG3YbAYiFlvPHStifrSdVfELEW8SbbJ0u9IgY8NzrDa2ntqaCn6E2vdJIjzgMRrlsPlMyxwBrdLPx1ou92oeNCwCXezwiTBAcf5Wp%2BmByjnUApXqW%2BGgSVTJC684L3gaispO5t"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1581503623525394
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
59160
accept-ranges
bytes
cf-ray
6e9f121bc88b9162-FRA
cf-bgj
imgq:85,h2pri
3A1416EE928727CAA262D55B41C53B838E063DB8190E91AD28C25ED5A196521B7E995F4FF8A87D4E3E3AE2959912A928F43AB1C2988064014D978C88D75E9BD5
assets.ad4m.at/product_image/ Frame DCF6 		381 KB
382 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/product_image/3A1416EE928727CAA262D55B41C53B838E063DB8190E91AD28C25ED5A196521B7E995F4FF8A87D4E3E3AE2959912A928F43AB1C2988064014D978C88D75E9BD5
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9003fef55e3576f4a0a0238398fe166e7ee41975e55dd3ba079066eea0fb291d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=7K8YCA==, md5=h7XbqynNpVDqQyWo3WfcwA==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
85946
cf-polished
origFmt=png, origSize=609525
x-guploader-uploadid
ADPycdvQY3AYfNTDaTpk3n2zuRcDIYgJuK4xpOwIvE46qyVFuvhGuu61_N5pzBNOLwnUti9QR2vu0UWIXZvR4QRv7-s
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
390038
last-modified
Wed, 23 Feb 2022 15:34:53 GMT
server
cloudflare
etag
"87b5dbab29cda550ea4325a8dd67dcc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2OQ6yUTJ%2B%2F9NJY8iHeqapFyUeTST7IDdbl4rbjP9zN4bTpYpSGpc5znx%2FQA4y%2BrqWdppeQoedJZuPXGUFPbg0xx7WsisqiSEIvtWctW2ogy%2BFO5rMp1ZVCd0j5d%2FZeQPoJXoeaTkaBewzlMR"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1645630493382906
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
609525
accept-ranges
bytes
cf-ray
6e9f121bc8899162-FRA
cf-bgj
imgq:85,h2pri
cshow.php
www.awin1.com/ Frame DCF6 		43 B
704 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.awin1.com/cshow.php?s=2480620&v=14363&q=359541&r=412871&pv=1&pref3=oneidY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Troneid__asuidlWBR-OZnzNRSEE-XKXSToKOm4u7TjiXVasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd={{IAB_CONSENT_PD}
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19483%2C19491%2C182000&b=3bgFpf14UB63a7HrHAtEt997f8TWTRead%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=WrpSrfYdsYJWuYH5HjtDCXXGaPTET4QF2%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=250&e=lWBR-OZnzNRSEE-XKXSToKOm4u7TjiXV&g=131e7320ac4ac5b7b831864c5aaa7c92%2F11164407888829653755&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1kj3de7j088sf9982n293yefmfpvakwrfmg96s1whx9k3rkca8g2cgae8vm66dr6xj3mjvkytgyyn3jn9fn5xk9dbxjh2p3hpj92de6qxs8pc7bmys6mp7xc538qr07kxpswam76442a695fnsrwjgche5wna1gmtf83m9ds923wfym8znm7ja6zapw3ggn7ctb82aqydhhga6gtzfkzywg95qcdcfjp0rb1j7ah4qftsh040jgzrnk95v2tpv39ph802411mv009bpzbpwg%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCK_DTomoqYumXEKmlx_APvqSjyAuQ4YGEXLaoworwAsCNtwEQASAAYJUCggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQKSNL7jI3qyPqgDAaoEnQNP0Hok5ngnzCUvaqsTI2zjVLkTrz3o-MlIPNj23v56dPUXrR17TEd4tcYsaW86lNu-QJK0pi3c3oU9gyFnE7PCyVo9vuSgoUuIg9KNt1cWjwil4A6U4WPeOIm-Y6Ufe-CqQR-LleZUcZU1Vc5uxEoy5nGUC7WUCs6Vh2ABy2tm_6WY7uy_axB_6--qF__5_mDph0ujcACEIB8T3CzxhqSDlCp9FvpYBx9pzA3OB-STH4ah9GpKV0y6bGIApbMUOVhPh6c_DMkkDUPGB7aqBGcfLYdE9b_s_UEZ8ell88iFREb2mVz9Sm5Hf07QkgbLYpT6BMcYhnd0EpvflXSpm_HjU7x6qcxOzf8VhCewj0U-ifPEOmg2cQhn3MkyU6r-TvEoBqCtwB2QyploN2MdaGNNQ1wwhGW9r2W8Y7XSPwNyZD4Xnv4w3IfQfbMasXUQVpzv8-K3wPgH_yzD7AQCL9CSaOQgc_uCd7kxdT3rEafO2-S_6z3Foux1Lz3tosXQD-TZUtXgt6U26eV65YWCy9XY1C-y_jp29C8lGa5t5oAGvLaZ853-j8sxoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_01F_9vrmW51QbP9tzxclUA2PjFwA%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-239-217.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:19 GMT
Strict-Transport-Security
max-age=86400
P3P
policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control
no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set
default
Node
Helix
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
0
default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame 3C52 		81 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age
870319
cross-origin-embedder-policy
unsafe-none
cf-polished
origSize=83581
surrogate-control
no-store
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=86400; includeSubDomains; preload
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
same-origin
expires
0
last-modified
Mon, 28 Feb 2022 19:31:00 GMT
server
cloudflare
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options
noopen
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type
text/css; charset=utf-8
vary
Accept-Encoding
cache-control
max-age=3600, must-revalidate, proxy-revalidate
cf-ray
6e9f121b9dcb5c50-FRA
cf-bgj
minify
D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
assets.ad4m.at/logo/ Frame 3C52 		53 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/logo/D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7cdf71044448cb736733f5163fff96081d51ba4101567d61d22ee5998a7a399

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=V11ayA==, md5=Cid9We/KA2mmmDZF4nNlng==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
88854
cf-polished
origFmt=png, origSize=115129
x-guploader-uploadid
ADPycdt5m8MKfD8vivYxNQwLE6DOSGX1MOqECeVQ0m6Ix2n06edxj0i5MJfOMS52yU13g4a-xWPiuWkj9n3rnb2_0lk
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
54564
last-modified
Tue, 09 Feb 2021 15:11:24 GMT
server
cloudflare
etag
"0a277d59efca0369a6983645e273659e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bmq4GUitaPQ2wX66mwHDh8nJJQkN%2BHJZ633GSbA4nOM%2FoLIIhI3vY7UhKetZrLIfW7rAHT6B33fwAwgcDd9MA2KHVMX04EXHJFi1RhFP%2FF1x3eFBRXL6%2BJRe3PFGET1YKDH%2BGuNxqDMnW6hz"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1612883484779402
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
115129
accept-ranges
bytes
cf-ray
6e9f121ba8419162-FRA
cf-bgj
imgq:85,h2pri
26828D6A2B7AB8CBF0BD7B12A4C4174B36788EB53D97F67629064D2A25EF1C665B2713B39242B63E13EAC36EB9351683292AFEA0E72E0EB1131F26ACCAD28AC2
assets.ad4m.at/product_image/ Frame 3C52 		31 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/product_image/26828D6A2B7AB8CBF0BD7B12A4C4174B36788EB53D97F67629064D2A25EF1C665B2713B39242B63E13EAC36EB9351683292AFEA0E72E0EB1131F26ACCAD28AC2
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1189ccbd0346d7aeb090d8769592e0285599a29122ffd5a0a0ce9c039412387c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=UIcfng==, md5=WdNWx4gdrvbwTy1Z36jlTw==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
89320
cf-polished
qual=85, origFmt=jpeg, origSize=80186
x-guploader-uploadid
ADPycdtMiDMR6CTBCd0M2t_7zYcqs-C8CQN3LcS61HAk7i6EfXAJ7JCff4t9M_lJ1Z9hRlbvercNd0VC-O1r3oflEmg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
31900
last-modified
Wed, 10 Feb 2021 09:05:09 GMT
server
cloudflare
etag
"59d356c7881daef6f04f2d59dfa8e54f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=veUaVwggD7jUq2gSFK8ywckDDUBU%2FVAVzmJo1TMnY9WfI0Q%2BSUD%2BvQRnuFomWNchNd%2BKnEzX79nA0zPPoY4dngV66J0WSxx1tX2LprcRIHvQqozfvUsKXi%2FNHHj6PCrUnkflOOHd%2BWXueJLE"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1612947909004757
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
80186
accept-ranges
bytes
cf-ray
6e9f121bc88c9162-FRA
cf-bgj
imgq:85,h2pri
/
partner.o2online.de/a/ Frame 3C52
Redirect Chain
  • https://www.telefonica-partner.de/tpv.php?t=117679V1226132702M&subid=oneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
  • https://www.lead-alliance.net/tpv.php?t=117679V1226132702M&subid=oneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
  • https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022031022161965414948589X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuid82BiICP...
49 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022031022161965414948589X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022031022161965414948589X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
HTTP/1.1
Server
78.46.85.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
nonstopads1.sunbonet.de
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:19 GMT
X-NODEIP
78.46.85.162
Server
nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy
https://www.nonstoppartner.net/
P3P
policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=10
Content-Length
49

Redirect headers

location
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022031022161965414948589X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022031022161965414948589X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
nginx
x-xss-protection
1; mode=block
content-type
text/html; charset=UTF-8
DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
assets.ad4m.at/logo/ Frame 3C52 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/logo/DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5eeedf9055f9efab9127642b4c44135be9f404caa7ce08e51a5ea734dfd28828

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=euqM8A==, md5=F0uw3DVkfiBLCaoSCWVgSg==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
83872
cf-polished
origFmt=png, origSize=24833
x-guploader-uploadid
ADPycdt7lqoBLs6A7lt4z1LHRQjUnt97U0x1N__X7KzRNCe-7r9zQWKMhUYRwEyVhCW5PVPogsGGar3TruW0x7AivEM
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
9258
last-modified
Tue, 09 Feb 2021 15:11:57 GMT
server
cloudflare
etag
"174bb0dc35647e204b09aa120965604a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rpUf6iTqhZ57ibiZpJKgthir9FSSUel6VwUQuETmsofHcc6eP7uN7ndxwj7AZ9uzAoQmOIpx6WAugGUTdT7bOHw%2FwRR0PDprE1cn8JZMYS7PpDaxruq%2FyaiixHYPPk0QYnb0%2Boi%2BO4YzDILS"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1612883517528266
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
24833
accept-ranges
bytes
cf-ray
6e9f121bc8919162-FRA
cf-bgj
imgq:85,h2pri
0AC0DD533161B07A3BB2D72DC66FF10DF997383C63884E78FDBEF4BEDA8ED904DC259BD68D098814FB574FED8B566E90A3C1272EA9C368275203F9D628BB015E
assets.ad4m.at/product_image/ Frame 3C52 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/product_image/0AC0DD533161B07A3BB2D72DC66FF10DF997383C63884E78FDBEF4BEDA8ED904DC259BD68D098814FB574FED8B566E90A3C1272EA9C368275203F9D628BB015E
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
769996a987ead923de78ded8af9ebbc0125bfdca436dfadfdc9755fd54270371

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=1aKs/g==, md5=nBaxji7Rcg1LrHhoV5P3TA==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
97837
cf-polished
qual=85, origFmt=jpeg, origSize=84530
x-guploader-uploadid
ADPycdsDh8V-kleKhi_L5OQzn5QrDdgLWR9W4fNIAdOj9TX3vmrvxha4qh6_ZywO-C3owSNMoj54sPFqQRxCs0bwHO4
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
19022
last-modified
Wed, 10 Nov 2021 15:00:52 GMT
server
cloudflare
etag
"9c16b18e2ed1720d4bac78685793f74c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n6Zn1jsBqyykeg60xLhhbFg5CNFCcNWMD9bG5%2Ficor4VgVulGUbaFwVplVDW2NQdIVa9F9a3yYJObwft0fL1fG%2FuWmWxxUMg4VkG%2FzUy%2FFK49PUUsZvN1aoRNJf3wSBn%2FDmj9P3X%2BPthH5VQ"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1636556452656256
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
84530
accept-ranges
bytes
cf-ray
6e9f121bc8909162-FRA
cf-bgj
imgq:85,h2pri
/
partner.blau.de/a/ Frame 3C52
Redirect Chain
  • https://www.telefonica-partner.de/tpv.php?t=113752V1225131106M&subid=oneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
  • https://www.lead-alliance.net/tpv.php?t=113752V1225131106M&subid=oneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
  • https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022031022161965414948585X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuid82BiICP45...
49 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022031022161965414948585X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
HTTP/1.1
Server
46.4.41.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
nonstopads2.sunbonet.de
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:19 GMT
X-NODEIP
46.4.41.145
Server
nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy
https://www.nonstoppartner.net/
P3P
policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=10
Content-Length
49

Redirect headers

location
https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022031022161965414948585X113752V1225131106MSoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
nginx
x-xss-protection
1; mode=block
content-type
text/html; charset=UTF-8
C46E36494CD11571AD6096436563A935A4EF86E9E013CC4B9F0AD882C02907C50D011AD030C69BCB573604CFA07F783CB4ADC16C72A9B72EB614A2172586C052
assets.ad4m.at/logo/ Frame 3C52 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/logo/C46E36494CD11571AD6096436563A935A4EF86E9E013CC4B9F0AD882C02907C50D011AD030C69BCB573604CFA07F783CB4ADC16C72A9B72EB614A2172586C052
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dded8f8315bfa1c937330c6d23a5883248d37e189635b093e93e096e594ad5d9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=E3pl4w==, md5=aKDSgUdJtYIMnFy3kSz8CQ==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
91777
cf-polished
origFmt=png, origSize=59160
x-guploader-uploadid
ADPycdseVJ947GLODqDB0FnxrxPzEueFe0428y8-yHsb-dySYH24bbK9oXJsKWiukTJysEyDG1gCQ4iLlAZyL99KDM4
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
39746
last-modified
Wed, 12 Feb 2020 10:33:43 GMT
server
cloudflare
etag
"68a0d2814749b5820c9c5cb7912cfc09"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pPBT4izmx0MNHWXPsw68n%2BajE1gLxPFCCmiKj8NXd4YyhM%2FfpVMqpGHU%2B9n1GJbicYAqoJZrUwXm5kS2iT6Zm0OAxXW5Glejxca%2BGzUO8GaXwsiAHWynrF4wI0F9h49Bl2lewT235eAAR8lV"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1581503623525394
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
59160
accept-ranges
bytes
cf-ray
6e9f121ba8499162-FRA
cf-bgj
imgq:85,h2pri
3A1416EE928727CAA262D55B41C53B838E063DB8190E91AD28C25ED5A196521B7E995F4FF8A87D4E3E3AE2959912A928F43AB1C2988064014D978C88D75E9BD5
assets.ad4m.at/product_image/ Frame 3C52 		381 KB
382 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/product_image/3A1416EE928727CAA262D55B41C53B838E063DB8190E91AD28C25ED5A196521B7E995F4FF8A87D4E3E3AE2959912A928F43AB1C2988064014D978C88D75E9BD5
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9003fef55e3576f4a0a0238398fe166e7ee41975e55dd3ba079066eea0fb291d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-goog-hash
crc32c=7K8YCA==, md5=h7XbqynNpVDqQyWo3WfcwA==
date
Thu, 10 Mar 2022 21:16:19 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
85946
cf-polished
origFmt=png, origSize=609525
x-guploader-uploadid
ADPycdvQY3AYfNTDaTpk3n2zuRcDIYgJuK4xpOwIvE46qyVFuvhGuu61_N5pzBNOLwnUti9QR2vu0UWIXZvR4QRv7-s
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
390038
last-modified
Wed, 23 Feb 2022 15:34:53 GMT
server
cloudflare
etag
"87b5dbab29cda550ea4325a8dd67dcc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kYtW26Ib8axIVro3XkKyRApxh04mkm%2BnDo55CVp7sgN8G2wTLtQsLKk8cCwlsASw9m%2FnoI4CC7o66a0%2FOaZEcjvnC%2FPOatwnQKGxPJqMHlcUShXe8CC4%2FB2NI8sgzP6jA%2F%2FvxECNHX3SklKy"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1645630493382906
content-type
image/webp
expires
Fri, 11 Mar 2022 21:16:19 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
609525
accept-ranges
bytes
cf-ray
6e9f121ba8479162-FRA
cf-bgj
imgq:85,h2pri
cshow.php
www.awin1.com/ Frame 3C52 		43 B
704 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.awin1.com/cshow.php?s=2480620&v=14363&q=359541&r=412871&pv=1&pref3=oneidY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Troneid__asuid82BiICP45HnFP1emJ-ubpDG3ffpid5MGasuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd={{IAB_CONSENT_PD}
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19877%2C19491%2C182000&b=Y2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Tr%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CY2jcrfG3f5BXkfVH9HetQtReGtAT1TK1Tr&f=qGXsmf1WUp3JuZHgHDtRCXXxaPTgTq4s3%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2CqGXsmf1WUJ5zAhZHgHDtRCXwgFPTgTq4s3&c=300&d=600&e=82BiICP45HnFP1emJ-ubpDG3ffpid5MG&g=17f72e84460285238bc6b16b62f3eed6%2F12725654121030675716&i=20774%2C20773%2C20703&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1646946978988&h=%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1khjmfjhcres84hn92bveybyvc4yax4htvm0jezggqj37z1xkzayp6avmac4nbphvh3dmzrsdgapd95nyq8y12snxmjjt96e78j5h7n5e223hatrp8f1114trxjsv8e64d97shh1kxa5z3nc95h3qwafya2yqyst8y60detaenegac7nn2qp8x77xech48dmk8j8g6xwynjzm7x5t67hk4j773hn3nk4h5kkf6n8gk15rrk62eeepjvf541177baxd7nrrztpkp22225vs10%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCsa-gomoqYt-aFNflgAeL8ZrADJDhgYRctqjCivACwI23ARABIABglQKCARdjYS1wdWItNzUwMDU5MzIzNjcwNzMyNaABwq7o3QPIAQmpApI0vuMjerI-qAMBqgSjA0_QytVCCgQFc6fapILdAX-XohFUccDbffS6Votn7ehWcZCKRJ0qShnuXvh4vKruo2eczGWJU--5vgJVbtEKlhRmMARWv-lYvrLoGG8R1OYxg9o_ThcneE1NgjzZbVnUp05vHPTnCK_6aSralQ4EZLmmN-RaKbYsgkHRxgHbLXDETWkGxVIoQwQCDaSS4f1MsVVdh0qN3VEnn67XN4wG_FwvEjCyj2HcBEsVqNdcLk6yvuJGe7yvlbeg61WS1xa-iVPHRe88UE0H0Rxbn-EmCpQxv9B5AZsrS6EDU6CZ-GIVxJSbfmnADaceUPjr-DTAYI7iF_xUuK83pgXcRf1gIodc7GIFSSV7zMknFxRQ57A421LUZ7Qyag5RKQ_wwA56xBOoOBWDBkPMjbLoBdY9xec_qu9pHNSmxImvXL4-qVm6PNnGbk6y98x5boFaZsriHuw3ccVp2OVVqsd8J8IZmFegclS7e3D6omhBGiLJHCa0JYhjHIKpT4vmr2MovcLSn0yOXyBHHnDcTKxZW6W2kE-lfTawopFOnZ_Hf_NYm-QeEnItgAaltZbd7MeG0_4BoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%252526num%25253D1%252526sig%25253DAOD64_2b4sdEFjG7_C7886xdRQpd1TZeaw%252526client%25253Dca-pub-7500593236707325%252526adurl%25253D&y=1&z=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-239-217.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:19 GMT
Strict-Transport-Security
max-age=86400
P3P
policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control
no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set
default
Node
Helix
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
0
activeview
pagead2.googlesyndication.com/pcs/ Frame B449 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvFQC9RnAUmCkXu7vvmbFhkXR9oUHNQ_2B5bxAs952ebiE8MNBreX1tQ4cZGK_Dje8ORAK0z9cUybiQMeqGGLfHmcGq8A6PbsirSUDh4r2Glz-w7jpv&sig=Cg0ArKJSzIVUGyFzjqVCEAE&id=lidar2&mcvt=1012&p=8,315,98,1285&mtos=1012,1012,1012,1012,1012&tos=1012,0,0,0,0&v=20220309&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=4166723991&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1646946977374&rpt=734&isd=0&lsd=0&met=ie&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 519E 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv6zSuTxkPJLFRCwfr6j8PhRYfJWPi3p9t__eLM_ncv_6UxJbFZszDdnHkHbDGPOpE8qTac70zxBqCqLncKwldb15gpThW4zQFGBn8lIzEJIAnHbxUG&sig=Cg0ArKJSzM4AVRC4-naHEAE&id=lidar2&mcvt=1008&p=256,1064,536,1400&mtos=1008,1008,1008,1008,1008&tos=1008,0,0,0,0&v=20220309&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=1414505084&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1646946977454&rpt=742&isd=0&lsd=0&met=ie&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame B449 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220308&jk=3023269658188208&bg=!1dal1pLNAAb7UztL-1M7ACkAdvg8Wi_A76S2t6tI6Bkzrrqp2yd17QIX4QCicOxAUbdroRdKVziOWQIAAAFlUgAAAAJoAQcKADvGlXi4lM4bCzLjdaBARQornSuXUo6TwlCs6LD6dO_dlTUWrmivFzVvpAt-5QqewzUQy8pdv9QVp5pELJkC4ql17qb6MRPOmBgywac9Y3mrXBplHhICph7nXxY1_U_iQd_yI8hG6eS0GQna9VfQU8C_uG2o_vsGkjy_vwjhrt81UVSNO5wupDxJEtf-eVoOu1rXLZbDqo_1USSG92FcMwaQr227bcFA5BmAM5_ASBxXUkmH7e_O6IWN3k1St0IbK5Rx_kgNciCJ7tjHIJJGrYdLRumjE3nFYowTRzhsYFbSu9WynpeKcuMItB-xzb-9wPtpVhWnMKx8HP56D2Y_h0BFFE4Yf3LoZKXNwCmHTabDMewQ83gGbND6zxYlBoEnAuvEjbDxClBvtsL6vMGNE9OzqpVN1kzMIN7dr5HtZxSDbfKKGbAGlNtjIvNUf98xZqSHXVTQSOzubq2KLygLsEwnwzNEjYkd9yRV1zCP5tcZN8FSJNDOkNrCSS4zzMFuevW_OLSYMZnOqQHtSBcCNQCObMMiCdeJ7d2vvTtaA7VufzWu09c3EFSobEhcv4cqogN6G3JbJvMNOlxyNIZ8xzXBeLWEhGsL5Pj_LskTVTHNbiooxYG9ifHIdQRs9Q7R-BZ77eVRlSRt1KYDb6_MYVQeD65FN2esMjoYmfhB4vLHgXwDARfp0oyQHzqKmP1Y5I9S-WYMpSLhw2ClX8-o7OAYe85LARwSO0YorBzyflNpv5QVquTnMAI75Jms-luhgGuFdupdh2DaBlb24ehMU9ckknyOEFc9UwdORqg4AZn1v085IvdJwTz5iNQCNQRNY_JadJW5NpEF3WK4xhzUzldg7g6GcMP5PHe7g84iwBWn0Lum7nGqAV5i0uxarDHbwoB-poXN4LgGZ-lLtz09HIfDYgLxAyvJ1xqTpE-EdUaNzYJILBzGbvB53XKieW3099_DYwa7g-b4tlhcOPfmQcakG0eQSmR5e2I9axGeI7i7Wv6xbqY3VDQQD6fbjhaO9Xzx1Yz_9NDhQTwBF1mG928c9PyXaQJ6sxBUX_vxSwXhkg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 519E 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220308&jk=1750612626987723&bg=!HxylHFjNAAb7UztL-1M7ACkAdvg8WvzMj050RKAqaiK8CMKdMmRtmz3MuTkawPN1gfXHVJx-i2T37AIAAAFKUgAAAAVoAQeZAumiku2w662tBnk1aNOJi4bivI8frUyLh6CdVb0anw9wZzsqHljpd3joMWPPEFPJyLcGpK0BEmhr3QPDEoCG9NKVNav4OeKNOXm5iqHQMyLuPj1Gr4s6FsKvojQlHVLYoVriw6AXKUfDk4VnqsPiDETiQdc8aiiTkyKT71DVhyR-8Ly0TQlIRPy2MYrblBxkLyHNLlRIDe-8jfWhau4H_mOMCm0XZt5MDjLGwOHfjjgcglg27ufPoWeT-PAqZ6aPwt3xnYZanY4xfQvEMXevChXqwIRiriZgw5leZIu4P1CdMX8KeYwVH8SwkUgvXFMgmmtPFZM69HjHEUlo8LN3pqmjIncMwYUvaf75e8T1EY1YzkdGkPINLS-LjY5RM4AKqOti5mlKzsOMwEfJjvUbMew5pFr5wVVk2wBO7CaUm7rzOSVsXuSNMjtTwi-gyvQg0yfFElNs7wNi_0yjIyX7okiCsY5ICeRv6OdIblFYrv4NCvD2zD961SlIwgbIQsZyFz5FVKo00edUaX1-YzMUkae0pAwDPAA38lVuXZjfO5o5GEx68aJpaAX9ev4IcRmT48zHvPocSB-I4zyV8bCMrtMqd5lhNtX44ik30kCjt9Fx-_CVO2qznp67sIVF3Avcyyxw3pHzrVWpx-UiBikiVS8ZkQuDSJ3tExoaZ4g7ZT-NrO53GWdasvV_x7TuiISgVdRLk27q9XhpcthX3zJdoJn1WfgWIlwflwZlXxXXDKtRjkquxJuKcWpDAUIAbUuY4iRd0lfFkUeRoq_t-gyRL4nKgsLI9KVVJWF_GXSXcTHrkZV2qSX_Qh9drzuLp_YPSVcpGue4SzxOz7JGUs22xpok_tZcNORpXTwBpOlQmvAeSlmSh10vV4VFy8hKLqpPAl9J437aXjzkRPfPN48tnhU7f_ljNVeaJHzbPi8itaK5ov8epald1Antc4sCRcvlqWcZ0-jGC63j1tpVbHl3bEoAzAg2Lvht44Jr
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 58A1 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220308&jk=3868763332743951&bg=!3N-l35vNAAb7UztL-1M7ACkAdvg8WlSk7QC2TXhPSZMMQJq7yATm4ZjVYLJHxKZymbbXzQW2FwvjsAIAAAC2UgAAAAJoAQeZAwztaKJlw_hiuCxU--7NnwIF9IuBlkbtyJ__ndg3Nui6A0y2VTKoL4mgpSMmlkIxKacmQQzfMKGpPBSyV08MiauVjZI6KsA74pAMGGk7vR8v1OF8hao_SPIJwNJowtFx8eiyRgdod_Fu_l83-2ebpFB_a3Qow1r9t6m1C4Aa7bl6gAPFK65H3Zq6H53E4FUv3-xg-QYtxMxW8Cds5MB2rnxJmaRKaOTW1shRl-T1-rpiysW-vT1NRzK_B_PlQQYXXaKncG0thJUBnl79DriQNUtCV8Lidy-ObgF-_S46QaBtNa4zoY7gU9LkRXIRGgNwrGfsIH6eJmO4ORpAwd0-BqDXiqVmemyxLdPBXQGO-OkicWXd_FR4UDgY5xgKgmQoxHuQyYhxB6OEFPKThxS1TKu7Ni0q_vl7u98VqJ0X3CQBlO7tOzlW6ZPi1Ynp9iJ4oyN3usfrqaoXc7ccFq5nvjekBrrBdK7ZqL5JjCufUwOkKx_rBYsFWzejGsjk9yZbS29mzNhD8Ir8fAiXs84Ws8zKuEMUL1qmPP7GM1U1jfYJXwCoZOs7HciObjOKLX9HTO2cWwOFEe9niby2vcW9-phJAQ24RWGvGYdliAjAA3ccyLXS3kZJyJe3fhLAdjkb30jLRV-SkhQwAWzhUCXUDOt1g0r1wbMZCnhKfxXXCMg8_SdXqYhq36NLmB4_X0wTDIeKTBEJUjVVa5KuTXMh7tLL6mDZnhwVMg0scX80ESGEMFNCj9P6YWBNImj3riGWalKUk-0UxW7g_QSRryk78S_EPPkqU5v5aiFBOm9uAFfrFMcWZjpKg2lvN3erX5APNmLYn6nc9yiqOQpaYzzGPCcBDoEl-gxr_Z6HcRoxwJHnEECH6gSAqNvtJd5NFQk-nGXWUdoQShRGxIvMBBJoH4nbe0DzItvYvqtR3FXwaKgsHIUSDlNCTvPrZdfKKDamDr-kZlBw1DH8P8DnIfdKR5_pjEVfddfocUC6f2iQc-xRvCZp2B2IPsvGKoyf8kuOVq0pnll8KqN9Gb-cUxE
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
json
gum.criteo.com/sid/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthreatpost.com%2F&domain=threatpost.com&cw=1&lsw=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
access-control-allow-origin
https://threatpost.com
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
2013
date
Thu, 10 Mar 2022 21:16:19 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
vary
Accept-Encoding
sid
mug.criteo.com/ Frame CFD6
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthreatpost.com%2F&domain=threatpost.com&cw=1&lsw=1
  • https://mug.criteo.com/sid?cpp=DoGzV3xpazYrTTljc3ZYSW9NZklVbUxhQkYwZFMxZGE4WVk1Tzg1RU9hVTRWcGl0OFZmTzFoejlXNEx0aGNpTElIRldYVkp5MHFQZllKY2JDNFR4WmFwWE1ndXJ0S1FHNkZraE51d2Z6OThmT2FVR0tRb3VGZ2R2MTE2cC...
342 B
612 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=DoGzV3xpazYrTTljc3ZYSW9NZklVbUxhQkYwZFMxZGE4WVk1Tzg1RU9hVTRWcGl0OFZmTzFoejlXNEx0aGNpTElIRldYVkp5MHFQZllKY2JDNFR4WmFwWE1ndXJ0S1FHNkZraE51d2Z6OThmT2FVR0tRb3VGZ2R2MTE2cCtIVHhzQ1dldDNvV0QzNHJFT0k3bUEzbzg0S3lqUUozNjlSWEtSUSsrNFVWeGlYYS9ZL0tUUjFJc3NFb2Z2WG5jOHN3VUpJUmNkbnAzZDA2MXJLNm5pUURDS2FWby90Wm9UdUdLazUzVGpNNTVTU09JRHFVPXw&cppv=2
Protocol
H2
Server
178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
a07787009482debd508bb530fd88cf1f90eb39a5702c74b409fbc0becd71c584
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
content-encoding
gzip
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
3161
strict-transport-security
max-age=31536000; preload;
expires
0

Redirect headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:18 GMT
location
https://mug.criteo.com/sid?cpp=DoGzV3xpazYrTTljc3ZYSW9NZklVbUxhQkYwZFMxZGE4WVk1Tzg1RU9hVTRWcGl0OFZmTzFoejlXNEx0aGNpTElIRldYVkp5MHFQZllKY2JDNFR4WmFwWE1ndXJ0S1FHNkZraE51d2Z6OThmT2FVR0tRb3VGZ2R2MTE2cCtIVHhzQ1dldDNvV0QzNHJFT0k3bUEzbzg0S3lqUUozNjlSWEtSUSsrNFVWeGlYYS9ZL0tUUjFJc3NFb2Z2WG5jOHN3VUpJUmNkbnAzZDA2MXJLNm5pUURDS2FWby90Wm9UdUdLazUzVGpNNTVTU09JRHFVPXw&cppv=2
strict-transport-security
max-age=31536000; preload;
access-control-allow-methods
GET
content-type
text/html; charset=utf-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1681
content-length
482
expires
0
pd
u.openx.net/w/1.0/ Frame CB8A 		668 B
731 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
42e6eedf5679d8d81a6c90851a203e9db1c5a3597dd8e2854fd8ff5b339c6181

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/17.2.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Thu, 10 Mar 2022 21:16:19 GMT
content-type
text/html
content-length
419
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
async_usersync.html
acdn.adnxs.com/dmp/ Frame BC3E 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-232-130.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.13.10
Access-Control-Allow-Origin
*
Content-Type
text/html
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Fri, 11 Mar 2022 21:16:21 GMT
Date
Thu, 10 Mar 2022 21:16:19 GMT
Connection
keep-alive
Vary
Accept-Encoding
ixmatch.html
js-sec.indexww.com/um/ Frame 9456 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7c3b96f238042f73d0bedf5877fa02eb834e89649bbd122e2f10cc35238173cf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

Server
Apache
Last-Modified
Fri, 18 Feb 2022 16:05:37 GMT
ETag
"e20015-b6b-5d84d0db0c30a"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1388
Date
Thu, 10 Mar 2022 21:16:19 GMT
Connection
keep-alive
pd
u.openx.net/w/1.0/ Frame 3B9F 		668 B
719 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
42e6eedf5679d8d81a6c90851a203e9db1c5a3597dd8e2854fd8ff5b339c6181

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/17.2.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Thu, 10 Mar 2022 21:16:19 GMT
content-type
text/html
content-length
419
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
async_usersync.html
acdn.adnxs.com/dmp/ Frame 790E 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-232-130.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.13.10
Access-Control-Allow-Origin
*
Content-Type
text/html
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Fri, 11 Mar 2022 21:16:21 GMT
Date
Thu, 10 Mar 2022 21:16:19 GMT
Connection
keep-alive
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 7BF4 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

last-modified
Tue, 01 Feb 2022 06:38:00 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5549
content-type
text/html; charset=UTF-8
cache-control
max-age=38481
expires
Fri, 11 Mar 2022 07:57:40 GMT
date
Thu, 10 Mar 2022 21:16:19 GMT
vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame E479 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

last-modified
Tue, 01 Feb 2022 06:38:00 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5549
content-type
text/html; charset=UTF-8
cache-control
max-age=38481
expires
Fri, 11 Mar 2022 07:57:40 GMT
date
Thu, 10 Mar 2022 21:16:19 GMT
vary
Accept-Encoding
ixmatch.html
js-sec.indexww.com/um/ Frame A08D 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7c3b96f238042f73d0bedf5877fa02eb834e89649bbd122e2f10cc35238173cf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

Server
Apache
Last-Modified
Fri, 18 Feb 2022 16:05:37 GMT
ETag
"e20015-b6b-5d84d0db0c30a"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1388
Date
Thu, 10 Mar 2022 21:16:19 GMT
Connection
keep-alive
sync
ups.analytics.yahoo.com/ups/55986/ Frame CFD6
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
  • https://pixel.advertising.com/ups/55986/sync?uid=YipqoAAAAFJ7uAQA&_origin=0&gdpr=0&gdpr_consent=
  • https://pixel.advertising.com/ups/55986/sync?uid=YipqoAAAAFJ7uAQA&_origin=0&gdpr=0&gdpr_consent=&verify=true
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=YipqoAAAAFJ7uAQA&_origin=0&gdpr=0&gdpr_consent=&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8
  • https://ups.analytics.yahoo.com/ups/55986/sync?uid=YipqoAAAAFJ7uAQA&_origin=0&gdpr=0&gdpr_consent=&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8&verify=true
0
122 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55986/sync?uid=YipqoAAAAFJ7uAQA&_origin=0&gdpr=0&gdpr_consent=&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8&verify=true
Protocol
H2
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:19 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/55986/sync?uid=YipqoAAAAFJ7uAQA&_origin=0&gdpr=0&gdpr_consent=&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8&verify=true
date
Thu, 10 Mar 2022 21:16:19 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sync
ups.analytics.yahoo.com/ups/57304/ Frame CFD6
Redirect Chain
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&verify=true
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8&verify=true
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VVA1NDU5NGFiNy1hMGI3LTExZWMtYmVhNC0wMjM4YTBmNWZmZDg%3D
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEJMoIXvvr02cxOnRYcLBeMw&google_cver=1
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEJMoIXvvr02cxOnRYcLBeMw&google_cver=1&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8
0
18 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEJMoIXvvr02cxOnRYcLBeMw&google_cver=1&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8
Protocol
H2
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:19 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEJMoIXvvr02cxOnRYcLBeMw&google_cver=1&apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8
date
Thu, 10 Mar 2022 21:16:19 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sync
ups.analytics.yahoo.com/ups/55953/ Frame CFD6
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=d7b276ae-2a2a-4852-9181-19b97d7e27a1&_origin=1&gdpr=1&gdpr_consent=
0
15 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55953/sync?uid=d7b276ae-2a2a-4852-9181-19b97d7e27a1&_origin=1&gdpr=1&gdpr_consent=
Protocol
H2
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:19 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ups.analytics.yahoo.com/ups/55953/sync?uid=d7b276ae-2a2a-4852-9181-19b97d7e27a1&_origin=1&gdpr=1&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
267
sd
eu-u.openx.net/w/1.0/ Frame CB8A
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=d3a2622a-6aa3-4500-b4fa-1b5df0770cc6
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=d3a2622a-6aa3-4500-b4fa-1b5df0770cc6
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
server
OXGW/17.2.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Thu, 10 Mar 2022 21:16:19 GMT
Server
MT3 4256 109297d master zrh-pixel-x9 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=d3a2622a-6aa3-4500-b4fa-1b5df0770cc6
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Thu, 10 Mar 2022 21:16:18 GMT
sd
us-u.openx.net/w/1.0/ Frame CB8A
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&&val=4KoqHeD5eUz7qCsY5a81SLeufkT7ryFNsKkWRb_8
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&&val=4KoqHeD5eUz7qCsY5a81SLeufkT7ryFNsKkWRb_8
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
server
OXGW/17.2.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&&val=4KoqHeD5eUz7qCsY5a81SLeufkT7ryFNsKkWRb_8
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame CB8A
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8882919795340086458
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8882919795340086458
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
server
OXGW/17.2.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8882919795340086458
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame CB8A 		70 B
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=7e04da9e-6e04-7958-de17-f44a704f963a&gdpr=0
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame CB8A 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTI2YjA5NTQtYTc3My0yN2ZjLWNiZjctYWVmM2JhYWQ1ODVh
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame CB8A
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKeI7MDe-3hsJq8hsd2q418&google_cver=1
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKeI7MDe-3hsJq8hsd2q418&google_cver=1
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
server
OXGW/17.2.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKeI7MDe-3hsJq8hsd2q418&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 3B9F
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=ad8b622a-6aa3-4b00-85b2-11db6d3e7dda
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=ad8b622a-6aa3-4b00-85b2-11db6d3e7dda
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
server
OXGW/17.2.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Thu, 10 Mar 2022 21:16:19 GMT
Server
MT3 4256 109297d master zrh-pixel-x8 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=ad8b622a-6aa3-4b00-85b2-11db6d3e7dda
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Thu, 10 Mar 2022 21:16:18 GMT
sd
us-u.openx.net/w/1.0/ Frame 3B9F
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&&val=4KoqHeD5eUz7qCsY5a81SLeufkT7ryFNsKkWRb_8
43 B
122 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&&val=4KoqHeD5eUz7qCsY5a81SLeufkT7ryFNsKkWRb_8
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
server
OXGW/17.2.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&&val=4KoqHeD5eUz7qCsY5a81SLeufkT7ryFNsKkWRb_8
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 3B9F
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6957336235413161053
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6957336235413161053
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
server
OXGW/17.2.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6957336235413161053
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame 3B9F 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=7e04da9e-6e04-7958-de17-f44a704f963a&gdpr=0
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 3B9F 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTI2YjA5NTQtYTc3My0yN2ZjLWNiZjctYWVmM2JhYWQ1ODVh
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 3B9F
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKeI7MDe-3hsJq8hsd2q418&google_cver=1
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKeI7MDe-3hsJq8hsd2q418&google_cver=1
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
via
1.1 google
server
OXGW/17.2.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKeI7MDe-3hsJq8hsd2q418&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame E031 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssJNmVYidhnJscIVbL940rLTusjVXva2Dy2jO4NENUy8rnnAxs6RPN3VqFGSCycthZB44IYovV6IWIXiIWmWXlq6Q&sig=Cg0ArKJSzFq-6VNCubEkEAE&cid=CAASF-RoQM3Bt3fjyjQfD225CFS1pSpU0Lvi&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220309&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2236077833&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1646946978444&rpt=127&met=ie&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 5A99 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvKm4jCIqwQXpKG1F9G8cbgpXJ1MdcauqNVWN8UwvOEsg0wvqhlNuLTcEmEKZSaK84yZtGToPYpxv3d3BqwpqvZIQ&sig=Cg0ArKJSzEOWo0nsTRxPEAE&cid=CAASF-RoC8gM4xmfPRuvWouPWXtqjhdq73Bh&id=lidar2&mcvt=1002&p=0,0,250,300&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20220309&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2662501839&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1646946978473&rpt=133&met=ie&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:19 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async_usersync
ib.adnxs.com/ Frame BC3E 		0
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:19 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
197f8f6e-a637-410b-8d93-5240f482b445
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 790E 		0
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:19 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
86dbd458-5619-42bc-9b5e-a0804a27ce66
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sid
mug.criteo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=DoGzV3xpazYrTTljc3ZYSW9NZklVbUxhQkYwZFMxZGE4WVk1Tzg1RU9hVTRWcGl0OFZmTzFoejlXNEx0aGNpTElIRldYVkp5MHFQZllKY2JDNFR4WmFwWE1ndXJ0S1FHNkZraE51d2Z6OThmT2FVR0tRb3VGZ2R2MTE2cCtIVHhzQ1dldDNvV0QzNHJFT0k3bUEzbzg0S3lqUUozNjlSWEtSUSsrNFVWeGlYYS9ZL0tUUjFJc3NFb2Z2WG5jOHN3VUpJUmNkbnAzZDA2MXJLNm5pUURDS2FWby90Wm9UdUdLazUzVGpNNTVTU09JRHFVPXw&cppv=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
null
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
access-control-allow-origin
null
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1146
date
Thu, 10 Mar 2022 21:16:19 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
vary
Accept-Encoding
async_usersync
ib.adnxs.com/ Frame BC3E 		0
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:20 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
2b2bc192-fdb2-4ffd-ab38-60102e53c537
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 790E 		0
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:20 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
4788097d-4477-4190-9628-aac11da5ca49
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
abt
capi-tier-2-us-east-2.connatix.com/tr/ Frame AE9B 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-2-us-east-2.connatix.com/tr/abt?v=154208
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.216.183.199 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-216-183-199.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Thu, 10 Mar 2022 21:16:20 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
ixmatch.html
js-sec.indexww.com/um/ Frame 0AD8 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7c3b96f238042f73d0bedf5877fa02eb834e89649bbd122e2f10cc35238173cf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

Server
Apache
Last-Modified
Fri, 18 Feb 2022 16:05:37 GMT
ETag
"e20015-b6b-5d84d0db0c30a"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1388
Date
Thu, 10 Mar 2022 21:16:21 GMT
Connection
keep-alive
sync
eb2.3lift.com/ Frame A236
Redirect Chain
  • https://eb2.3lift.com/sync?
  • https://eb2.3lift.com/sync?&ld=1
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://eb2.3lift.com/sync?&ld=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
9dbcbf5c2a84b934886f7d82e39ecffcd2fe11e94b7d2a5f6e7bb761dd847f54

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-type
text/html; charset=utf-8
content-length
461
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate

Redirect headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-length
0
location
/sync?&ld=1
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 715D 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

last-modified
Tue, 01 Feb 2022 06:38:00 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5549
content-type
text/html; charset=UTF-8
cache-control
max-age=38479
expires
Fri, 11 Mar 2022 07:57:40 GMT
date
Thu, 10 Mar 2022 21:16:21 GMT
vary
Accept-Encoding
pd
eu-u.openx.net/w/1.0/ Frame 14C6 		542 B
356 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
2612a15822521046e5dcba03b0fb5bcfa263d69262298c81f5695a0e92d45df2

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/17.2.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Thu, 10 Mar 2022 21:16:21 GMT
content-type
text/html
content-length
337
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
async_usersync.html
acdn.adnxs.com/dmp/ Frame B157 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-232-130.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.13.10
Access-Control-Allow-Origin
*
Content-Type
text/html
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Fri, 11 Mar 2022 21:16:23 GMT
Date
Thu, 10 Mar 2022 21:16:21 GMT
Connection
keep-alive
Vary
Accept-Encoding
2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 3F3D
Redirect Chain
  • https://sync.serverbid.com/ss/2000891.html
  • https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.42 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
f3d66b78ca0c93adf48dec8533da3c4db538cc648dc60e383d5fd0b666859206
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

Date
Thu, 10 Mar 2022 21:16:22 GMT
Connection
Keep-Alive
Cache-Control
max-age=38887
Content-Length
4947
Content-Type
text/html
Last-Modified
Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges
bytes
etag
"1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id
tx00000000000000584adb6-006229b10d-14d1c90f-nyc3a
strict-transport-security
max-age=15552000; includeSubDomains; preload
age
554
x-rgw-object-type
Normal
Vary
Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW
1646946982.dop051.fr8.t,1646946982.cds130.fr8.shn,1646946982.dop051.fr8.t,1646946982.cds227.fr8.c

Redirect headers

content-length
0
location
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control
no-cache
beacon
ap.lijit.com/ Frame 3A03 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/beacon?informer=13394437
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

Date
Thu, 10 Mar 2022 21:16:21 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma
no-cache
P3P
CP="CUR ADM OUR NOR STA NID"
X-Sovrn-Pod
ad_ap1ams1
sync.html
public.servenobid.com/ Frame 0E08 		8 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://public.servenobid.com/sync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bbfd30e5fd2bd475d319b5b55ab61469966d1517b703f9bd830a6f3207387c27

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

cache-control
max-age=86400
content-type
text/html
content-encoding
br
last-modified
Wed, 15 Dec 2021 19:31:35 GMT
accept-ranges
bytes
etag
"32347ab14bd5257f1f3d2e210ba82276"
server
AmazonS3
x-cache
TCP_HIT
x-amz-id-2
Es4p1l2ZJLv48l18zQ6pTqw7k5V9rGH/6oxpOP50q9J94x1fopZ3dz6kdYyfRi+rlNAYfvnVHnw=
x-amz-request-id
Q46PJAZS4MNAGX0R
x-amz-meta-codebuild-content-sha256
8644b4f52d5a37b8f0b84f0bbcfa66f9e0f7f97407e4d25c13a055f86b22baed
x-amz-meta-codebuild-buildarn
arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:0897103a-6355-4b89-92f6-53a82b1da700
x-amz-meta-codebuild-content-md5
276cf0a41034befc9a603617ae1a1731
x-azure-ref-originshield
04lopYgAAAACs0r/wMRzVSbrlrsMkt3IaQU1TMDRFREdFMTkxOAA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref
0pmoqYgAAAAD1oMrY40AkTrNOA1cWwiM6RlJBRURHRTEwMTAAODRlN2RmYTItMTQ0Mi00MzM0LWIzNGYtZTQyZDNmN2RkYWQ5
date
Thu, 10 Mar 2022 21:16:21 GMT
usync.html
eus.rubiconproject.com/ Frame ACC3 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
ETag
"40014-119-5d32342a551c0"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Thu, 10 Mar 2022 21:16:22 GMT
Connection
keep-alive
Vary
Accept-Encoding
dds
rtb.openx.net/sync/ Frame 14C6 		43 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:21 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
ppbvke82a1ncq0fnfrf3v9rf9004i1tv
eac3bcda-fea8-eb11-efc0-e2bf8f185b73
pr-bh.ybp.yahoo.com/sync/openx/ Frame 14C6 		43 B
986 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/openx/eac3bcda-fea8-eb11-efc0-e2bf8f185b73?gdpr=0
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:d29:3602:c713:d832:3f91:5c2a Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
sd
eu-u.openx.net/w/1.0/ Frame 14C6
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
  • https://eu-u.openx.net/w/1.0/sd?id=537072979&val=g2xR0Ow31Nsq905
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537072979&val=g2xR0Ow31Nsq905
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
via
1.1 google
server
OXGW/17.2.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:21 GMT
Server
PingMatch/v2.0.30-713-gdae83a2#rel-ec2-master i-04fd973f611872bb0@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
Location
https://eu-u.openx.net/w/1.0/sd?id=537072979&val=g2xR0Ow31Nsq905
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 14C6
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=openx
  • https://x.bidswitch.net/ul_cb/sync?ssp=openx
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=openx&bsw_custom_parameter=c8366fd5-e3eb-4447-9ebf-eb5d8b206510
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=openx&bsw_custom_parameter=c8366fd5-e3eb-4447-9ebf-eb5d8b206510
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=133a9be6-7793-412b-9edb-d9693a3b2969&ssp=openx&expires=30&user_group=5&bsw_param=c8366fd5-e3eb-4447-9ebf-eb5d8b206510
  • https://us-u.openx.net/w/1.0/sd?id=537072968&val=c8366fd5-e3eb-4447-9ebf-eb5d8b206510&gdpr=&gdpr_consent=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072968&val=c8366fd5-e3eb-4447-9ebf-eb5d8b206510&gdpr=&gdpr_consent=
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
via
1.1 google
server
OXGW/17.2.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
//us-u.openx.net/w/1.0/sd?id=537072968&val=c8366fd5-e3eb-4447-9ebf-eb5d8b206510&gdpr=&gdpr_consent=
Date
Thu, 10 Mar 2022 21:16:22 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
sd
eu-u.openx.net/w/1.0/ Frame 14C6
Redirect Chain
  • https://ib.adnxs.com/getuid?https://eu-u.openx.net/w/1.0/sd?id=537072399&val=$UID
  • https://eu-u.openx.net/w/1.0/sd?id=537072399&val=2769691298401138908
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537072399&val=2769691298401138908
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
via
1.1 google
server
OXGW/17.2.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
75dac1f7-96e7-49c6-968b-0e3b937c9eba
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://eu-u.openx.net/w/1.0/sd?id=537072399&val=2769691298401138908
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ox
match.prod.bidr.io/cookie-sync/ Frame 14C6 		43 B
430 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.prod.bidr.io/cookie-sync/ox
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.31.32.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-31-32-190.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control
no-cache, must-revalidate
Connection
keep-alive
content-type
image/gif
Content-Length
43
expires
Fri, 01 Jan 1990 00:00:00 GMT
async_usersync
ib.adnxs.com/ Frame B157 		0
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
3c68a558-6603-4655-8c4f-04ad9eeeb51a
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame ACC3 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
a92d6c8c0724333c59f6325fe39375b76e55fa55a4a4b5ee8d59d715082a4402

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:22 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 16:28:01 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=36504
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9538
Expires
Fri, 11 Mar 2022 07:24:46 GMT
generic
match.adsrvr.org/track/cmf/ Frame A236 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame A236
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&gdpr=1&cmp_cs=
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDA2ODk3NzAyNDg2NjMxNjY4MzUx
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDA2ODk3NzAyNDg2NjMxNjY4MzUx
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDA2ODk3NzAyNDg2NjMxNjY4MzUx
date
Thu, 10 Mar 2022 21:16:22 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
pixel
cm.g.doubleclick.net/ Frame A236 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame A236
Redirect Chain
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDA2ODk3NzAyNDg2NjMxNjY4MzUx
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDA2ODk3NzAyNDg2NjMxNjY4MzUx
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDA2ODk3NzAyNDg2NjMxNjY4MzUx
date
Thu, 10 Mar 2022 21:16:22 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
setuid
px.ads.linkedin.com/ Frame A236 		0
139 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=406897702486631668351&dbredirect=true&gdpr=1&consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:21 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 1D6012AF1AE249E9AE26C0A10053A2D2 Ref B: FRAEDGE1313 Ref C: 2022-03-10T21:16:22Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAXZ47nWGVZwyt9hlGPHrw==
xuid
eb2.3lift.com/ Frame A236
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/406897702486631668351?gdpr=1&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-Wvrd.ZxE2oRaY7tp.HkU77s4QEgzjST4ahP8TKHZCA--~A&dongle=0883
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2662&xuid=y-Wvrd.ZxE2oRaY7tp.HkU77s4QEgzjST4ahP8TKHZCA--~A&dongle=0883
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date
Thu, 10 Mar 2022 21:16:22 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://eb2.3lift.com/xuid?mid=2662&xuid=y-Wvrd.ZxE2oRaY7tp.HkU77s4QEgzjST4ahP8TKHZCA--~A&dongle=0883
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
sync
x.bidswitch.net/ Frame A236 		43 B
220 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/sync?ssp=triplelift&user_id=406897702486631668351&gdpr=1&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.121.19.101 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-121-19-101.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:22 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
c.gif
c.bing.com/ Frame A236 		42 B
593 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.bing.com/c.gif?xid=406897702486631668351&Red3=TLMS_pd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:21 GMT
etag
"7c5ed6a6f22cd81:0"
last-modified
Mon, 28 Feb 2022 22:29:30 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B6B85B584EEE4254B5F7D2FB34F80D8B Ref B: FRAEDGE1521 Ref C: 2022-03-10T21:16:22Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42
iu3
s.amazon-adsystem.com/ Frame A236
Redirect Chain
  • https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=406897702486631668351
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=406897702486631668351&dcc=t
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=406897702486631668351&dcc=t
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
HTTP/1.1
Server
209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Redirect headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
4S91JXQFCRZC386P8PFH
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=406897702486631668351&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
xuid
eb2.3lift.com/ Frame A236
Redirect Chain
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
37 B
139 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif

Redirect headers

Location
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Content-Length
95
Content-Type
text/html; charset=utf-8
13926
g2.gumgum.com/usync/ Frame 041B 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
f7d57458a0dd608d1a1e9f75545b24b07a868be96a76e052f7e7bdfa250101fe

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-type
text/html;charset=UTF-8
server
nginx
etag
W/"029225e68634aafa68a858ac8cb5b985a"
timing-allow-origin
*
content-encoding
gzip
ps
pixel.33across.com/ Frame 6C9E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.22 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip22.67-202-105.static.steadfastdns.net
Software
33XP001 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

x-33x-status
2000208
server
33XP001
date
Thu, 10 Mar 2022 21:16:21 GMT
/
onetag-sys.com/usync/ Frame 4E2A 		2 KB
814 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.75.86.98 , France, ASN16276 (OVH, FR),
Reverse DNS
ip98.ip-51-75-86.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

content-type
text/html
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
strict-transport-security
max-age=15552000
sync
ssbsync.smartadserver.com/api/ Frame 5067 		842 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.137.107 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
bd86fa96fcfbf25d665fddf9b38614b22b043bf14b6b4e3a193ff4aec5c69ab5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

content-length
842
content-type
text/html
date
Thu, 10 Mar 2022 21:16:21 GMT
usermatch
ssum-sec.casalemedia.com/ Frame 1024 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
408e9c6680dab12e1a2f84f86e4e81ef6a0869231dfcb9a987814862fbb0ea0b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
45|241|39|230|156|218|191|88
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Expires
Thu, 10 Mar 2022 21:16:22 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Content-Length
1757
Connection
keep-alive
sync
ads.servenobid.com/ Frame 0E08
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
  • https://ads.servenobid.com/sync?pid=312&uid=2769691298401138908
0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=312&uid=2769691298401138908
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
52.215.175.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-175-9.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
dd23ab38-cffb-45d7-acf0-f2800ea61bb8
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ads.servenobid.com/sync?pid=312&uid=2769691298401138908
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
ads.servenobid.com/ Frame 0E08
Redirect Chain
  • https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
  • https://ads.servenobid.com/sync?pid=310&uid=401a0ec0a2ae1e2b91219257
0
346 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=310&uid=401a0ec0a2ae1e2b91219257
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
52.215.175.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-175-9.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Location
https://ads.servenobid.com/sync?pid=310&uid=401a0ec0a2ae1e2b91219257
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap3ams1
Content-Length
0
Expires
Fri, 20 Mar 2009 00:00:00 GMT
sync
ads.servenobid.com/ Frame 0E08
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1646946982236
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2968747261
  • https://sync.1rx.io/usersync/tradedesk/d7b276ae-2a2a-4852-9181-19b97d7e27a1
  • https://sync.targeting.unrulymedia.com/csync/RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
  • https://ads.servenobid.com/sync?pid=321&uid=RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
0
362 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=321&uid=RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
52.215.175.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-175-9.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

location
https://ads.servenobid.com/sync?pid=321&uid=RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
date
Thu, 10 Mar 2022 21:16:22 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RX6a648ec44459419785be6bbf37b216e5003
content-type
text/html
101954
jadserve.postrelease.com/suid/ Frame 0E08 		43 B
427 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/suid/101954?ntv_r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D322%26uid%3DNTV_USER_ID
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.211.211.136 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-211-211-136.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
nginx/1.12.1
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
sync
ads.servenobid.com/ Frame 0E08
Redirect Chain
  • https://p.rfihub.com/cm?pub=44007&in=1
  • https://ads.servenobid.com/sync?pid=324&uid=5131077720858604117
0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=324&uid=5131077720858604117
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
52.215.175.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-175-9.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Location
https://ads.servenobid.com/sync?pid=324&uid=5131077720858604117
Date
Thu, 10 Mar 2022 21:16:22 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
usa
sync.go.sonobi.com/ Frame 0E08 		0
478 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
sync
ads.servenobid.com/ Frame 0E08
Redirect Chain
  • https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
  • https://ads.servenobid.com/sync?pid=327&uid=a2122771-06e0-4b3f-93ef-8ceef4f9c4f8&gdpr=0&gdpr_consent=&us_privacy=1YN-
0
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=327&uid=a2122771-06e0-4b3f-93ef-8ceef4f9c4f8&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
52.215.175.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-175-9.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

location
https://ads.servenobid.com/sync?pid=327&uid=a2122771-06e0-4b3f-93ef-8ceef4f9c4f8&gdpr=0&gdpr_consent=&us_privacy=1YN-
date
Thu, 10 Mar 2022 21:16:21 GMT
cache-control
max-age=0, private, must-revalidate
x-envoy-upstream-service-time
1
server
envoy
content-length
0
sync
ads.servenobid.com/ Frame 0E08
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58559/occ
  • https://ads.servenobid.com/sync?pid=337&uid=y-UsuQWIhE2uHorDGvzV0riQunUMj.Sf.bYwVATMQ-~A
0
367 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=337&uid=y-UsuQWIhE2uHorDGvzV0riQunUMj.Sf.bYwVATMQ-~A
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
52.215.175.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-175-9.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

location
https://ads.servenobid.com/sync?pid=337&uid=y-UsuQWIhE2uHorDGvzV0riQunUMj.Sf.bYwVATMQ-~A
date
Thu, 10 Mar 2022 21:16:22 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
crum
dsum-sec.casalemedia.com/ Frame 1024
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENjVMe1j5GBcPzpljZfj_Fk&google_cver=1&gdpr=1
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENjVMe1j5GBcPzpljZfj_Fk&google_cver=1&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 10 Mar 2022 21:16:22 GMT

Redirect headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENjVMe1j5GBcPzpljZfj_Fk&google_cver=1&gdpr=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
325
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame 1024
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&dcc=t
43 B
645 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&dcc=t
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Server
209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
V4V5TR810KKT9BTKF3A4
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
ABMPWD6MHCW0SZGKX07K
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
casale
match.adsrvr.org/track/cmf/ Frame 1024 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 1024 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&gdpr_consent=&us_privacy=&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cookiesync
bttrack.com/pixel/ Frame 1024 		35 B
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bttrack.com/pixel/cookiesync?source=67e94f23-25d6-4008-8236-375d1743c2e0&secure=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
192.132.33.46 -, , ASN (),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

X-ServerName
Track004-iad
Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:18 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Cache-Control
private,no-cache
Content-Type
image/gif
Content-Length
35
Expires
-1
ibs:dpid=23728&dpuuid=Yipqotmaf5R3Tjh7Fnb4KgAA%261190
dpm.demdex.net/ Frame 1024 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=23728&dpuuid=Yipqotmaf5R3Tjh7Fnb4KgAA%261190?gdpr_consent=&us_privacy=&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.111.225 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-111-225.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers
crum
dsum.casalemedia.com/ Frame 1024
Redirect Chain
  • https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3CIndex_user_id%3E&gdpr=1
  • https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=b4f5b009-8b11-e467-9d9f7740
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=b4f5b009-8b11-e467-9d9f7740
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Server
2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 10 Mar 2022 21:16:22 GMT

Redirect headers

date
Thu, 10 Mar 2022 21:16:22 GMT
via
1.1 google
server
nginx/1.20.2
access-control-allow-origin
*
p3p
CP='This is not a P3P policy!'
location
https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=b4f5b009-8b11-e467-9d9f7740
cache-control
max-age=3600
content-type
text/html; charset=utf-8
alt-svc
clear
content-length
119
ZMAwryCI
sync-tm.everesttech.net/upi/pid/ Frame 1024 		85 B
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
via
1.1 varnish
server
Jetty(9.4.35.v20201120)
x-timer
S1646946982.244065,VS0,VE93
x-served-by
cache-hhn4057-HHN
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin
*
cache-control
no-cache
accept-ranges
bytes
content-type
image/png
content-length
85
x-cache-hits
0
sync
ads.servenobid.com/ Frame 1024 		0
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=333&uid=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.175.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-175-9.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
pixel
cm.g.doubleclick.net/ Frame ACC3
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjlhZDA1NzcwYzAxOGUzY2E4ZmY0YWIyMzJkYjE0ODc2NjgyZmI2MQ
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjlhZDA1NzcwYzAxOGUzY2E4ZmY0YWIyMzJkYjE0ODc2NjgyZmI2MQ
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjlhZDA1NzcwYzAxOGUzY2E4ZmY0YWIyMzJkYjE0ODc2NjgyZmI2MQ
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
pixel
cm.g.doubleclick.net/ Frame ACC3
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==
Protocol
H3
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBMSFBGVUctMTMtRzZOUQ==
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
66ef90d06496cfd000aab8206f2b6221
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
rubicon
match.adsrvr.org/track/cmf/ Frame ACC3 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/rubicon
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
ecm3
s.amazon-adsystem.com/ Frame ACC3
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=WZOKSeC8Qg-E0B3TIzqIww&rk=usync-na
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=WZOKSeC8Qg-E0B3TIzqIww
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=WZOKSeC8Qg-E0B3TIzqIww
Protocol
HTTP/1.1
Server
209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
7VZBJCNPKSES6FQAQ92N
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=WZOKSeC8Qg-E0B3TIzqIww
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
66ef90d06496cfd000aab8206f2b6221
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
709414.gif
id.rlcdn.com/ Frame ACC3 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/709414.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers
tap.php
pixel.rubiconproject.com/ Frame ACC3
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/Jq3z7CSsEUvlD7JKjevcpMn5EUdSAgOZEtemQ7w0kco?csrc=
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2534768160550192133
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2534768160550192133
Protocol
HTTP/1.1
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
66ef90d06496cfd000aab8206f2b6221
Content-Type
image/gif

Redirect headers

date
Thu, 10 Mar 2022 21:16:22 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2534768160550192133
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
setuid
px.ads.linkedin.com/ Frame ACC3
Redirect Chain
  • https://token.rubiconproject.com/token?pid=36584
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L0LHPFUG-13-G6NQ
0
140 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L0LHPFUG-13-G6NQ
Protocol
H2
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 9E415B0332F14775832E217C9E540158 Ref B: FRAEDGE1313 Ref C: 2022-03-10T21:16:22Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAXZ47nbLQPESqOW508/PQ==

Redirect headers

Location
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L0LHPFUG-13-G6NQ
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
66ef90d06496cfd000aab8206f2b6221
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
ecm3
aax-eu.amazon-adsystem.com/s/ Frame ACC3
Redirect Chain
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=5eHGSDVwS8WS___d1zMiJw&rk=usync-other
  • https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=5eHGSDVwS8WS___d1zMiJw
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=5eHGSDVwS8WS___d1zMiJw
Protocol
HTTP/1.1
Server
52.95.126.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
BSR9B5NYPGQS767W0B4X
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=5eHGSDVwS8WS___d1zMiJw
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
66ef90d06496cfd000aab8206f2b6221
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
sync
ads.servenobid.com/ Frame 5067 		0
343 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=317&uid=655740961209670750&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.175.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-175-9.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
dcm
s.amazon-adsystem.com/ Frame 5067
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fdcm%3Fpid%3D72348060-38ad-4586-8e4f-f1e2a8e789b3%26id%3DSMART_USE...
  • https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=655740961209670750&gdpr=0&gdpr_consent=
  • https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=655740961209670750&gdpr=0&gdpr_consent=&dcc=t
43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=655740961209670750&gdpr=0&gdpr_consent=&dcc=t
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
6W0QACACFYA7DRYTCZ1P
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
V3H5Y091V80T4FZW2E12
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=655740961209670750&gdpr=0&gdpr_consent=&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
sync.targeting.unrulymedia.com/csync/ Frame 5067
Redirect Chain
  • https://sync.1rx.io/usersync2/smartadserver?gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4508649151
  • https://sync.1rx.io/usersync/tradedesk/d7b276ae-2a2a-4852-9181-19b97d7e27a1
  • https://sync.targeting.unrulymedia.com/csync/RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
43 B
395 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
H2
Server
213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
server
Tengine
content-length
43
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location
https://sync.targeting.unrulymedia.com/csync/RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
cache-control
no-store, no-cache, must-revalidate
server
Tengine
content-type
text/html
expires
0
/
rtb-csync.smartadserver.com/redir/ Frame 5067
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=YipqoAAAAFJ7uAQA&gdpr=0&gdpr_consent=
43 B
405 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=YipqoAAAAFJ7uAQA&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.139.115 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
cache-control
no-cache,no-store
content-type
image/gif
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
via
1.1 varnish
server
Varnish
x-timer
S1646946982.391264,VS0,VE0
x-served-by
cache-hhn4057-HHN
x-cache
HIT
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=YipqoAAAAFJ7uAQA&gdpr=0&gdpr_consent=
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
/
rtb-csync.smartadserver.com/redir/ Frame 5067
Redirect Chain
  • https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=ee919e6c-367f-4ce2-b4db-c6b63f767887&gdpr_consent=null&gdpr=0
43 B
426 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=ee919e6c-367f-4ce2-b4db-c6b63f767887&gdpr_consent=null&gdpr=0
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.139.115 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
cache-control
no-cache,no-store
content-type
image/gif
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=ee919e6c-367f-4ce2-b4db-c6b63f767887&gdpr_consent=null&gdpr=0
date
Thu, 10 Mar 2022 21:16:22 GMT
server
_
content-length
0
usersync
rtb.gumgum.com/ Frame 041B
Redirect Chain
  • https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
  • https://rtb.gumgum.com/usersync?b=apn&i=2769691298401138908
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=apn&i=2769691298401138908
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
1e27ae91-7943-4c5d-aa56-7be087484bc3
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://rtb.gumgum.com/usersync?b=apn&i=2769691298401138908
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usersync
rtb.gumgum.com/ Frame 041B
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_0ef695f5-98d3-44ca-b07b-51f1b21a0b2b&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://event.clientgear.com/cookie/bidswitch?partner=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=c8366fd5-e3eb-4447-9ebf-eb5d8b206510
  • https://x.bidswitch.net/sync?dsp_id=257&user_id=mka2690cea-fdae-4c76-a6fd-9c4001392695&expires=7&user_group=5&ssp=gumgum2&bsw_param=c8366fd5-e3eb-4447-9ebf-eb5d8b206510
  • https://rtb.gumgum.com/usersync?b=bsw&i=c8366fd5-e3eb-4447-9ebf-eb5d8b206510
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=bsw&i=c8366fd5-e3eb-4447-9ebf-eb5d8b206510
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
//rtb.gumgum.com/usersync?b=bsw&i=c8366fd5-e3eb-4447-9ebf-eb5d8b206510
Date
Thu, 10 Mar 2022 21:16:22 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
c.gif
c.bing.com/ Frame 041B
Redirect Chain
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
  • https://rtb.gumgum.com/usersync?b=obn&i=ENC%28eaVBx3jiCUfRnjTu9cmc-MQ1xVOvfrBsHnd9cDMBS8teia9Ep1u_gGzzR-xnahef%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_0ef695f5-98d3-44ca-b07b-51f1b21a0b2b&obuid=ENC(eaVBx3jiCUfRnjTu9cmc-MQ1xVOvfrBsHnd9cDMBS8teia9Ep1u_gGzzR-xnahef)
  • https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
  • https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D
42 B
173 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:23 GMT
etag
"7c5ed6a6f22cd81:0"
last-modified
Mon, 28 Feb 2022 22:29:30 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 3A7B0DCF5E114783A5D0388F03989476 Ref B: FRAEDGE1521 Ref C: 2022-03-10T21:16:23Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42

Redirect headers

Location
https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D
Date
Thu, 10 Mar 2022 21:16:23 GMT
X-TraceId
6163f06f731ba54e1a0c8410b5bdaa09
Content-Length
0
usersync
rtb.gumgum.com/ Frame 041B
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
  • https://rtb.gumgum.com/usersync?b=opx&i=89397eee-4611-410e-b96c-e4a7b81f977c
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=opx&i=89397eee-4611-410e-b96c-e4a7b81f977c
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-encoding
gzip
server
OXGW/17.2.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://rtb.gumgum.com/usersync?b=opx&i=89397eee-4611-410e-b96c-e4a7b81f977c
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
usersync
rtb.gumgum.com/ Frame 041B
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=sta&i=0-a8585234-f896-4018-710c-47237522e79a$ip$217.114.215.131
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=sta&i=0-a8585234-f896-4018-710c-47237522e79a$ip$217.114.215.131
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=sta&i=0-a8585234-f896-4018-710c-47237522e79a$ip$217.114.215.131
Date
Thu, 10 Mar 2022 21:16:22 GMT
Connection
keep-alive
Content-Length
124
Content-Type
text/html; charset=utf-8
usersync
rtb.gumgum.com/ Frame 041B
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=oth&i=y-ubMM9HJE2pf0DSvobeikbDTYb4dkdGjagPU6~A
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=oth&i=y-ubMM9HJE2pf0DSvobeikbDTYb4dkdGjagPU6~A
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

date
Thu, 10 Mar 2022 21:16:22 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://rtb.gumgum.com/usersync?b=oth&i=y-ubMM9HJE2pf0DSvobeikbDTYb4dkdGjagPU6~A
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
usersync
rtb.gumgum.com/ Frame 041B
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%...
  • https://rtb.gumgum.com/usersync?b=vnt&i=5638b94f-a0b7-11ec-bcde-477f26462834
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=vnt&i=5638b94f-a0b7-11ec-bcde-477f26462834
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=vnt&i=5638b94f-a0b7-11ec-bcde-477f26462834
Date
Thu, 10 Mar 2022 21:16:22 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
Content-Length
0
X-CI-RTID
5638b950-a0b7-11ec-bcde-477f26462834
services
sync.technoratimedia.com/ Frame 041B 		0
293 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
150.136.26.45 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
via
1.1 varnish
server
nginx
age
0
access-control-allow-methods
POST,GET,HEAD,OPTIONS
x-varnish
421103598
access-control-allow-origin
https://g2.gumgum.com/
access-control-allow-credentials
true
142
match.deepintent.com/usersync/ Frame 041B 		0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/142
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
g.deepintent.com
Software
a /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-length
0
server
a
usersync
rtb.gumgum.com/ Frame 041B
Redirect Chain
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=e_0ef695f5-98d3-44ca-b07b-51f1b21a0b2b&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://stags.bluekai.com/site/23178?id=H2smdvEF4TEG19QlX96j&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2SBSONWWI5SFIY2FIRKHGE4VC3CYHE3GUJTVONPXA...
  • https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=H2smdvEF4TEG19QlX96j&us_privacy=1---
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=H2smdvEF4TEG19QlX96j&us_privacy=1---
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:23 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
P3p
CP="We do not support P3P header."
Location
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=H2smdvEF4TEG19QlX96j&us_privacy=1---
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
118
Expires
Thu, 01 Dec 1994 16:00:00 GMT
usersync
usersync.gumgum.com/ Frame 041B
Redirect Chain
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://usersync.gumgum.com/usersync?b=idi&i=af15bb5e-9b9c-478b-b687-dfb0beda6c1c
35 B
296 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=idi&i=af15bb5e-9b9c-478b-b687-dfb0beda6c1c
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Server
34.240.27.36 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-240-27-36.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
envoy
content-type
image/gif
cache-control
private, no-store, must-revalidate, max-age=0
x-envoy-upstream-service-time
4
x-region
ireland
content-length
35
expires
0

Redirect headers

location
https://usersync.gumgum.com/usersync?b=idi&i=af15bb5e-9b9c-478b-b687-dfb0beda6c1c
date
Thu, 10 Mar 2022 21:16:22 GMT
access-control-allow-origin
*
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
sync.targeting.unrulymedia.com/csync/ Frame 041B
Redirect Chain
  • https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3494928880
  • https://sync.1rx.io/usersync/tradedesk/d7b276ae-2a2a-4852-9181-19b97d7e27a1
  • https://sync.targeting.unrulymedia.com/csync/RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
43 B
395 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
server
Tengine
content-length
43
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location
https://sync.targeting.unrulymedia.com/csync/RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
cache-control
no-store, no-cache, must-revalidate
server
Tengine
content-type
text/html
expires
0
usersync
rtb.gumgum.com/ Frame 041B
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
  • https://rtb.gumgum.com/usersync?b=pln&i=ntTW0dDKSofh&ev=1&pid=558355
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=pln&i=ntTW0dDKSofh&ev=1&pid=558355
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Mar 2022 21:16:22 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
de-DE
location
https://rtb.gumgum.com/usersync?b=pln&i=ntTW0dDKSofh&ev=1&pid=558355
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-5799967b4-hwnzj
expires
-1
sync
ssbsync.smartadserver.com/api/ Frame 041B 		0
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=15
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.137.107 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:21 GMT
content-length
0
sync
ads.servenobid.com/ Frame 041B 		0
357 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=309&uid=e_0ef695f5-98d3-44ca-b07b-51f1b21a0b2b
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.175.9 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-175-9.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
usersync
rtb.gumgum.com/ Frame ED77
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
  • https://rtb.gumgum.com/usersync?b=mmh&i=ad8b622a-6aa3-4b00-85b2-11db6d3e7dda&gdpr=0&gdpr_consent=
35 B
208 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=mmh&i=ad8b622a-6aa3-4b00-85b2-11db6d3e7dda&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Date
Thu, 10 Mar 2022 21:16:22 GMT
Content-Type
image/gif
Content-Length
0
Connection
keep-alive
Keep-Alive
timeout=360
Access-Control-Allow-Origin
*
Server
MT3 4256 109297d master zrh-pixel-x25 config:1.0.0
Cache-Control
no-cache
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://rtb.gumgum.com/usersync?b=mmh&i=ad8b622a-6aa3-4b00-85b2-11db6d3e7dda&gdpr=0&gdpr_consent=
Expires
Thu, 10 Mar 2022 21:16:21 GMT
usersync
usersync.gumgum.com/ Frame 411B
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=atm&i=YipqoAAAAFJ7uAQA&gdpr=0&gdpr_consent=
35 B
296 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=atm&i=YipqoAAAAFJ7uAQA&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.240.27.36 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-240-27-36.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
content-type
image/gif
content-length
35
date
Thu, 10 Mar 2022 21:16:22 GMT
x-envoy-upstream-service-time
6
x-region
ireland
server
envoy

Redirect headers

server
Varnish
retry-after
0
location
https://usersync.gumgum.com/usersync?b=atm&i=YipqoAAAAFJ7uAQA&gdpr=0&gdpr_consent=
accept-ranges
bytes
date
Thu, 10 Mar 2022 21:16:22 GMT
via
1.1 varnish
x-served-by
cache-hhn4057-HHN
x-cache
HIT
x-cache-hits
0
x-timer
S1646946982.391162,VS0,VE0
cache-control
no-cache
pragma
no-cache
content-length
0
pixel
cm.g.doubleclick.net/ Frame 5301 		170 B
188 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV8wZWY2OTVmNS05OGQzLTQ0Y2EtYjA3Yi01MWYxYjIxYTBiMmI=&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

content-type
image/png
date
Thu, 10 Mar 2022 21:16:22 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
server
HTTP server (unknown)
content-length
170
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 8B09 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

last-modified
Tue, 01 Feb 2022 06:38:00 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5549
content-type
text/html; charset=UTF-8
cache-control
max-age=38478
expires
Fri, 11 Mar 2022 07:57:40 GMT
date
Thu, 10 Mar 2022 21:16:22 GMT
vary
Accept-Encoding
/
ssc-cms.33across.com/ps/ Frame 1875 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.22 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip22.67-202-105.static.steadfastdns.net
Software
33XP004 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

x-33x-status
2000208
server
33XP004
date
Thu, 10 Mar 2022 21:16:22 GMT
usersync
rtb.gumgum.com/ Frame 3CA5
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=ttd&i=d7b276ae-2a2a-4852-9181-19b97d7e27a1&t=1649538982
35 B
208 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=ttd&i=d7b276ae-2a2a-4852-9181-19b97d7e27a1&t=1649538982
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-type
text/html
content-length
209
location
https://rtb.gumgum.com/usersync?b=ttd&i=d7b276ae-2a2a-4852-9181-19b97d7e27a1&t=1649538982
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
usync.html
eus.rubiconproject.com/ Frame 9E3B
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
  • https://eus.rubiconproject.com/usync.html?p=gumgum
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
ETag
"40014-119-5d32342a551c0"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Thu, 10 Mar 2022 21:16:22 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

server
AkamaiGHost
content-length
0
location
https://eus.rubiconproject.com/usync.html?p=gumgum
date
Thu, 10 Mar 2022 21:16:22 GMT
access-control-allow-credentials
true
access-control-allow-origin
*
um
cs.emxdgt.com/ Frame 85E2 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

content-type
text/html
date
Thu, 10 Mar 2022 21:16:21 GMT
content-length
0
usersync
rtb.gumgum.com/ Frame 62FD
Redirect Chain
  • https://tg.socdm.com/aux/idsync?proto=gumgum
  • https://rtb.gumgum.com/usersync?b=sus&i=Yipqp8Co8YEAAA5EJGUAAAAA
35 B
208 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=sus&i=Yipqp8Co8YEAAA5EJGUAAAAA
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Thu, 10 Mar 2022 21:16:23 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Server
nginx
Date
Thu, 10 Mar 2022 21:16:23 GMT
Content-Length
0
Connection
keep-alive
Cache-Control
private
Location
https://rtb.gumgum.com/usersync?b=sus&i=Yipqp8Co8YEAAA5EJGUAAAAA
P3P
CP="See also http://www.scaleout.jp/privacy/"
X-SO-Ads-Time
2
X-SO-HostName
m-ad15.dc4p.scaleout.jp
X-SO-LB-Hostname
m-tgng29.dc4p.scaleout.jp
X-SO-LB-Data
{"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":52,"gdpr":true,"ipv4":"0.0.0.0","key":"Yipqp8Co8YEAAA5EJGUAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad15"}
X-SO-Key
Yipqp8Co8YEAAA5EJGUAAAAA
X-SO-IP
217.114.215.131
X-SO-Cluster-ID
52
X-SO-Upstream-ID
m-ad15
usersync
rtb.gumgum.com/ Frame C2B7
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=gumgum
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1
  • https://rtb.gumgum.com/usersync?b=rth&i=KIxk9HKbaftOgxoA2ejD&pi=gumgum&tc=1
35 B
208 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=rth&i=KIxk9HKbaftOgxoA2ejD&pi=gumgum&tc=1
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

date
Thu, 10 Mar 2022 21:16:22 GMT Thu, 10 Mar 2022 21:16:22 GMT
location
https://rtb.gumgum.com/usersync?b=rth&i=KIxk9HKbaftOgxoA2ejD&pi=gumgum&tc=1
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
content-length
0
um
cs.emxdgt.com/ Frame DDF8 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.emxdgt.com/um?ssp=pbs&redirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D44%26userId%3D%24UID
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

content-type
text/html
date
Thu, 10 Mar 2022 21:16:21 GMT
content-length
0
usync.html
eus.rubiconproject.com/ Frame 7ECE
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17632&endpoint=us-east
  • https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
ETag
"40014-119-5d32342a551c0"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Thu, 10 Mar 2022 21:16:22 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

server
AkamaiGHost
content-length
0
location
https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
date
Thu, 10 Mar 2022 21:16:22 GMT
access-control-allow-credentials
true
access-control-allow-origin
*
uc.html
go.sonobi.com/ Frame 26A0 		43 B
577 B 		Document
General
Check archive.org
Download Go to
Full URL
https://go.sonobi.com/uc.html?pubid=e55fb5d7c2
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.148 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1.go.sonobi.com
Software
sonobi-go /
Resource Hash
bcdf010ba3dc61605c33de9b33e7e76dbc3bb4326dcec49f33970345e517fb25
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

Date
Thu, 10 Mar 2022 21:16:22 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Expires
Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control
no-cache, no-store, private
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma
no-cache
Tcn
Choice
Vary
negotiate,Accept-Encoding
X-Go-Server
go-ams-1-7-128
X-Xss-Protection
0
Content-Encoding
gzip
Server
sonobi-go
cm
gift-connect-d.openx.net/w/1.0/ Frame C6EC 		0
83 B 		Document
General
Check archive.org
Download Go to
Full URL
https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/17.2.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/17.2.0
date
Thu, 10 Mar 2022 21:16:22 GMT
content-type
text/html
content-length
20
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A6C5 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156319&userIdMacro=PM_UID&predirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D4%26userId%3DPM_UID
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/

Response headers

last-modified
Tue, 01 Feb 2022 06:38:00 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5549
content-type
text/html; charset=UTF-8
cache-control
max-age=38478
expires
Fri, 11 Mar 2022 07:57:40 GMT
date
Thu, 10 Mar 2022 21:16:22 GMT
vary
Accept-Encoding
i.gif
e.serverbid.com/udb/9969/sync/ Frame 3F3D
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D28%26userId%3D%24UID
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=2769691298401138908
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=2769691298401138908
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
134.209.129.254 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-length
0

Redirect headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
e1d1ec79-eedd-4e34-9069-14d11d08eab4
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=2769691298401138908
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
i.gif
e.serverbid.com/udb/9969/sync/ Frame 3F3D
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=185073&cb=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D1%26userId%3D
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=Yipqotmaf5R3Tjh7Fnb4KgAA%261190
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=Yipqotmaf5R3Tjh7Fnb4KgAA%261190
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
134.209.129.254 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-length
0

Redirect headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=Yipqotmaf5R3Tjh7Fnb4KgAA%261190
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
282
Expires
Thu, 10 Mar 2022 21:16:22 GMT
i.gif
e.serverbid.com/udb/9969/sync/ Frame 3F3D
Redirect Chain
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D24%26userId%3D%24UID
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=401a0ec0a2ae1e2b91219257
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=401a0ec0a2ae1e2b91219257
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
134.209.129.254 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-length
0

Redirect headers

Date
Thu, 10 Mar 2022 21:16:22 GMT
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=401a0ec0a2ae1e2b91219257
Access-Control-Allow-Credentials
true
Connection
close
X-Sovrn-Pod
ad_ap1ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
usa
sync.go.sonobi.com/ Frame 3F3D 		0
478 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/usa?https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=38&userId=
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
i.gif
e.serverbid.com/udb/9969/sync/ Frame 3F3D
Redirect Chain
  • https://pixel.advertising.com/ups/56621/occ
  • https://ups.analytics.yahoo.com/ups/56621/occ?apid=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
134.209.129.254 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-length
0

Redirect headers

location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8
date
Thu, 10 Mar 2022 21:16:22 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
us.gif
sync.go.sonobi.com/ Frame 3F3D
Redirect Chain
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dco%26nuid%3D
  • https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89
49 B
513 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Server
178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:22 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89
cache-control
no-cache
content-length
0
56939
i6.liadm.com/s/ Frame 3F3D
Redirect Chain
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fi.liadm.com%2Fs%2F56939%3Fbidder_id%3D203802%26bidder_uuid%3D
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89&_li_chk=true&previous_uuid=7540f2f72c4d4512903426f1b21dec29
  • https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89
43 B
419 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Server
2600:1f18:444a:4602:2c20:3113:5c28:1366 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:23 GMT
Cache-Control
no-store
Connection
keep-alive
Content-Length
43
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89
Date
Thu, 10 Mar 2022 21:16:22 GMT
Connection
keep-alive
Content-Length
0
Strict-Transport-Security
max-age=31536000; includeSubDomains
usync.js
eus.rubiconproject.com/ Frame 9E3B 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
a92d6c8c0724333c59f6325fe39375b76e55fa55a4a4b5ee8d59d715082a4402

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:22 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 16:28:01 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=36504
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9538
Expires
Fri, 11 Mar 2022 07:24:46 GMT
usync.js
eus.rubiconproject.com/ Frame 7ECE 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
a92d6c8c0724333c59f6325fe39375b76e55fa55a4a4b5ee8d59d715082a4402

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 21:16:22 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 16:28:01 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=36504
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9538
Expires
Fri, 11 Mar 2022 07:24:46 GMT
sync.php
pixel.rubiconproject.com/exchange/ Frame 9E3B 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=L0LHPFUG-13-G6NQ
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
66ef90d06496cfd000aab8206f2b6221
Content-Type
image/gif
sync.php
pixel-us-east.rubiconproject.com/exchange/ Frame 7ECE 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=17632&khaos=L0LHPFUG-13-G6NQ
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.151.100 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
af308bb17a856a105b8c87aaae7d7f8c
Content-Type
image/gif
st
capi-tier-2-us-east-2.connatix.com/tr/ Frame AE9B 		0
334 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-2-us-east-2.connatix.com/tr/st?v=154208
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.216.183.199 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-216-183-199.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Thu, 10 Mar 2022 21:16:22 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
transfer-encoding
chunked
Connection
keep-alive
access-control-allow-credentials
true
async_usersync
ib.adnxs.com/ Frame B157 		0
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 10 Mar 2022 21:16:23 GMT
X-Proxy-Origin
217.114.215.131; 217.114.215.131; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
567da08b-a4c8-4a5a-86be-fa6be82a37c1
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o

Verdicts & Comments Add Verdict or Comment

420 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| 25 function| structuredClone object| oncontextlost object| oncontextrestored object| gform string| gAMP_urlhost string| gAMP_urlpath string| gAMP_urlquery string| gAMP_contentid string| gAMP_category string| gAMP_contenttags number| kPrebidTimeout number| kRefreshPollTime number| gRefreshCount number| gOXRefreshCount boolean| gRefreshDebug boolean| gPrebidDebug boolean| gTrackVisibility boolean| gLazyLoad boolean| gTrackPageVisibility number| k30SecondRefreshInterval number| k60SecondRefreshInterval number| k90SecondRefreshInterval number| k120SecondRefreshInterval number| k180SecondRefreshInterval number| k999SecondRefreshInterval number| kDoNotRefresh number| kDefaultRefreshInterval object| gSChainNodes undefined| gGDPR_forceLocale boolean| gGDPR_silentNoConsent boolean| gGDPR_forceNoConsent object| gGDPR_NonTCFVendors string| gGDPR_publisherCountryCode string| gGDPR_logoURL string| gGDPR_privacyPolicyURL string| kAmazonPublisherID object| ad728x90ATF object| ad300x250ATF object| ad300x250ATF2 object| ad728x90ATFTAB object| ad728x90STICKY object| ad300x250ATFTAB object| ad300x250ATF2TAB object| ad320x50ATF object| ad300x250ATFM object| ad300x250ATF2M object| ad2x2skin object| adGoogleAdXInterstitial number| gBrowserWidth object| desktopAdUnits object| tabletAdUnits object| mobileAdUnits object| gAllSlotData number| gAllSlotCount function| _0x2484c2 object| gRefreshSlots object| gRefreshIDs object| gRefreshTimes object| gRefreshIntervals object| gThisRefreshIDs object| gThisRefreshSlots boolean| gInitialLoad object| gIntersectionObserver object| gPBJSTimeoutTimer object| gAmazonSlots object| gAmazonBids boolean| gAmazonBidsBack boolean| gPrebidBidsBack object| googletag object| pbjs function| _0x47b6 boolean| gHasGDPRCMP object| gGDPRTCData function| amp_getBidsForAllChannels function| amp_dumpBids function| amp_dumpWins function| amp_dumpTable function| amp_getBestBids function| sendAdserverRequest function| _0x4815 function| checkIfAllBidsBack function| amazonBidsBack function| pbjsBidsBack function| bidsTimeout function| scheduleConsentUpdates function| sendBidRequests function| doSendBidRequests function| amp_refreshAllSlots function| amp_refreshSlots function| refreshAdSlots function| attachCloseBoxSVG function| configureAdSlot function| getCookie object| apstag function| cnx function| $ function| jQuery object| gdprDynamicStrings object| gdprStrings object| kss object| sNew object| s0 object| dataLayer boolean| jQueryMigrateHelperHasSentDowngrade object| cnx_usr_storage function| __uspapi function| __uspOpenUI object| FontAwesomeConfig object| ___FONT_AWESOME___ function| __tcfapi object| __cmpAPI object| __GVL object| __cmpTCModel function| __cmpOpenUI function| pbjsChunk object| _pbjsGlobals object| ADAGIO string| nobidVersion object| nobid object| G2eM0M2 function| G2eM0M3 object| xop object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client boolean| apstagLOADED object| ggeac object| google_js_reporting_queue object| google_tag_manager function| postscribe object| google_tag_manager_external boolean| creativeVendorLibraryLoaded object| google_tag_data string| GoogleAnalyticsObject function| ga object| _qevents function| twq object| gd1nuh function| gd1nuK function| xblacklist object| MZ1D6o2 function| MZ1D6o3 function| xblocker object| kasperskyDynamicaReCaptchaData object| jQuery1124037480912218672335 object| kaspersky object| prmOm object| omPlatformsSettings function| trackKLReferrer function| trackTrialSubmit function| trackFraud function| getFilename function| trackFile function| trackTrial function| trackTrialKMS function| trackPU function| trackPU2 function| trackDoc function| trackBeta function| trackDBUpdate function| trackDRFile function| trackLink function| trackCountrySelector function| trackLRC function| trackIPP function| trackPage function| trackLRCFallback function| trackMaxymiser function| trackAuditories function| trackCroSegment function| trackCta function| trackDownload function| trackEvent function| trackExit function| trackForm function| trackGoToPayment function| trackChangePaymentMethod function| trackLena function| trackMarketLincGroup function| trackMarketLincVisitor function| trackPageView function| trackPageViewOnLoad function| trackPartnerLocatorSearchEvent function| trackProductView function| trackRegistration function| trackSaleButton function| trackSignin function| trackSignIn function| trackUpsellPage function| omSetContext function| omSetOmnitureParameters function| omChooseCookieDomain function| omGetAbsoluteUrl function| omGetBusinessType function| omGetGoogleAnalyticsClientId function| omGetHostName function| omGetOrigin function| omGetPageNameFromPath function| omGetQueryParam function| omReadCookie function| omRemoveAllUrlParameters function| omRemoveAllUrlParametersForDownloads function| omRemoveUrlParameter function| omRemoveCookie function| omSafeParseJson function| omSetCookie function| omSetInp function| removeHashFromString function| omPushEventToDataLayer function| omCreateEventParamsObj function| omPushTrackingObjectToDataLayer function| omPrepareProductsString function| omHandleClick function| omHandleMessage function| e object| sng object| s function| AppMeasurement function| s_gi function| s_pgicq object| adobe function| Visitor object| s_c_il number| s_c_in object| _uxa number| s_objectID number| s_giq object| recaptcha object| PublisherCommonId object| runtime object| regeneratorRuntime function| setImmediate function| clearImmediate object| wp function| quantserve function| __qc object| ezt object| _qoptions function| qtrack object| gaplugins object| gaGlobal object| gaData object| ID5 undefined| google_measure_js_timing object| google_reactive_ads_global_state object| player_instance_846fff3108bf4e888edb4f7b572c2736 object| cnxEnfStorage function| cnxsetTimeout function| cnxsetInterval object| cnxPlugins object| twttr function| sprintf function| vsprintf object| gform_i18n object| gf_global object| gf_legacy_multi object| gf_legacy function| announceAJAXValidationErrors function| gformBindFormatPricingFields function| Currency function| gformCleanNumber function| gformGetDecimalSeparator function| gformIsNumber function| gformIsNumeric function| gformDeleteUploadedFile object| _gformPriceFields undefined| _anyProductSelected function| gformIsHidden function| gformCalculateTotalPrice function| gformUpdateTotalFieldPrice function| gformGetShippingPrice function| gformGetFieldId function| gformCalculateProductPrice function| gformGetProductQuantity function| gformIsProductSelected function| gformGetBasePrice function| gformFormatMoney function| gformFormatPricingField function| gformToNumber function| gformGetPriceDifference function| gformGetOptionLabel function| gformGetProductIds function| gformGetPrice function| gformRoundPrice function| gformRegisterPriceField function| gformInitPriceFields function| gformShowPasswordStrength function| gformPasswordStrength function| gformToggleShowPassword function| gformToggleCheckboxes function| gformToggleRadioOther function| gformAddListItem function| gformDeleteListItem function| gformAdjustClasses function| gformAdjustRowAttributes function| gformToggleIcons function| gformAddRepeaterItem function| gformDeleteRepeaterItem function| gformResetRepeaterAttributes function| gformToggleRepeaterButtons function| gformMatchCard function| gformFindCardType function| gformToggleCreditCard function| gformInitChosenFields function| gformInitCurrencyFormatFields function| GFMergeTag function| GFCalc undefined| __gf_keyup_timeout function| gformFormatNumber function| getMatchGroups function| gf_get_field_number_format function| gformValidateFileSize function| gformInitSpinner function| gformAddSpinner function| gformReInitTinymceInstance function| gf_raw_input_change function| gf_get_input_id_by_html_id function| gf_get_form_id_by_html_id function| gf_get_ids_by_html_id function| gf_input_change function| gformExtractFieldId function| gformExtractInputIndex function| rgars function| rgar function| HandleUnsavedChanges function| renderRecaptcha function| gformIsRecaptchaPending object| gfMultiFileUploader undefined| __gf_timeout_handle function| gf_apply_rules function| gf_check_field_rule function| gf_get_field_logic function| gf_apply_field_rule function| gf_get_field_action function| gf_is_match function| gf_is_match_checkable function| gf_is_checkable_empty function| gf_is_match_default function| gf_format_number function| gf_try_convert_float function| gf_matches_operation function| gf_get_value function| gf_do_field_action function| gf_do_next_button_action function| gf_do_action function| gf_reset_to_default function| gf_is_hidden_pricing_input function| cnxProxyTask object| Placeholders object| gf_form_conditional_logic string| gf_number_format function| do_callback function| gtag function| onYouTubeIframeAPIReady number| google_global_correlator object| sas object| apntag object| _ADAGIO object| closure_lm_451772 string| main_loc object| in_domain object| locale_out undefined| url_path_start_latam undefined| locale_out_latam string| firstPart undefined| locale object| url_path_start undefined| domain_loc function| getSelector function| getLargestLayoutShiftEntry function| getLargestLayoutShiftSource function| wasFIDBeforeDCL function| getDebugInfo function| getRating function| calculateRating function| sendToDataLayer function| SetCookie string| newCookieValue string| _linkedin_data_partner_id function| lintrk boolean| _already_called_lintrk object| webVitals object| googleToken object| googleIMState function| processGoogleToken number| google_unique_id object| s_i_kaspersky-single-suite object| GoogleGcLKhOms object| ONFOCUS object| google_ad_modifications object| google_prev_clients object| google_image_requests function| cnxAddEventListener

115 Cookies

Domain/Path Name / Value
.3lift.com/sync Name: sync
Value: CgoIoQEQqLHCrfcvCgoIgQIQqLHCrfcvCgoI4gEQqLHCrfcvCgoI5gEQqLHCrfcvCgoIhwIQqLHCrfcvCgkICRCoscKt9y8KCQg6EKixwq33LwoJCAsQqLHCrfcvCgoIjAIQqLHCrfcvCgkIXxCoscKt9y8=
.marketing.reversinglabs.com/ Name: __cfruid
Value: c9d5c241be44bd45dad5282700c2a2196b632cb0-1646946972
.threatpost.com/ Name: _cs_mk
Value: 0.499502179518742_1646946975642
.threatpost.com/ Name: _gid
Value: GA1.2.1299625775.1646946976
.threatpost.com/ Name: _gat_UA-35676203-21
Value: 1
threatpost.com/ Name: _pbjs_userid_consent_data
Value: 6683316680106290
.demdex.net/ Name: demdex
Value: 26556241689329212323610521727414406761
.threatpost.com/ Name: AMCVS_983502BE532960BE0A490D4C%40AdobeOrg
Value: 1
.quantserve.com/ Name: mc
Value: 622a6aa0-03d37-4a6f8-791f1
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~YipqoAAAAFJ7uAQA
.lijit.com/ Name: ljtrtb
Value: eJyrrgUAAXUA%2BQ%3D%3D
.lijit.com/ Name: ljt_reader
Value: 401a0ec0a2ae1e2b91219257
.t.co/ Name: muc_ads
Value: 46838242-e61d-4834-8fe7-cffed71a0b8c
.dpm.demdex.net/ Name: dpm
Value: 26556241689329212323610521727414406761
.threatpost.com/ Name: __qca
Value: P0-463493838-1646946975992
.twitter.com/ Name: personalization_id
Value: "v1_CLUpyzoMRxyczitgYWD/gA=="
.rubiconproject.com/ Name: khaos
Value: L0LHPFUG-13-G6NQ
.rubiconproject.com/ Name: audit
Value: 1|naVuGyos1qpFB/iuCfRN68zzH/SUMvpGs1wMD2ZZQDI/v2L5sO5vr7jSnOh/yIOcazGDAnZkjgciW6Q58jarRAvAG15loFpV9ffqWu8FjBY=
.threatpost.com/ Name: AMCV_983502BE532960BE0A490D4C%40AdobeOrg
Value: 1585540135%7CMCIDTS%7C19062%7CMCMID%7C30625287790357303784341966813391233075%7CMCAAMLH-1647551775%7C6%7CMCAAMB-1647551775%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1646954176s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19069%7CvVersion%7C4.4.0
e.serverbid.com/ Name: azk
Value: ue1-sb1-bc2e267d-8a16-43ac-a91f-f25473f25e89
.openx.net/ Name: i
Value: ada8e5c7-c783-46af-84c1-3ca21468a5c7|1646946976
.threatpost.com/ Name: _pubcid
Value: 49e4b8c3-9a3f-4df6-8899-e90f91b01ff7
.adnxs.com/ Name: icu
Value: ChgIzLJhEAoYASABKAEwoNWpkQY4AUABSAEQoNWpkQYYAA..
.threatpost.com/ Name: _gat_UA-63997723-2
Value: 1
threatpost.com/ Name: CookieConsent
Value: {stamp:873140406=='|Cnecessary:true|Cpreferences:true|Cstatistics:true|Cmarketing:true|Cver:1|Cutc:637307619|Cregion:'not_gdpr'}
.adnxs.com/ Name: uuid2
Value: 2769691298401138908
prebid.a-mo.net/ Name: __amc
Value: 1_1646946976_1646946976
threatpost.com/ Name: usprivacy
Value: 1---
.threatpost.com/ Name: _gcl_au
Value: 1.1.925028702.1646946977
.threatpost.com/ Name: _ga_YP1JLG57CH
Value: GS1.1.1646946976.1.0.1646946976.0
.threatpost.com/ Name: _ga
Value: GA1.1.865144764.1646946976
.linkedin.com/ Name: UserMatchHistory
Value: AQIh-qqOXVO51AAAAX91sISURHmtrZ1Vb-HhnlTuSAz9NhBvWFVazlBG35ngqItS3MK2YALnUxSC8g
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQJnG-9y53DyTAAAAX91sISULl70NviTMFAjQUY7Pq_r1UXIme8ST4IRK4AREJrrl6RE972bmnoZtRr16URcjA
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&c51cb103-257a-42c0-8976-6c51b51616d7"
.linkedin.com/ Name: lidc
Value: "b=TGST05:s=T:r=T:a=T:p=T:g=2491:u=1:x=1:i=1646946976:t=1647033376:v=2:sig=AQELO81zOhSU1tWHlhKiQcylujuwuJTF"
.threatpost.com/ Name: s_cc
Value: true
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&202203102116173b71e34f-a1b7-4bba-87f3-8530f25b5fbcAQGFoHc7j-qRNS7upe4khiXwUN2ipkdY"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NDY5NDY5Nzc7MjswMjGdub5mAl52/4iuch7GV6T9Nxdf/pZFpQSi+aVbnOLXdQ==
.threatpost.com/ Name: __gads
Value: ID=9b3d556ce1e6b56a-22285f7059cd0019:T=1646946977:S=ALNI_MYWsR2TfYWiJbFnTlEoFLGTnKPXcQ
.doubleclick.net/ Name: IDE
Value: AHWqTUlIHBych07cN2sVvrY5x9ibp4G7iV5U35_MeyuWYFVSDFmh3D9cQho4vFw7qOM
.casalemedia.com/ Name: CMPS
Value: 3192
.innovid.com/ Name: uuid
Value: c47c08d7-4824-491b-aad5-311ff7fb5f9c-20220310 16:16:18
.casalemedia.com/ Name: CMID
Value: Yipqotmaf5R3Tjh7Fnb4KgAA
.casalemedia.com/ Name: CMPRO
Value: 1190
.pubmatic.com/ Name: KTPCACOOKIE
Value: YES
.awin1.com/ Name: AWSESS
Value: 359541:2480620
.awin1.com/ Name: awpv14363
Value: 412871|1646946979|541bf361-a0b7-11ec-9413-2263ccb3da92
.pubmatic.com/ Name: KADUSERCOOKIE
Value: 49B147E2-F9AD-4953-A487-561CE0E73FA3
.blau.de/ Name: nscQ486
Value: V
.blau.de/ Name: nscT486
Value: v01MTQyMTExMzExMTExMTExMTEwMTQyMTY3MDAwMDAwMDA2MTY0Njk0Njk3OXZsZWExZGUyMDIyMDMxMDIyMTYxOTY1NDE0OTQ4NTk1WDExNzY2M1YxMjI1MTMxMTA2TVNvbmVpZFI1WGZnZjZRRnhreEZrSHdIM3RRdGRkQUZ3VHpUN2dzN29uZWlkX19hc3VpZERPb0hlOU1pNHFTWWt2dXU5XzhRT29tYmotSUE5TzlrYXN1aWRfX3N1aXRlX05ldG1peF9SZWFjaDQzX1RvcFJvdGFNb250aDExNzY2Mw
.blau.de/ Name: webShopPV
Value: ?partnerId=BLU_AFF_POV_EXA_35008&mediacode=AFF_la_117663_-HTLP&utm_term=AFF_la_117663_-HTLP&utm_content=BLU_AFF_POV_EXA_35008&spid=2022031022161965414948595X117663V1225131106MSoneidR5Xfgf6QFxkxFkHwH3tQtddAFwTzT7gs7oneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117663
.o2online.de/ Name: nscQ485
Value: V
.o2online.de/ Name: nscT485
Value: v01MTQyMTExMzExMTExMTExMTEwMTQyMTY3MDAwMDAwMDA2MTY0Njk0Njk3OXZsZWExZGUyMDIyMDMxMDIyMTYxOTY1NDE0OTQ4NTg3WDExNzY3OVYxMjI2MTMyNzAyTVNvbmVpZFkyamNyZkczZlltNVNWSDlIZXRRdFJSOGNBVDFUSzFUcm9uZWlkX19hc3VpZERPb0hlOU1pNHFTWWt2dXU5XzhRT29tYmotSUE5TzlrYXN1aWRfX3N1aXRlX05ldG1peF9SZWFjaDQzX1RvcFJvdGFNb250aDExNzY3OQ
.o2online.de/ Name: webShopPV
Value: ?partnerId=O2_AFF_POV_EXA_15008&mediacode=AFF_la_117679_-HTLP&utm_term=AFF_la_117679_-HTLP&utm_content=O2_AFF_POV_EXA_15008&spid=2022031022161965414948587X117679V1226132702MSoneidY2jcrfG3fYm5SVH9HetQtRR8cAT1TK1Troneid__asuidDOoHe9Mi4qSYkvuu9_8QOombj-IA9O9kasuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679&affiliateId=v01MTQyMTExMzExMTExMTExMTEwMTQyMTY3MDAwMDAwMDA2MTY0Njk0Njk3OXZsZWExZGUyMDIyMDMxMDIyMTYxOTY1NDE0OTQ4NTg3WDExNzY3OVYxMjI2MTMyNzAyT
.quantserve.com/ Name: d
Value: EC0BDwHQJYEPisMA
.advertising.com/ Name: APID
Value: UP54594ab7-a0b7-11ec-bea4-0238a0f5ffd8
.adsrvr.org/ Name: TDID
Value: d7b276ae-2a2a-4852-9181-19b97d7e27a1
.mathtag.com/ Name: uuid
Value: ad8b622a-6aa3-4b00-85b2-11db6d3e7dda
.adform.net/ Name: C
Value: 1
.yahoo.com/ Name: A3
Value: d=AQABBKNqKmICEEvGxk2XtZ7nQRDKyumaaboFEgEBAQG8K2I0YgAAAAAA_eMAAA&S=AQAAApuFwsx-2Vi2smakHi8Xsaw
.adform.net/ Name: uid
Value: 6957336235413161053
.threatpost.com/ Name: cto_bundle
Value: Y7LwuV9GbXd5QXVyaGlyV2hGdm5xaWhGcGhrNzZNSUpTenRocjJ1Z0szNmdLR1lPZ0JWQ3UwUENHZWNPVERTNCUyRmpVRzhkMVRVZzYzajBvZ2ZCUDkyOTRsN1pacE9YR1RBdE9BWlFUeUM0bmtZSzFiJTJCdmkyUmNIbE5jb0IlMkY3eVRsczB4MA
.threatpost.com/ Name: cto_bidid
Value: YGHmrF9ZR05PSXhldjVFRlJLQzlLRGxFNGhKWEJzdFVHejk1R3pvQ1hiTXEyelZIbnNJcHdFWm1NdFdabzhld1FZN0NzYTEwT3ZFQ1JQJTJCcExsWmlJOEpobDBBJTNEJTNE
.openx.net/ Name: pd
Value: v2|1646946979.2|kiiygevNgun0.gqsLommOnsgi
.3lift.com/ Name: tluid
Value: 406897702486631668351
.w55c.net/ Name: wfivefivec
Value: g2xR0Ow31Nsq905
.bidswitch.net/ Name: tuuid
Value: c8366fd5-e3eb-4447-9ebf-eb5d8b206510
.bidswitch.net/ Name: c
Value: 1646946982
.bidswitch.net/ Name: tuuid_lu
Value: 1646946982
.bing.com/ Name: MUID
Value: 3EDE1D5C441D6A980C900C3F45766BC1
.w55c.net/ Name: matchopenx
Value: 5
.casalemedia.com/ Name: CMST
Value: YipqomIqaqYA
.servenobid.com/ Name: pid_337
Value: y-UsuQWIhE2uHorDGvzV0riQunUMj.Sf.bYwVATMQ-~A
.servenobid.com/ Name: pid_312
Value: 2769691298401138908
.lijit.com/ Name: _ljtrtb_273657
Value: 273657
.a-mo.net/ Name: amuid2
Value: a2122771-06e0-4b3f-93ef-8ceef4f9c4f8
.servenobid.com/ Name: pid_333
Value: Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB
.smartadserver.com/ Name: pid
Value: 655740961209670750
.gumgum.com/ Name: vst
Value: e_0ef695f5-98d3-44ca-b07b-51f1b21a0b2b
.servenobid.com/ Name: pid_310
Value: 401a0ec0a2ae1e2b91219257
.creative-serving.com/ Name: tuuid
Value: 133a9be6-7793-412b-9edb-d9693a3b2969
.creative-serving.com/ Name: c
Value: 1646946982
.creative-serving.com/ Name: tuuid_lu
Value: 1646946982
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAAADslzmtoZmJmCUQWRsZGhgA6RpTkEAAAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNjU0NjQwNzc3MrAwtTAzMDE0NBfiM9QNLSuJSDMwLY83yckCAEpS1FclAAAA
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNjU0NjQwNzc3MrAwtTAzMDE0NBfiM9QNLSuJSDMwLY83ycmS4jU0MzGzBCILI2MjQwCOH-nvNAAAAA
.servenobid.com/ Name: pid_327
Value: a2122771-06e0-4b3f-93ef-8ceef4f9c4f8
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003%22%7D
.servenobid.com/ Name: pid_317
Value: 655740961209670750
.servenobid.com/ Name: pid_309
Value: e_0ef695f5-98d3-44ca-b07b-51f1b21a0b2b
.servenobid.com/ Name: pid_324
Value: 5131077720858604117
.brand-display.com/ Name: _knxq_
Value: b4f5b009-8b11-e467-9d9f7740.1646946982.0.1646946982.1646946982
.adsrvr.org/ Name: TDCPM
Value: CAEYASABKAIyCwjYwN_WvrnBOhAFOAFaC2FkY29uZHVjdG9yYAI.
.creativecdn.com/ Name: u
Value: KIxk9HKbaftOgxoA2ejD
.creativecdn.com/ Name: ts
Value: 1646946982
.smartadserver.com/ Name: csync
Value: 124:ee919e6c-367f-4ce2-b4db-c6b63f767887
.360yield.com/ Name: tuuid
Value: af15bb5e-9b9c-478b-b687-dfb0beda6c1c
.360yield.com/ Name: tuuid_lu
Value: 1646946982
.analytics.yahoo.com/ Name: IDSYNC
Value: "187s~23ol:196n~23ol:17ot~23ol"
.postrelease.com/ Name: opt_out
Value: 1
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003%22%7D
.casalemedia.com/ Name: CMRUM3
Value: 27622a6aa60b40&da622a6aa62760&e6622a6aa62760&58622a6aa605a0&9c622a6aa605a00&2d622a6aa605a0&bf622a6aa62760b4f5b009-8b11-e467-9d9f7740&f1622a6aa605a0
.servenobid.com/ Name: pid_321
Value: RX-6a648ec4-4459-4197-85be-6bbf37b216e5-003
.go.sonobi.com/ Name: HAPLB5G
Value: s57128|Yipqq
.zemanta.com/ Name: zuid
Value: H2smdvEF4TEG19QlX96j
.amazon-adsystem.com/ Name: ad-privacy
Value: 0
.technoratimedia.com/ Name: tads_uid
Value: GDPR
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: 0528060491997172
.outbrain.com/ Name: obuid
Value: d1fc4bde-9db6-4e26-aa55-e607acd581bb
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-a8585234-f896-4018-710c-47237522e79a.LunOoul7GAZ75ujCxD%2FVYJWD0pwgyt2ZyQ%2BjtNxWi4g
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AqFhSNPiWQBhxDEcjdSLnmtly14M.%2FWqPgRBzgFsqVE%2BT3kHFFNYFJVQ7%2BUa%2BAEp6dJ8IMzk
.ipredictive.com/ Name: cu
Value: 5638b94f-a0b7-11ec-bcde-477f26462834|1646946982766
.amazon-adsystem.com/ Name: ad-id
Value: A6ROycBPkEbvudWLS7NQIgw

16 Console Messages

Source Level URL
Text
other warning URL: https://www.googletagmanager.com/gtag/js?id=DC-9582686(Line 40)
Message:
Unrecognized feature: 'attribution-reporting'.
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_push=AYg5qPIRwmPKe-SMJBJliGF27zcfVVlI7AlCuFAQ6yKiXnOJp27MBt2egaPMJe-Q14nGlDxlrzDU_AuxGMrlrM0Eyr9EUv891yo
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4LwAABGgAAAAB&google_push=AYg5qPLJJtUuEVZ_uOzYWnnuF2wwbYoz8uycR4TLCWPJVZ4ev2DneabgcNDeEZZx2GbWU1p25ix_KfpsTcEJ3PzaGJUqOFU-YiRY&google_cver=1&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yipqotmaf5R3Tjh7Fnb4KgAABKYAAAIB&google_push=AYg5qPLWQsu_b-wcpc36SmLgDmghCuR0ddSKzcbjZO6sXRF8lshBrYZXDiJcMFVXP8xzYWbEz2egw2V5AouAmwmsI6u9FMRgiKU&google_gid=CAESEB8EvDal1rahBk8E9GjJP2o&google_cver=1
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://js-sec.indexww.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://js-sec.indexww.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://js-sec.indexww.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
network error URL: https://id.rlcdn.com/709414.gif
Message:
Failed to load resource: the server responded with a status of 451 ()
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

59bf77f101e2a5c2e3c052a9c0f9547d.safeframe.googlesyndication.com
9582686.fls.doubleclick.net
aax-eu.amazon-adsystem.com
acdn.adnxs.com
ad.360yield.com
ad4m.at
ads.adaptv.advertising.com
ads.creative-serving.com
ads.pubmatic.com
ads.servenobid.com
adservice.google.com
adservice.google.de
ag.innovid.com
analytics.twitter.com
ap.lijit.com
as.ad4m.at
assets.ad4m.at
assets.threatpost.com
b1sync.zemanta.com
bh.contextweb.com
btlr.sharethrough.com
bttrack.com
c.amazon-adsystem.com
c.bing.com
c1.adform.net
c2shb.ssp.yahoo.com
capi-tier-2-us-east-2.connatix.com
capi.connatix.com
cd.connatix.com
cdn.id5-sync.com
cds.connatix.com
ce.lijit.com
cm.everesttech.net
cm.g.doubleclick.net
cms.quantserve.com
creativecdn.com
cs.emxdgt.com
csync.loopme.me
dmp.brand-display.com
dpm.demdex.net
dsum-sec.casalemedia.com
dsum.casalemedia.com
e.serverbid.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
event.clientgear.com
fastlane.rubiconproject.com
g2.gumgum.com
geo.ipify.org
gift-connect-d.openx.net
go.sonobi.com
googleads.g.doubleclick.net
googlecm.hit.gemius.pl
gum.criteo.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
i.liadm.com
i6.liadm.com
ib.adnxs.com
id.rlcdn.com
id5-sync.com
image6.pubmatic.com
imasdk.googleapis.com
img.connatix.com
jadserve.postrelease.com
js-sec.indexww.com
kaspersky.d3.sc.omtrdc.net
kaspersky.demdex.net
kasperskycontenthub.com
lit.connatix.com
marketing.reversinglabs.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
media.kaspersky.com
media.threatpost.com
mp.4dex.io
mug.criteo.com
odr.mookie1.com
onetag-sys.com
p.rfihub.com
pagead2.googlesyndication.com
partner.blau.de
partner.googleadservices.com
partner.o2online.de
pixel-us-east.rubiconproject.com
pixel.33across.com
pixel.advertising.com
pixel.quantserve.com
pixel.rubiconproject.com
pm.w55c.net
pr-bh.ybp.yahoo.com
prebid.a-mo.net
prod-rtb.ad4mat.net
public.servenobid.com
px.ads.linkedin.com
px4.ads.linkedin.com
qd.admetricspro.com
rtb-csync.smartadserver.com
rtb.gumgum.com
rtb.openx.net
rules.quantcount.com
s.amazon-adsystem.com
s0.2mdn.net
script.4dex.io
secure-assets.rubiconproject.com
secure-web.cisco.com
secure.adnxs.com
secure.cdn.fastclick.net
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
snap.licdn.com
ssbsync.smartadserver.com
ssc-cms.33across.com
ssum-sec.casalemedia.com
stags.bluekai.com
static-de.ad4mat.net
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.1rx.io
sync.go.sonobi.com
sync.ipredictive.com
sync.mathtag.com
sync.outbrain.com
sync.serverbid.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
sync.technoratimedia.com
t.co
tag.1rx.io
tagan.adlightning.com
teachingaids-d.openx.net
tg.socdm.com
threatpost.com
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
u.openx.net
unpkg.com
ups.analytics.yahoo.com
us-u.openx.net
usersync.gumgum.com
vid.connatix.com
www.awin1.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.lead-alliance.net
www.linkedin.com
www.telefonica-partner.de
x.bidswitch.net
cm.g.doubleclick.net
104.109.78.125
104.111.215.191
104.111.219.144
104.111.239.217
104.244.42.131
104.244.42.133
104.36.113.23
124.146.215.45
13.107.42.14
13.248.245.213
13.32.119.176
13.36.218.177
134.209.129.254
142.250.181.226
142.250.185.230
142.250.186.130
146.59.70.99
147.75.38.124
150.136.26.45
151.101.130.137
151.101.2.137
151.101.66.137
151.101.66.49
165.227.252.242
169.197.150.8
178.162.133.148
178.162.133.149
178.250.0.157
18.156.0.31
18.156.195.47
18.185.181.98
18.195.155.181
18.196.197.61
18.202.206.42
18.216.183.199
18.66.139.110
184.31.84.150
185.184.8.65
185.29.132.241
185.64.189.112
185.85.15.31
185.86.137.107
185.86.139.115
192.132.33.46
193.0.160.128
198.148.27.139
199.232.136.157
2.18.232.130
2.18.233.180
2.18.234.21
2.19.35.65
205.185.216.42
209.54.180.144
213.19.147.42
213.19.147.44
23.88.75.189
2600:1901:0:76b9::
2600:1f18:444a:4602:2c20:3113:5c28:1366
2600:9000:223c:0:6:44e3:f8c0:93a1
2600:9000:2250:4e00:2:9275:3d40:93a1
2600:9000:2490:5a00:0:5c46:4f40:93a1
2602:803:c003:200::61
2606:2c40::c73c:67e1
2606:4700:20::681a:71b
2606:4700:20::681a:ad1
2606:4700:20::681a:bd1
2606:4700:20::ac43:4bf1
2606:4700:3031::6815:456d
2606:4700::6810:7baf
2606:4700::6812:272
2620:116:800d:21:51e4:db4b:4436:b305
2620:1ec:21::14
2620:1ec:46::44
2620:1ec:c11::200
2a00:1450:4001:801::200a
2a00:1450:4001:808::2001
2a00:1450:4001:809::2002
2a00:1450:4001:811::2002
2a00:1450:4001:813::2002
2a00:1450:4001:827::2003
2a00:1450:4001:828::2006
2a00:1450:4001:829::2003
2a00:1450:4001:829::200e
2a00:1450:4001:82a::2001
2a00:1450:4001:82b::2004
2a00:1450:4001:82f::2008
2a00:1450:4001:830::2002
2a00:1450:4001:831::2002
2a00:1450:400c:c07::9d
2a02:2638:1::13
2a02:26f0:6c00::210:ba20
2a04:e4c7:ffff::69
2a05:d018:d29:3602:c713:d832:3f91:5c2a
2a05:d01c:1d8:8102:d28c:83ad:1b58:a2c4
3.12.63.132
3.121.19.101
3.121.94.129
3.122.136.79
3.127.158.112
3.211.211.136
3.33.220.150
34.111.151.213
34.203.25.60
34.205.3.24
34.240.27.36
34.255.107.204
34.255.38.72
34.98.67.61
35.170.180.116
35.173.160.135
35.186.253.211
35.244.159.8
35.244.174.68
37.157.2.234
37.252.172.249
37.252.173.62
46.105.202.126
46.4.41.145
47.252.78.131
51.195.5.38
51.75.86.98
52.215.111.225
52.215.175.9
52.29.1.115
52.31.32.190
52.95.126.160
54.75.68.230
64.140.160.2
64.202.112.159
64.202.112.95
67.202.105.22
69.173.144.138
69.173.144.165
69.173.151.100
72.251.249.14
72.251.249.9
78.46.85.162
84.200.5.215
010792043e3dcbf986df59204a8fe6f2884dbe370082ac5dda69891b3336e15d
038fc4d49a9191d416d49841f371b6e0b06bb40f719124099d40fe8f393b9e2c
03a3f5398aef1378ce76d1e24c6e73a942a2b42a378ca8e74150ad7d0fafb5dd
03cc687f0c8a2d1694e509b91fcd6c62c0fbdbdbdb850b8007b8052f649c7f77
0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
079112c3107dfb6e95b14f8ddd2d1a1c3a094ebd3212077a99876cb41bad13b2
084885652dacd1b70a7979e7631caa6fe5985a5c1b872c28dd890d9ea39cec3d
0a0f7b434f868be40616c4d40c59796ee68072e0417b338473af031451574279
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c213878fbc1d369aaa1c9c7ffdd1269322371c74be124ff4809cd6cb6e8960f
0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c
1189ccbd0346d7aeb090d8769592e0285599a29122ffd5a0a0ce9c039412387c
13e3e608a99640f5a7c2b3ae0a38e0d01b0ac6545cf3cf96503d3986cc1d9e4e
13eb644aa7c69a15e7e0a356a8d3901278d54db305211aeb2ee224365f3da8c5
156a9802a1ba3acf722fe76ddb97dccb14a2138a5ce3a526100c42d7f2b18eb9
16114b450bf691dd524d3c0e2125de311faf6a254838b6078c0a45535806219b
1791bf831c158912a11ca40bcf5f3573fc54ec8f8343c37780dab679c0203d63
17aee1fe3d7d16e647b97f568230c2ff36c1855ce35ce930c26aec5d2c58eaf4
189474137e3d1b04badc67e2c55c9cb9f9875e3c01c77b2c300f6f1c64bc24ff
19b1abbb0de5388bec8b3f45f26dfc27c7e48630553559aad0a07026122f27bd
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f
1aeb3ee07f4b462935c5d8047ff038c8e279d75f9be1dcd0b848ba68223a3ee2
1c824cef6b855bf575b4c6a0564cf50f40da1e47fb7b58b8903ca32d3758b49e
1cc8f236395021ae8cedd13405db496e01adb47b7a9a9df3fd85ad420eb8df8d
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4
1f3d8b57f69b73694c38ba6bbf8ddc46c8a5e52db401795fa8ab80643e14236d
22637db89b1d70be76a1594fa204683657da188de1bc49233a8ea2e235035504
22c90613db09ef65c964b143e6adbe584b42eae85c9b7a75fa27c22b25cccb90
2612a15822521046e5dcba03b0fb5bcfa263d69262298c81f5695a0e92d45df2
289ca8f32c03ad695ffb8da0a83ae0b45caa5bd43c8d2b4af457caa3c94c4696
2a647d79b31b4b19f30c795aac862bcf5b424731c732e239775127b8ac4aae0a
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e9992ed264174e850e57d7cf584dcf322d30c954514badc658592349c0d0933
2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e
2fe24ebb4d5333ef883e9e30f37118946283f81e286afdb4b52fde0fc94b8eef
307468c466035ab0e9176bb3e5d6c02edddca2dc2ed8268e906ffde723f0cccb
31c1613a34d87d9a03090babcfb88c16fdff9e9e5d1c03c696d5f9bdf06a65b2
3269e45f9b952b460e8a94f247c5ca2b41c3b685126bf9d36be21aa1d0953f9d
34be38d133fe32063b42903021ab00b51e6ba9190777a9a331a323295e8cc4b9
356aea1e84019ba785c13fdb3e8fa8573bb002ed37c73c242a60bee731f2bafa
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
380bd23640c07e8589e197c629a8f74d073f8ea0d1eb13e4fa535a7faa45996f
38586ee391e065406aeb39b262d399bf32085d6724151d00f37f3b8e6b3eb8b2
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26
3d185748c9add785702fd1b8ecc0984e2913c715a5584deb0ebd48a080bf7de2
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3ef5bfd224e0baa902eb88c94979cfaeccf2169a996c601fa3de4c3f3b33da01
3f156b054149f99085e69ea1a23cdb601aaa9213219dc541569d2f6cd033324b
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
3fef9e04e60498e2a2c9daa0ee83ecd94b5e32d681e8f0a9babb898034adf718
408e9c6680dab12e1a2f84f86e4e81ef6a0869231dfcb9a987814862fbb0ea0b
41f047950d4db7e04d250ebe65613aaaf482546a855d9321d1536ecb8ab6cccf
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
42e6eedf5679d8d81a6c90851a203e9db1c5a3597dd8e2854fd8ff5b339c6181
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
442e238997ccdf2457f7e614c2d4d1746b749fb20bc20d1786467e93b3a5a025
443d084812077ec6712c919ad9eb37f26151f52a2b9822573827cca0c9ee4e77
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd
47fa83c42634790c68e1c352a9be81c173fdb70c8e0f459fd11da901925ac785
4823c011e4b4cb4b7f35ced3ab09d57215ee243676d9bfcc24d10ec77d3db398
48612d697d41f938e9392cd38c1715d982e4ad11d81765aeffe06ec9196d40a2
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4a1a2e5f372c06d87f8ab2baf759b42835353e7ed5410d6983584d9d7e0b3d87
4d52f37b83f70c5035632548c652508d793eec55e17f2ac19552f4fa19d323be
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e0b5563ff1fc5175d65e11e1546bee1945486d65d76c9248bdd77487532dadf
500288356853c7199a27a6a2cdcd14b217d18dd9c8103272d8e6def6acbe2580
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
511c99debe7a98083a9bb165bc5ee93de821a4056f82000c657cceb6d41519a6
519815bc4a3dd9a571cb56f57c7c6abfbda2b4e2de8c4b884a7535a1705438f2
52cac1193a3683e35353723a38e01a9bcc0c5f9bf2be42d29c96905527c7923d
533e8ab00e73a9a61f550b956a872f9091fe48b79b4072d87bdb07348af7f4bc
53e7b382748a03aeaa0857aba684ac2fa416f94cdb97566c117b85cab04f668d
546be401414bcb20cdea07cdbcd806409b9629e4895737e214401948c40409f3
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5b1ef120b8cafab218068320e792cfe2155df8a5e8f77b1992d86e202130def2
5eeedf9055f9efab9127642b4c44135be9f404caa7ce08e51a5ea734dfd28828
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61c79ef2330e73c9def8133c8a6838a9c2082add2fe515f939f6c3f90409c77d
62cbf085d014439b719c84c3d2f3222fde66e299c2da1b41dfc4dbb315db0456
64806986d08d884e0edc911b9fc00398f00fb4fdf7aea5455649092b4875f1fb
6493fe707262fb8d9bc0e4d487e319fc9ebe7de26ebe7e3b4f58a5d17f03a9ea
654b439253ed177cd570490cf72e6d38126dd6a03797b3a22f8628501c9387df
66e3c287882bd1ea6ec5b6ebd27f0bdea61cf13b6eb0beb7b39db7286a8920de
68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f
6842eeb2b3840ed24218c6720db56d407fd380f6e042b544343af69d30154e8d
68cdaaeccd079ab33df06d3e5fb47594a4458a6491d48a8ae2f394defb419eb5
693c8b61667ac94847264924178702a190c5113b41b82085dad0641f89e3f864
69f0ade8cca67112ef495f707fb73c68fd5099a6cd9c51d9ba9ceda8dcca16f7
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6c8e343da3b15a6a26e0367b83d1c97813863ea6e6a905bd9e69870bb0a0ebd0
6e6377776a1104aed9b11142115b22dcaad3cf78ae76d255e454b04b7189af32
7104f88840a420f1702717d900db98910deb6141ad639bb7338b88993e989c72
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658
739ab1cbd5fc795c806cfbc012e937834a1d566f02ed72ff02af2700c0629eb4
73db106d0237846f0e0ebb683af75de25b0f4ca921da823747473788ac1cef37
769996a987ead923de78ded8af9ebbc0125bfdca436dfadfdc9755fd54270371
7aaca292221d94693d7393d6d84e9cd350483358fccd88c048c9706e002c8400
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7bfc2055694a04e00bedd6a25a1b130b96cc7a4c35309f36e46d9322ea29b028
7c3b96f238042f73d0bedf5877fa02eb834e89649bbd122e2f10cc35238173cf
7c9fb31b8fc71d7280f2de2d6a791d6c0febce4b95e3da5acc07d2d561092fbe
7e75ade51afcae47ec8dedc46bd50962ebb58b46638a69951f1f494c5052fe14
7ee7be21d91af71ca9589c2044eb2f4666ac9f7427e73c6dea7d4d0d870b8af4
7fd9983a3429d6ead1f66bf933770f9b790818b189e39ff0f2a0d3f590bbf67b
816f5777083926d282d6307a1d75ff2cf6ccdc7a834032739637654bc2cc7d76
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84d00511d9ac2d60f4b43ad8dd4c237a8093c7a45f1e8da88f5c233866d408f2
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
84f884ae3edcb8c05f55a2f69a0c8c5484885584acb5c9978572b9f51ad0277e
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
85b8c8f31ca51e98dabd0c9f76986fa38d417dd921fd18143356f4b1ba5c4592
86cf7cdf56588a045829e9bd6d130cb75889b8d8110bbab4e060a435bcf46373
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a320365cca763b186df5b19567471ca60e33d41c287bda5a73a9631bc5c83cd
8aceba9e8cee57a5e42f954ff050f6baffbd87600ffe4092a9f859b55d490ed7
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8d713e04531efe2242b16d8fe8fe69c1b95ef7fc99d4a85fdbb695f7fb5a5f91
8edaef698e025c37ba9e8d632a895d7252c62251df3f095d5cff17b6f3304854
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
9003fef55e3576f4a0a0238398fe166e7ee41975e55dd3ba079066eea0fb291d
927e16d837ac9f46ddb4a64c8fea1cbe39343902c91b14e11b484e9b01f98cdd
931dc539e87db7f509be9c77dfcc9b2baee0b91e5236aa04580ab14ed81e2cc0
950ae7fb1dbd8fd4c849224f7bf9dd7f02912f0d16fb32047c6479a4a5ea7f18
96286511eca09b0c91bc02d96d4763f76d8a5ede343a49e0a9d3c020376fee43
97f5070aadd9475bb56a49a7bc1114e9fe1b992b55f2b227502f35f8bba71d74
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b2768ec59412bbaf92b5ce4405dff00a4e08af74a4226ff5d930d5816d48310
9db763fc6b8b1e326731d686dd817d0e0b3f88dbb1c9c3b7355ed3a2594fff51
9dbcbf5c2a84b934886f7d82e39ecffcd2fe11e94b7d2a5f6e7bb761dd847f54
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a07787009482debd508bb530fd88cf1f90eb39a5702c74b409fbc0becd71c584
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1051ebf75059a19bb11690e1c0ae38f508170a08e04ec1dad1c8c62fdb1bfed
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2f39e7093ae8158721d77ec51af1a7009b4e389ee231cd16fd42fae1c97babf
a33f82a5e2de17331a7b4c0b2aba9b677167db758599e93ea95acdc7022cbd34
a3e64300797e8078baa41dbc49e2affc1d2bedd04a470f0c929ed7fac698fbcd
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952
a48a2dd5c8d694af984a789271173ee9c7c22502c3fbf9e7c12423e33a9048c2
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4ad8a4c4d23720b5cd68054e212751a2ad4a2bf8add55dbd817f1e0fd2bcded
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a92d6c8c0724333c59f6325fe39375b76e55fa55a4a4b5ee8d59d715082a4402
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
abfa5ce24f65db048040344e04b17c9f99d99170f41393641a1531828c05b3ce
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
ae01f81568274cd06b5147c59eddad07b73d10799cfc76b67223dfc30abfb95a
b13a70bbf9440ad94f2108d762ca3db168fc275d6389538dfb0f032b18d5975f
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1f863d13dbad7d5240f577a73b47b06227d218909259042da95301e2eb8be55
b236dccee1a0d5280842bdff52b4005e2b0c9ee5d74a15db3e939c53306576d3
ba2bfa49e9c9b015fa91ff873ee8b778f31583ed99a619922abfedc5f22b0fa5
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb83a3ba5468dc41aa8b6456858d98bcbd45cc745e076a0de6fcdd91bfb00b84
bbfd30e5fd2bd475d319b5b55ab61469966d1517b703f9bd830a6f3207387c27
bc2ff895812543f6ec943eddb5fe186ec0e57c2ea8a498494c110b2c33c70c1a
bcdf010ba3dc61605c33de9b33e7e76dbc3bb4326dcec49f33970345e517fb25
bd86fa96fcfbf25d665fddf9b38614b22b043bf14b6b4e3a193ff4aec5c69ab5
be6f75489b6c2d061c4085b9e67b4ff000ad74513600d361560c67f49ae8652b
beff8d5769ba68eaa43d7713cbdf15cf9b6cf7cdff4dd1c3a0a012d70a939518
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c567d0068aa9d314d13047cf6af171cce476501aac5e5521bd2b2233b16fbce5
c8b94a7e80a79cd62d64f7276e514417e2659849663996d90fec4e09ed5ee4c3
c8c03fd4dea0f2c83fa05b10dfd913bfcff51d05e0c6e84b7f340b857fdda517
c8e92abaf2e87fa74d7c90513d7fde3b3249f1145ef5831dc82007a92925ffaf
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cbbd5676d9c7345483787d39fb83cb6880b4ee7d114e53f5b3df9b217af5f72b
cbdbc42844b93e9491e321c96f1c7e23e72b4615eab7e8d75b5c9e3bd2056b16
cc0c786efbbe7567af9d4754502be241a47319e077fbce9f5e91384d5985b8d9
cd3767c9daaaaf6b31ba6dd8821d1cf09594ffdddb05a60b81d960aa4e2f44e9
ce329cd4eec855a3382ff4539be2a54c34435aae94f94d8b14e972349470b5e5
cf2dea74c2167f9b90ec423d1423652280593f68efab42a5559a63cd3eb7f6db
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
d12a71cd626ac8f0fc91e6f1b98280cfb49fd724f2dcc118d192adff9a0154b4
d1e27d303d0f0a3a4e0d99f82c90672dd4a595383fb2f9fba89638eed26abc2b
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d39688d694f5488ae394bc24b2bf5f278cbb53d8368d9fd6b2163fba5c4155df
d4c4215f41a4bb6f12e0d100854eecc6bc5c57ef23af0e945b8359d7727ae94e
d526e08d2f18f7fea947247c440cf46473ed39655b4931e959939c383291f665
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d9078a8da2ef1c28c12e550b82caa0c1924de2ef49aacc471aab4318f948376f
daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f
db2f97866b2059c564f5b8b3b53c5ff2835672c09ccff1ed22385bc2515a961b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dded8f8315bfa1c937330c6d23a5883248d37e189635b093e93e096e594ad5d9
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e0f1df7af81fd8eb920863093c426fdafd241b8d9aeb6126fb2fd24f36c061b3
e127aead57cd6625f795f8c41d8b7c463c2c50158e3a3dc398424db2b16bd5db
e206e4b3b96e0033f6dbd6cf17e2458f118000c43ab90a5e17683b4ae3ecacc2
e20ddb9ed1fa044cb624f0253bb06b13c92ed9915063bd63a5806440c6b1ce7c
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
e2bea7e6d83b5f76327319571709551864df4297466b60f6e2626621b7666fa1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e5935466216a250bb06338805b32ffb19eeda9042ead790ebc6e5dda27820adb
e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389
ec068031a38f2d97255ddf90e6d75a5538a3b0ea29510482d1909c5a1a10ad74
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
eded679506e3297bab085a54c0e0c062ddfcb46f43a34e961d44c53d7e7d0eee
ee9907f608e1977b5aa325d6021ae8acbfeb9bcc279d2cb89b9ce838fd3ea9b7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3d66b78ca0c93adf48dec8533da3c4db538cc648dc60e383d5fd0b666859206
f3de350a428af5c6cc90503d461eb9305555ca492d887c7f3299e6b585df75b0
f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea
f61e477e31acf22782eb2acc7f716837d8613caef8d774047f45206d820a6856
f7492476dfa60f0146889b13e37c67fd1a70e42e6ddb017c0c08e25148fd8985
f7cdf71044448cb736733f5163fff96081d51ba4101567d61d22ee5998a7a399
f7d57458a0dd608d1a1e9f75545b24b07a868be96a76e052f7e7bdfa250101fe
f7fa16318dc480af20d576dd448a1d5ecf4f2a1cfefd77622111817ac2a54194
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189
fd0a316e35f5b2e7923e88936bf7de05526e72fda0b7da2b03c46d0e639a50f4
fdecda5ee87b28e579c5b61ef0f86e7fff85c838ff0a06450feee13a5877ed0b
ff52cd6fa87197e500ac404574525aeeb1b9d184f90a74e19197f6fc159e6107
ffd115e2f82505f80c02d8d141620cd10f8edaa9e066294e716863f4af20427c