threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Submission: On October 21 via api (October 21st 2020, 3:00:54 am UTC) from DE

Summary HTTP 259 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 65 IPs in 9 countries across 43 domains to perform 259 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on June 10th 2020. Valid for: a year.

This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
18	35.173.160.135 35.173.160.135	14618 (AMAZON-AES) (AMAZON-AES)
11	99.86.2.42 99.86.2.42	16509 (AMAZON-02) (AMAZON-02)
7	2606:4700:e6:... 2606:4700:e6::ac40:c502	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:81b::2002	15169 (GOOGLE) (GOOGLE)
8	2600:9000:215... 2600:9000:2156:1800:2:9275:3d40:93a1	16509 (AMAZON-02) (AMAZON-02)
12	2600:9000:20e... 2600:9000:20eb:4a00:0:5c46:4f40:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2606:2800:234... 2606:2800:234:46c:e8b:1e2f:2bd:694	15133 (EDGECAST) (EDGECAST)
7	2a00:1450:400... 2a00:1450:4001:821::2004	15169 (GOOGLE) (GOOGLE)
10	172.217.23.162 172.217.23.162	15169 (GOOGLE) (GOOGLE)
3	52.222.182.122 52.222.182.122	16509 (AMAZON-02) (AMAZON-02)
1 17	151.101.14.137 151.101.14.137	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81e::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
1 3	2620:116:800d... 2620:116:800d:21:51e4:db4b:4436:b305	16509 (AMAZON-02) (AMAZON-02)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1	2600:9000:209... 2600:9000:2093:3800:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
1	64.140.160.2 64.140.160.2	18450 (WEBNX) (WEBNX)
1	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f01... 2a03:2880:f01c:800e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	199.232.53.140 199.232.53.140	54113 (FASTLY) (FASTLY)
9	52.15.169.204 52.15.169.204	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
2 10	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
4	136.144.59.88 136.144.59.88	54825 (PACKET) (PACKET)
1	104.111.215.135 104.111.215.135	16625 (AKAMAI-AS) (AKAMAI-AS)
5	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	54.76.211.112 54.76.211.112	16509 (AMAZON-02) (AMAZON-02)
2 8	185.33.221.53 185.33.221.53	29990 (ASN-APPNEX) (ASN-APPNEX)
4	69.173.144.143 69.173.144.143	26667 (RUBICONPR...) (RUBICONPROJECT)
6 9	2606:2800:233... 2606:2800:233:97b6:26be:138a:cba8:bb01	15133 (EDGECAST) (EDGECAST)
2 3	72.251.249.13 72.251.249.13	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
1	165.227.252.242 165.227.252.242	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	52.28.149.230 52.28.149.230	16509 (AMAZON-02) (AMAZON-02)
12	18.203.131.207 18.203.131.207	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
2 6	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
2	18.197.185.70 18.197.185.70	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.136 104.244.42.136	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:4001:800::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
1 10	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:816::2001	15169 (GOOGLE) (GOOGLE)
2 5	151.101.130.49 151.101.130.49	54113 (FASTLY) (FASTLY)
3	34.95.120.147 34.95.120.147	15169 (GOOGLE) (GOOGLE)
3	185.148.48.55 185.148.48.55	23539 (TUBEMOGUL) (TUBEMOGUL)
11	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
9	93.184.221.64 93.184.221.64	15133 (EDGECAST) (EDGECAST)
3 6	142.250.74.198 142.250.74.198	15169 (GOOGLE) (GOOGLE)
3	151.101.113.108 151.101.113.108	54113 (FASTLY) (FASTLY)
3	2.18.233.180 2.18.233.180	16625 (AKAMAI-AS) (AKAMAI-AS)
3 7	52.28.254.214 52.28.254.214	16509 (AMAZON-02) (AMAZON-02)
2	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
1 1	216.58.206.2 216.58.206.2	15169 (GOOGLE) (GOOGLE)
2 3	34.249.135.160 34.249.135.160	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
1 2	54.93.138.105 54.93.138.105	16509 (AMAZON-02) (AMAZON-02)
1	2620:1ec:bdf::10 2620:1ec:bdf::10	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	23.37.42.132 23.37.42.132	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	206.189.254.17 206.189.254.17	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	205.185.216.10 205.185.216.10	20446 (HIGHWINDS3) (HIGHWINDS3)
1	37.157.4.29 37.157.4.29	198622 (ADFORM) (ADFORM)
1	2a02:fa8:8806... 2a02:fa8:8806:13::1430	41041 (VCLK-EU-) (VCLK-EU-)
259	65

18 35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com

threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 99.86.2.42 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-2-42.fra6.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:e6::ac40:c502 (United States)

ASN13335 (CLOUDFLARENET, US)

qd.admetricspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:2156:1800:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2600:9000:20eb:4a00:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:2800:234:46c:e8b:1e2f:2bd:694 (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:821::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 172.217.23.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s22-in-f162.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.222.182.122 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-182-122.ham50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 151.101.14.137 (Frankfurt am Main, Germany) 1 redirects

ASN54113 (FASTLY, US)

cd.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cds.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vid.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:51e4:db4b:4436:b305 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2093:3800:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.140.160.2 (Los Angeles, United States)

ASN18450 (WEBNX, US)
PTR: threatintelligenceplatform.com

geo.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.53.140 (United States)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 52.15.169.204 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-15-169-204.us-east-2.compute.amazonaws.com

capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 35.244.159.8 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

teachingaids-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 136.144.59.88 (United States)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.215.135 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-135.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.211.112 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-211-112.eu-west-1.compute.amazonaws.com

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 185.33.221.53 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.143 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:2800:233:97b6:26be:138a:cba8:bb01 (United States) 6 redirects

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 72.251.249.13 (Amsterdam, Netherlands) 2 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 165.227.252.242 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

e.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.28.149.230 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-149-230.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 18.203.131.207 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

s.srvsynd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2.18.234.21 (Ascension Island) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.197.185.70 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-185-70.eu-central-1.compute.amazonaws.com

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.136 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

a26a165e8e9d5dd7aa15809c2f2fe6a7.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:816::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.130.49 (United States) 2 redirects

ASN54113 (FASTLY, US)

displayf-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.95.120.147 (United States)

ASN15169 (GOOGLE, US)

ox-delivery-prod-1-europe-west1.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.148.48.55 (Netherlands)

ASN23539 (TUBEMOGUL, US)

rtb-lb-event-tm-ams-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 151.101.14.49 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

statsf-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 93.184.221.64 (London, United Kingdom)

ASN15133 (EDGECAST, US)

playtime.tubemogul.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.74.198 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.113.108 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.233.180 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-180.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 52.28.254.214 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.0.31 (United States)

ASN16509 (AMAZON-02, US)

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.2 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s20-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.249.135.160 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.93.138.105 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::10 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

public.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.37.42.132 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-42-132.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 206.189.254.17 (North Bergen, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

sync.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.10 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

serverbid-sync.nyc3.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.4.29 (Denmark)

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:13::1430 (Sweden)

ASN41041 (VCLK-EU-, SE)

aol-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
37	threatpost.com threatpost.com assets.threatpost.com media.threatpost.com	825 KB
26	connatix.com 1 redirects cd.connatix.com cds.connatix.com capi.connatix.com vid.connatix.com img.connatix.com	2 MB
19	everesttech.net 2 redirects displayf-tm.everesttech.net rtb-lb-event-tm-ams-tm.everesttech.net statsf-tm.everesttech.net sync-tm.everesttech.net	15 KB
19	doubleclick.net 5 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net ad.doubleclick.net cm.g.doubleclick.net	114 KB
18	advertising.com adserver-us.adtech.advertising.com Failed ads.adaptv.advertising.com pixel.advertising.com	8 KB
13	openx.net 2 redirects teachingaids-d.openx.net ox-delivery-prod-1-europe-west1.openx.net u.openx.net eu-u.openx.net	13 KB
12	srvsynd.com s.srvsynd.com	41 KB
11	googlesyndication.com a26a165e8e9d5dd7aa15809c2f2fe6a7.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	23 KB
11	adnxs.com 2 redirects ib.adnxs.com acdn.adnxs.com	6 KB
11	adlightning.com tagan.adlightning.com	252 KB
9	tubemogul.com playtime.tubemogul.com	215 KB
8	pubmatic.com hbopenbid.pubmatic.com ads.pubmatic.com	351 B
8	google.com www.google.com adservice.google.com	2 KB
8	twitter.com platform.twitter.com analytics.twitter.com syndication.twitter.com	35 KB
7	admetricspro.com qd.admetricspro.com	292 KB
6	googletagservices.com www.googletagservices.com	158 KB
5	rubiconproject.com fastlane.rubiconproject.com eus.rubiconproject.com	13 KB
4	casalemedia.com 2 redirects htlb.casalemedia.com as-sec.casalemedia.com ssum.casalemedia.com	2 KB
4	a-mo.net prebid.a-mo.net	1 KB
3	adsrvr.org 2 redirects match.adsrvr.org	1 KB
3	yahoo.com ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	3 KB
3	indexww.com js-sec.indexww.com
3	3lift.com 1 redirects tlx.3lift.com eb2.3lift.com	621 B
3	lijit.com 2 redirects ap.lijit.com	2 KB
3	quantserve.com 1 redirects secure.quantserve.com pixel.quantserve.com	9 KB
3	google-analytics.com www.google-analytics.com	18 KB
3	amazon-adsystem.com c.amazon-adsystem.com	32 KB
2	serverbid.com 1 redirects e.serverbid.com sync.serverbid.com	267 B
2	servenobid.com ads.servenobid.com public.servenobid.com	3 KB
2	google.de www.google.de adservice.google.de	274 B
1	dotomi.com aol-match.dotomi.com	104 B
1	adform.net c1.adform.net	187 B
1	digitaloceanspaces.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1	t.co t.co	448 B
1	reddit.com www.reddit.com	1 KB
1	linkedin.com www.linkedin.com
1	facebook.com graph.facebook.com	586 B
1	ipify.org geo.ipify.org	1 KB
1	quantcount.com rules.quantcount.com	356 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	gstatic.com www.gstatic.com	134 KB
1	googletagmanager.com www.googletagmanager.com	48 KB
1	kasperskycontenthub.com kasperskycontenthub.com	399 B
259	43

	Domain	Requested by
17	threatpost.com	threatpost.com
12	s.srvsynd.com	tagan.adlightning.com s.srvsynd.com
12	media.threatpost.com	threatpost.com
11	statsf-tm.everesttech.net	threatpost.com
11	vid.connatix.com	cd.connatix.com
11	tagan.adlightning.com	threatpost.com tagan.adlightning.com
10	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net threatpost.com
9	playtime.tubemogul.com	tagan.adlightning.com threatpost.com playtime.tubemogul.com
9	adserver-us.adtech.advertising.com	threatpost.com
9	capi.connatix.com	cd.connatix.com
8	ib.adnxs.com	2 redirects qd.admetricspro.com cds.connatix.com
8	assets.threatpost.com	threatpost.com assets.threatpost.com
7	pixel.advertising.com	3 redirects
7	www.google.com	threatpost.com tagan.adlightning.com
7	qd.admetricspro.com	threatpost.com qd.admetricspro.com
6	ad.doubleclick.net	3 redirects
6	tpc.googlesyndication.com	tagan.adlightning.com
6	platform.twitter.com	threatpost.com tagan.adlightning.com platform.twitter.com
6	www.googletagservices.com	threatpost.com tagan.adlightning.com securepubads.g.doubleclick.net
5	hbopenbid.pubmatic.com	qd.admetricspro.com cds.connatix.com
5	teachingaids-d.openx.net	qd.admetricspro.com cds.connatix.com
4	u.openx.net	2 redirects cds.connatix.com
4	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
4	fastlane.rubiconproject.com	qd.admetricspro.com
4	prebid.a-mo.net	qd.admetricspro.com
3	match.adsrvr.org	2 redirects
3	ads.pubmatic.com	cds.connatix.com qd.admetricspro.com
3	js-sec.indexww.com	cds.connatix.com qd.admetricspro.com
3	acdn.adnxs.com	cds.connatix.com qd.admetricspro.com
3	rtb-lb-event-tm-ams-tm.everesttech.net	tagan.adlightning.com
3	ox-delivery-prod-1-europe-west1.openx.net	tagan.adlightning.com
3	displayf-tm.everesttech.net	tagan.adlightning.com
3	ap.lijit.com	2 redirects qd.admetricspro.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com threatpost.com
3	cds.connatix.com	threatpost.com tagan.adlightning.com cd.connatix.com
3	c.amazon-adsystem.com	qd.admetricspro.com c.amazon-adsystem.com
2	ssum.casalemedia.com	2 redirects
2	eb2.3lift.com	1 redirects qd.admetricspro.com
2	cm.g.doubleclick.net	2 redirects
2	ups.analytics.yahoo.com
2	sync-tm.everesttech.net	2 redirects
2	ads.adaptv.advertising.com	cds.connatix.com
2	pixel.quantserve.com	1 redirects threatpost.com
2	img.connatix.com	threatpost.com
1	aol-match.dotomi.com
1	c1.adform.net
1	serverbid-sync.nyc3.cdn.digitaloceanspaces.com	qd.admetricspro.com
1	sync.serverbid.com	1 redirects
1	eus.rubiconproject.com	qd.admetricspro.com
1	public.servenobid.com	qd.admetricspro.com
1	eu-u.openx.net	qd.admetricspro.com
1	pr-bh.ybp.yahoo.com
1	a26a165e8e9d5dd7aa15809c2f2fe6a7.safeframe.googlesyndication.com	tagan.adlightning.com
1	adservice.google.com	tagan.adlightning.com
1	adservice.google.de	tagan.adlightning.com
1	syndication.twitter.com
1	as-sec.casalemedia.com	cds.connatix.com
1	analytics.twitter.com	tagan.adlightning.com
1	tlx.3lift.com	qd.admetricspro.com
1	e.serverbid.com	qd.admetricspro.com
1	ads.servenobid.com	qd.admetricspro.com
1	htlb.casalemedia.com	qd.admetricspro.com
1	t.co	threatpost.com
1	www.google.de	threatpost.com
1	www.reddit.com	threatpost.com
1	www.linkedin.com	threatpost.com
1	graph.facebook.com	threatpost.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	geo.ipify.org	qd.admetricspro.com
1	rules.quantcount.com	secure.quantserve.com
1	static.ads-twitter.com	www.googletagmanager.com
1	secure.quantserve.com	www.googletagmanager.com
1	www.gstatic.com	www.google.com
1	www.googletagmanager.com	threatpost.com
1	kasperskycontenthub.com	threatpost.com
1	cd.connatix.com	1 redirects
259	76

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
feedly.com
www.instagram.com
goodereader.com
akismet.com
t.co
indd.adobe.com
spotlight.threatpost.com

Subject Issuer	Validity	Valid
threatpost.com DigiCert SHA2 Secure Server CA	`2020-06-10` - `2021-06-15`	a year	crt.sh
*.adlightning.com Amazon	`2020-07-22` - `2021-08-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-10` - `2021-08-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
assets.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
media.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2019-11-12` - `2020-11-18`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
*.connatix.com Go Daddy Secure Certificate Authority - G2	`2020-09-29` - `2021-10-19`	a year	crt.sh
kasperskycontenthub.com DigiCert SHA2 Secure Server CA	`2020-06-01` - `2021-06-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.ipify.org COMODO RSA Domain Validation Secure Server CA	`2018-01-24` - `2021-01-23`	3 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2020-10-02` - `2021-04-02`	6 months	crt.sh
*.reddit.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-02-22`	6 months	crt.sh
www.google.de GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
*.a-mo.net Let's Encrypt Authority X3	`2020-10-07` - `2021-01-05`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
*.servenobid.com Amazon	`2020-03-12` - `2021-04-12`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.adtech.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2020-03-11` - `2021-05-10`	a year	crt.sh
e.serverbid.com Let's Encrypt Authority X3	`2020-09-18` - `2020-12-17`	3 months	crt.sh
*.3lift.com Amazon	`2020-07-04` - `2021-08-05`	a year	crt.sh
Sectigo RSA Domain Validation Secure Server CA	`2020-08-21` - `2021-02-10`	6 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-07-29` - `2021-01-25`	6 months	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
g2.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-18` - `2021-04-25`	6 months	crt.sh
*.tmogul.com DigiCert SHA2 Secure Server CA	`2020-07-14` - `2022-07-19`	2 years	crt.sh
*.tubemogul.com DigiCert SHA2 Secure Server CA	`2020-04-07` - `2022-05-19`	2 years	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
cdn.adnxs.com GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-06` - `2021-04-14`	6 months	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-05-27` - `2020-11-23`	6 months	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2020-10-04` - `2021-03-31`	6 months	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-06-02` - `2020-11-29`	6 months	crt.sh
public.servenobid.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-08-25`	a year	crt.sh
*.nyc3.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh

This page contains 33 frames:

Primary Page: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Frame ID: E526E0E54D84D618C357BF95C89A9723
Requests: 130 HTTP requests in this frame

Frame: https://cds.connatix.com/p/68605/connatix.player.dc.js
Frame ID: E218C70BF10EBB7F3BB96FDA4E9803A8
Requests: 40 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fthreatpost.com
Frame ID: 2607D2DBE93EADCFCFC3ED873EF8A355
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&theme=standard&size=normal&cb=jinghziip9gg
Frame ID: 4E5DBAD8D780E7946755A6A5859E68A5
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&theme=light&size=normal&cb=7lfy5git43ym
Frame ID: D1A7A50E358345A298D9DC04B2D0AFE4
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/follow_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Frame ID: D84D8ABF03D01968CB68659245F8E5DB
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/index.html?creatorScreenName=threatpost&dnt=true&embedId=twitter-widget-1&frame=false&hideCard=false&hideThread=false&id=1316704190010396673&lang=en&origin=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&siteScreenName=threatpost&theme=light&widgetsVersion=ed20a2b%3A1601588405575&width=500px
Frame ID: 2121802D27AA3A5D90C02348AF237B70
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=115h1rt5dmcc
Frame ID: 9499B37741F22E729C46A6991A516455
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=lll98xmfia41
Frame ID: BAF244CC061D2A70916CFB49B6B63373
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-d751150c.js
Frame ID: 0B86588C901C87B4A813ED9FE65865AC
Requests: 11 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-d751150c.js
Frame ID: D545D4BC4884BA9F951999A904750720
Requests: 11 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-d751150c.js
Frame ID: D8C81250F8EE90638951E6723C346992
Requests: 10 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-d751150c.js
Frame ID: A7C2CA759784F98C513F334B6ECC80CF
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/218/runner.html
Frame ID: F5A02A146F1A88E45695EA8A8BB9B1BA
Requests: 1 HTTP requests in this frame

Frame: https://playtime.tubemogul.com/ud/prod/ad_plugins/release/display-20200422.js?auction_id=688e6f86-21c9-45c3-88a9-f595b9c971e4.1
Frame ID: 311E55C70583BD48577B3A25E60BD417
Requests: 7 HTTP requests in this frame

Frame: https://playtime.tubemogul.com/ud/prod/ad_plugins/release/display-20200422.js?auction_id=395dac77-3868-4341-8481-6f97381fceb3.1
Frame ID: 763AEA334C20941CA1CBAC8E95E6EEE9
Requests: 7 HTTP requests in this frame

Frame: https://playtime.tubemogul.com/ud/prod/ad_plugins/release/display-20200422.js?auction_id=5a42b701-f33d-4eb7-bbda-6b4f5f6db3ca.1
Frame ID: A2D849264AAD77B7718D6B7C111D1219
Requests: 6 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: CA51A85FA90799E9016DCA2640D91718
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?cc=1
Frame ID: 017DD82384856B798D8CCC8A9F850A97
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 933585024772465CE9CCDB39DD0D952F
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 70DED399C60854F3E663E848C792DBF4
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?cc=1
Frame ID: 3BBA9E64F035AED619AED71995879EC0
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 65F5D5C19E82605DC6AB268C88EA996E
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 8297B3419933085A7C69F1C081B8BB4D
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 1B64D82B0C8FFBCAB3BCA00A8A422966
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 553EEF2D6BBB8FE799E1A8E77E5388DA
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 5229ABC08B4C677C2EF4D08AFCFE7ACD
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: DCE9AED9FC67BB1D1744F7EC58922F40
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: 6B5C25BDC7108D6E238E1C7620E600FC
Requests: 1 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 0CF1C1355DEDC69789A72E0A24AA6F4D
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: AD7D7753459A6B4E42A9FCB00971F856
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 52762DBECC6ED08D7E54D100A2654B20
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 89B4CEC03F570EB2A8D64C24DC62EDB0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Page Statistics

259
Requests

96 %
HTTPS

36 %
IPv6

43
Domains

76
Subdomains

65
IPs

9
Countries

3836 kB
Transfer

8066 kB
Size

5
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/threatpost/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/threatpost

Search URL Search Domain Scan URL

URL: https://feedly.com/threatpost

Search URL Search Domain Scan URL

URL: https://www.instagram.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://twitter.com/nookBN/status/1316406326898102273
Title: Nook e-reader service being taken offline

Search URL Search Domain Scan URL

URL: https://goodereader.com/blog/barnes-and-noble-nook-ereader-news/barnes-and-noble-nook-syncing-systems-are-down
Title: an e-reader blog

Search URL Search Domain Scan URL

URL: https://twitter.com/candii_cam/status/1316613793946853376
Title: late-night email notices

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23Pfizer
Title: #Pfizer

Search URL Search Domain Scan URL

URL: https://t.co/tlkFtO78VY
Title: https://t.co/tlkFtO78VY

Search URL Search Domain Scan URL

URL: https://indd.adobe.com/view/01579c19-a6ca-4cb0-8106-ed4d5d02a292
Title: Advertise With Us

Search URL Search Domain Scan URL

URL: https://spotlight.threatpost.com/
Title: HackerOne Spotlight

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

https://cd.connatix.com/connatix.player.js HTTP 302
https://cds.connatix.com/p/68605/connatix.player.dc.js

Request Chain 91

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5757b8a8adb0631;misc=1603249236388; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1603249235;v=2;cmd=bid;cors=yes;alias=5757b8a8adb0631;misc=1603249236388 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A98429974-1349-11eb-a249-12e1ea48904a;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=5757b8a8adb0631;misc=1603249236388

Request Chain 92

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=58ab6d214ecd838;misc=1603249236389; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=58ab6d214ecd838;misc=1603249236389 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A981943c6-1349-11eb-8fbe-120f1417a350;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=58ab6d214ecd838;misc=1603249236389

Request Chain 93

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5976d28b140ef96;misc=1603249236389; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=5976d28b140ef96;misc=1603249236389 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A981951e0-1349-11eb-a7df-1204ea82ed4e;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=5976d28b140ef96;misc=1603249236389

Request Chain 94

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=608a22ceaf3a146;misc=1603249236389; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=608a22ceaf3a146;misc=1603249236389 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A984186e2-1349-11eb-93a5-12d220623a1c;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=608a22ceaf3a146;misc=1603249236389

Request Chain 95

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=619298acdcd12e7;misc=1603249236389; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=619298acdcd12e7;misc=1603249236389 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A98197d50-1349-11eb-aa26-1249c31fdca2;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=619298acdcd12e7;misc=1603249236389

Request Chain 190

https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238575;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_pre=CKblo-vYxOwCFc_Fuwgd0NoBYg;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238575;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D

Request Chain 195

https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238614;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_pre=CKjno-vYxOwCFSuAgwcdmckHNg;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238614;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D

Request Chain 201

https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238676;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_pre=CNvpo-vYxOwCFUSIOAodUywJ-Q;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238676;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D

Request Chain 214

https://u.openx.net/w/1.0/pd HTTP 302
https://u.openx.net/w/1.0/pd?cc=1

Request Chain 217

https://u.openx.net/w/1.0/pd HTTP 302
https://u.openx.net/w/1.0/pd?cc=1

Request Chain 221

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=X4_kWAAAAHGB1zLL HTTP 302
https://pixel.advertising.com/ups/55986/sync?uid=X4_kWAAAAHGB1zLL&_origin=0&gdpr=0&gdpr_consent=&_test=X4_kWAAAAHGB1zLL HTTP 302
https://pixel.advertising.com/ups/55986/sync?uid=X4_kWAAAAHGB1zLL&_origin=0&gdpr=0&gdpr_consent=&_test=X4_kWAAAAHGB1zLL&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X4_kWAAAAHGB1zLL&_origin=0&gdpr=0&gdpr_consent=&_test=X4_kWAAAAHGB1zLL&apid=UP9a44e9df-1349-11eb-8a35-06f064b6781c

Request Chain 222

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEISIfWuhsa0mJFhy_6lEbbg&google_cver=1 HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEISIfWuhsa0mJFhy_6lEbbg&google_cver=1&apid=UP9a44e9df-1349-11eb-8a35-06f064b6781c

Request Chain 223

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://pixel.advertising.com/ups/55953/sync?uid=aaf800f2-dc58-45fd-a68d-a390db7a2db6&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=aaf800f2-dc58-45fd-a68d-a390db7a2db6

Request Chain 228

https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 235

https://sync.serverbid.com/ss/2000891.html HTTP 302
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Request Chain 237

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c3b87b9-a134-4b00-9459-e9d5d8afe79e%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253D4c3b87b9-a134-4b00-9459-e9d5d8afe79e%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID HTTP 302
https://prebid.a-mo.net/setuid?A=4c3b87b9-a134-4b00-9459-e9d5d8afe79e&D=&bidder=appnexus&uid=6236909604407324210

Request Chain 239

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=hHo5aNAoNDacfzhogSwsbIN9OTmcfzk4hyV3Vp5d

Request Chain 242

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_hm=MUE5ODE5N2Q1MC0xMzQ5LTExZWItYWEyNi0xMjQ5YzMxZmRjYTI%3D&gdpr=1&gdpr_consent=&_origin=0 HTTP 302
https://pixel.advertising.com/ups/55946/sync?uid=CAESEIbVbL_Z8IjERUHKa-2YaLo&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

Request Chain 243

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c3b87b9-a134-4b00-9459-e9d5d8afe79e%26D%3D%26bidder%3Dindex_rtb%26uid%3D HTTP 302
https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c3b87b9-a134-4b00-9459-e9d5d8afe79e%26D%3D%26bidder%3Dindex_rtb%26uid%3D&C=1 HTTP 302
https://prebid.a-mo.net/setuid?A=4c3b87b9-a134-4b00-9459-e9d5d8afe79e&D=&bidder=index_rtb&uid=X4.kXLlQJLcAAHZFJ2IAAABI%26698

Request Chain 244

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c3b87b9-a134-4b00-9459-e9d5d8afe79e%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID HTTP 307
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c3b87b9-a134-4b00-9459-e9d5d8afe79e%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID&sovrn_retry=true HTTP 307
https://prebid.a-mo.net/setuid?A=4c3b87b9-a134-4b00-9459-e9d5d8afe79e&D=&bidder=sovrn&uid=7de0e4fa93dafcadc7953f2f

259 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
threatpost.com/barnes-noble-hack-phishers-crooks/160148/ 82 KB
22 KB 537ms
204ms Document
text/html 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

c327074d7cae47927f1a0814e6dbdfb01d26bf5ffd9c5a6f75bcefd695e39de4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: threatpost.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx
Date: Wed, 21 Oct 2020 03:00:33 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Link: <https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/wp-json/wp/v2/posts/160148>; rel="alternate"; type="application/json" <https://threatpost.com/?p=160148>; rel=shortlink
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: threatpost.com
x-cache-hit: HIT
Content-Encoding: gzip

GET
H/1.1 200
OK main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/ 253 KB
39 KB 429ms
205ms Stylesheet
text/css 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:34 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Oct 2020 08:06:05 GMT
Server: nginx
ETag: W/"5f8d48ed-3f2b8"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 28 Oct 2020 03:00:34 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/math-aids-threatpost/ 37 KB
13 KB 116ms
35ms Script
application/javascript 99.86.2.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-42.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2479627ad80abb56e0e670a073899c3310b76452f26cf0a5ad1a20454169191b

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: R6WrVWvUoYGdYs8MOKKs5qvHDOAOs1FE
content-encoding: gzip
etag: "678799b826b94cdee16d0cd51c978978"
age: 1817
x-cache: Hit from cloudfront
status: 200
content-length: 13351
x-amz-meta-git_commit: 9a4f7ce
last-modified: Wed, 21 Oct 2020 00:29:29 GMT
server: AmazonS3
date: Wed, 21 Oct 2020 02:30:17 GMT
content-type: application/javascript
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
x-amz-cf-id: AInfa6NRs-nUGCK_m8WaGNOzap9iTCGzePmQL-aAs9skq-uraNJDug==

GET
H2 200 ros-layout.js Show response
qd.admetricspro.com/js/threatpost/ 22 KB
3 KB 606ms
577ms Script
application/javascript 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:34 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05eab2f7ee000006104a3cb000000001
last-modified: Thu, 06 Aug 2020 02:14:13 GMT
server: cloudflare
etag: W/"579e-5ac2c0b6aa2e7-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603249234"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e57ba9fed1c0610-FRA
expires: Wed, 21 Oct 2020 03:01:28 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 52 KB
17 KB 19ms
14ms Script
text/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0727068cb5fb8e5af5d0df7d0331408939337a141048d30f38162468e0898fbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "669 / 28 of 1000 / last-modified: 1603232041"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=10800
timing-allow-origin: *
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 17650
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:33 GMT

GET
H2 200 cmp.js Show response
qd.admetricspro.com/js/threatpost/ 305 KB
82 KB 606ms
578ms Script
application/javascript 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73339d824e344121a3039b2e0e9c9353fb8132e005bb6d53249814c213520d5d

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:34 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05eab2f7ee0000061068897000000001
last-modified: Tue, 06 Oct 2020 19:53:29 GMT
server: cloudflare
etag: W/"4c426-5b105f3f297c7-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603249234"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e57ba9fed220610-FRA
expires: Wed, 21 Oct 2020 03:09:33 GMT

GET
H2 200 uspcmp.js Show response
qd.admetricspro.com/js/threatpost/ 148 KB
55 KB 600ms
572ms Script
application/javascript 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:34 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05eab2f7ee00000610751a7000000001
last-modified: Sat, 08 Aug 2020 22:40:07 GMT
server: cloudflare
etag: W/"24e50-5ac65673cef1c-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603249234"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e57ba9fed240610-FRA
expires: Wed, 21 Oct 2020 03:10:33 GMT

GET
H2 200 targeting.js Show response
qd.admetricspro.com/js/threatpost/ 275 B
711 B 185ms
157ms Script
application/javascript 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:34 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05eab2f7ef000006106b1bb000000001
last-modified: Sat, 08 Feb 2020 20:49:18 GMT
server: cloudflare
etag: W/"113-59e16a3cfb471-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603249234"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e57ba9fed250610-FRA
expires: Wed, 21 Oct 2020 03:10:33 GMT

GET
H2 200 prebid.js Show response
qd.admetricspro.com/js/threatpost/ 399 KB
113 KB 611ms
583ms Script
application/javascript 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:34 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05eab2f7ef00000610381f5000000001
last-modified: Fri, 02 Oct 2020 04:32:28 GMT
server: cloudflare
etag: W/"63c0e-5b0a89ec6a525-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603249234"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e57ba9fed260610-FRA
expires: Wed, 21 Oct 2020 03:10:33 GMT

GET
H2 200 engine.js Show response
qd.admetricspro.com/js/threatpost/ 28 KB
8 KB 191ms
164ms Script
application/javascript 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/engine.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 747a03fee397ff9cf8a76308966b2cc28f4dd00160af7610bc81ccfcb2836fab

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:34 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05eab2f7ef0000061042b2f000000001
last-modified: Fri, 09 Oct 2020 03:25:52 GMT
server: cloudflare
etag: W/"6e56-5b1348179d4a3-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603249234"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e57ba9fed290610-FRA
expires: Wed, 21 Oct 2020 03:10:33 GMT

GET
H2 200 /
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 89 KB
18 KB 304ms
274ms Stylesheet
text/css 2600:9000:2156:1800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=5138f213

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

392cc23864e1d5ec27dc6db139581ea3da476624b962fb3b1f866248f554ae64

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:34 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 18335
x-cache-hit: HIT
last-modified: Mon, 19 Oct 2020 08:06:08 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: z2BhRBzDls0C1SLGH0ksrjSRNq192Dta1LL4XRsrVz6NDD3cBatG_Q==
expires: Wed, 21 Oct 2020 18:39:44 GMT

GET
H/1.1 200
OK jquery.js Show response
threatpost.com/wp-includes/js/jquery/ 95 KB
37 KB 348ms
118ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Sep 2020 19:07:35 GMT
Server: nginx
ETag: W/"5f4e9bf7-17a69"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 28 Oct 2020 03:00:34 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 177 KB
55 KB 303ms
273ms Script
application/x-javascript 2600:9000:2156:1800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=5138f213

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:34 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 56256
x-cache-hit: HIT
last-modified: Mon, 19 Oct 2020 08:06:08 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: HV0FswdVxSSKiq1UolyvCTUtURtEiQLxfdyOEuJh9ztWD_8e_g2aGA==
expires: Wed, 21 Oct 2020 18:39:42 GMT

GET
H2 200 Barnes-and-Noble2-e1602769388402.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/10/15094255/ 87 KB
87 KB 60ms
13ms Image
image/jpeg 2600:9000:20eb:4a00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/15094255/Barnes-and-Noble2-e1602769388402.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d60e5823c29324b4ace1b82980e97b3a8f5bbe2d630712287d3c539076b72d3c

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 15 Oct 2020 13:57:16 GMT
via: 1.1 49e78dae34a1d21beb31b4002f7ce92e.cloudfront.net (CloudFront), 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
last-modified: Thu, 15 Oct 2020 13:43:09 GMT
server: AmazonS3
age: 479000
etag: "1956980dfda970796be1714471c224c2"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA2-C1
accept-ranges: bytes
content-length: 88890
x-amz-cf-id: fsGTEzmb_JHu-qKnNkshKmk0A1Uzlbfjq_WV0oArQvVb_FNTIWJ5ZA==
expires: Fri, 15 Oct 2021 13:43:08 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 29ms
6ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/41A1) /
Resource Hash: 2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 21 Oct 2020 03:00:35 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 26
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Content-Length: 28698
x-tw-cdn: VZ
Last-Modified: Thu, 01 Oct 2020 21:52:09 GMT
Server: ECS (fcn/41A1)
Etag: "a671d4d584ef50954e5cebb21da17065+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
728 B 15ms
15ms Script
text/javascript 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

fe00a828c8984aa432d60646922198377e78dba43b704e73ab70d1fd4b9458e9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 554
x-xss-protection: 1; mode=block
expires: Wed, 21 Oct 2020 03:00:34 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 272ms
272ms Script
application/x-javascript 2600:9000:2156:1800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=5138f213

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:34 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 926
x-cache-hit: HIT
last-modified: Mon, 19 Oct 2020 08:06:03 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: Ydt3q25B8kgWI2ocPvdEt3N0r4KYgJpyZdtUtGAFmmdKsRI_5lx6xw==
expires: Wed, 21 Oct 2020 18:39:44 GMT

GET
H/1.1 200
OK gravityforms.min.js Show response
threatpost.com/wp-content/plugins/gravityforms/js/ 34 KB
12 KB 326ms
109ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:35 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Oct 2020 08:06:06 GMT
Server: nginx
ETag: W/"5f8d48ee-88c2"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 28 Oct 2020 03:00:35 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 7 KB
3 KB 273ms
273ms Script
application/x-javascript 2600:9000:2156:1800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=5138f213

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:35 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 2685
x-cache-hit: HIT
last-modified: Mon, 19 Oct 2020 08:06:03 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: EtvR_jlssIW0MASvV6ZFjUIbG4AsyuBLN6TqsGOg3oFOStKNpMzgGQ==
expires: Wed, 21 Oct 2020 18:39:42 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 5 KB
2 KB 272ms
272ms Script
application/x-javascript 2600:9000:2156:1800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=5138f213

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:35 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 1747
x-cache-hit: HIT
last-modified: Mon, 19 Oct 2020 08:06:06 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: bJRU7kHCtJGfI3UsM3WzGZcaALdWZH6cI0gKTlld6rPYdG-0wEtixA==
expires: Wed, 21 Oct 2020 18:39:45 GMT

GET
H3-Q050 200 api.js Show response
www.google.com/recaptcha/ 852 B
971 B 38ms
22ms Script
text/javascript 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.5.1

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

db26d6c8b9587ef47481a29cf0980a5573a3bb19a83bd6e74bdbec7b049f4c22

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 555
x-xss-protection: 1; mode=block
expires: Wed, 21 Oct 2020 03:00:35 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 275ms
273ms Script
application/x-javascript 2600:9000:2156:1800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=5138f213

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:35 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 973
x-cache-hit: HIT
last-modified: Tue, 01 Sep 2020 19:07:35 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: VUap3UWCnf3iJkEbF2RIqqxu_X3x9ezdNIi0Pd71Uw-YN_DWx3drSw==
expires: Wed, 21 Oct 2020 18:39:51 GMT

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ 61 KB
21 KB 41ms
39ms Script
application/javascript 99.86.2.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-42.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 11 Oct 2020 18:00:05 GMT
content-encoding: gzip
age: 810031
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: ikvLPonrUiKoqotQYLmAktBSa5BrI0XCyN1_gTIf1riLtgxNiALnCw==

GET
H2 200 bl-04a3385-d751150c.js Show response
tagan.adlightning.com/math-aids-threatpost/ 94 KB
27 KB 41ms
39ms Script
application/javascript 99.86.2.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-d751150c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-42.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9f77bf6ecbc06589bf03b9b673dec4cd51648ed1200ff242a6b53530b2cbccf5

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:32:58 GMT
content-encoding: gzip
age: 8858
x-cache: Hit from cloudfront
status: 200
content-length: 27159
x-amz-meta-git_commit: 04a3385
last-modified: Wed, 21 Oct 2020 00:29:10 GMT
server: AmazonS3
etag: "153e5781d1abd9808988bbfad02fc43e"
x-amz-version-id: H3e_7cWHLkRgnk8h19cVrYjzyOS4Zz7b
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 8RkwiudtUMUA2omZmqYwDPzaenGccNi23O3VYeiMPx6zuTZJ9uTKjQ==

GET
H2 200 pubads_impl_2020101501.js Show response
securepubads.g.doubleclick.net/gpt/ 272 KB
96 KB 554ms
187ms Script
text/javascript 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

sffe /

Resource Hash

81769ec6be856e69d17c22fdbf79b9e05b7c0ece06edc79db4114a8567298643

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 21 Oct 2020 03:00:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 15 Oct 2020 08:42:23 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97658
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:35 GMT

GET
H2 200 vendor-list.json Show response
qd.admetricspro.com/js/cmp2/ 286 KB
31 KB 209ms
193ms XHR
application/json 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:35 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05eab2fdfb0000e00707bab000000001
last-modified: Tue, 06 Oct 2020 19:31:27 GMT
server: cloudflare
etag: W/"4773b-5b105a5302c6b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603249236"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=600
cf-ray: 5e57baa98d8de007-FRA
expires: Wed, 21 Oct 2020 03:10:35 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 109 KB
28 KB 122ms
41ms Script
application/javascript 52.222.182.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.182.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-122.ham50.r.cloudfront.net
Software: Server /
Resource Hash: 5876f68bf30a82eb99d9ec29e561f5c925ea347243c3e022021dd87823c65813

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 20 Oct 2020 18:11:15 GMT
content-encoding: gzip
server: Server
age: 31760
etag: 0ef1f140246b7e0337b522d7332711d3
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: Ijc2EpR1vbaV_mwqOyRGVlApnPZ1QhiTpKuVzyN-vIhKNjRimqOdTw==
via: 1.1 9ed78f83b2bb44dc950eb2bc8dff85f0.cloudfront.net (CloudFront)

GET
H2

200

connatix.player.dc.js Show response
cds.connatix.com/p/68605/ Frame E218
Redirect Chain

https://cd.connatix.com/connatix.player.js
https://cds.connatix.com/p/68605/connatix.player.dc.js

889 KB
219 KB

32ms
30ms

Script
application/javascript

151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/68605/connatix.player.dc.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 7f193a9fbb3d85615c9b3c7e4df23a99bec5c65e38f189b8db86ecedd1e8a2ad

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:35 GMT
content-encoding: gzip
age: 70101
x-cache: HIT, HIT
status: 200
content-length: 224118
x-served-by: cache-dca17770-DCA, cache-fra19170-FRA
access-control-allow-origin: *
last-modified: Mon, 19 Oct 2020 15:29:28 GMT
x-timer: S1603249236.661682,VS0,VE0
etag: "dd885f33f03582efd079aafcaf0d5038"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 3849

Redirect headers

date: Wed, 21 Oct 2020 03:00:35 GMT
via: 1.1 varnish
server: Varnish
age: 0
x-served-by: cache-fra19170-FRA
status: 302
x-cache: HIT
location: https://cds.connatix.com/p/68605/connatix.player.dc.js
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
x-timer: S1603249236.560179,VS0,VE0
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1 200
OK / Show response
kasperskycontenthub.com/ 0
399 B 539ms
192ms Script
application/javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=605137270&back=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 21 Oct 2020 03:00:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/javascript
x-cache-hit: MISS
Transfer-Encoding: chunked
X-Debug-Auth: off
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Request-Host: kasperskycontenthub.com
X-XSS-Protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 151 KB
48 KB 17ms
15ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

78d192cb8942beb5e6c66cc55fbe3757c3d02577b9ed2cfcb6dadb931346dd76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:35 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49149
x-xss-protection: 0
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 21 Oct 2020 03:00:35 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 13 KB
5 KB 773ms
112ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Oct 2020 08:06:03 GMT
Server: nginx
ETag: W/"5f8d48eb-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 28 Oct 2020 03:00:36 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 13 KB
5 KB 827ms
160ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Oct 2020 08:06:03 GMT
Server: nginx
ETag: W/"5f8d48eb-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 28 Oct 2020 03:00:36 GMT

GET
H/1.1 200
OK logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 19 KB
19 KB 888ms
224ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:36 GMT
Last-Modified: Mon, 19 Oct 2020 08:06:03 GMT
Server: nginx
ETag: "5f8d48eb-4a32"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 18994
Expires: Wed, 28 Oct 2020 03:00:36 GMT

GET
H/1.1 200
OK museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 307ms
109ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:35 GMT
Last-Modified: Mon, 19 Oct 2020 08:06:08 GMT
Server: nginx
ETag: "5f8d48f0-51a4"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20900
Expires: Thu, 21 Oct 2021 03:00:35 GMT

GET
H/1.1 200
OK museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 320ms
108ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:35 GMT
Last-Modified: Mon, 19 Oct 2020 08:06:08 GMT
Server: nginx
ETag: "5f8d48f0-50c8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20680
Expires: Thu, 21 Oct 2021 03:00:35 GMT

GET
H/1.1 200
OK museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 327ms
112ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:35 GMT
Last-Modified: Mon, 19 Oct 2020 08:06:08 GMT
Server: nginx
ETag: "5f8d48f0-51b8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20920
Expires: Thu, 21 Oct 2021 03:00:35 GMT

GET
H/1.1 200
OK museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 337ms
112ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:35 GMT
Last-Modified: Mon, 19 Oct 2020 08:06:03 GMT
Server: nginx
ETag: "5f8d48eb-5194"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20884
Expires: Thu, 21 Oct 2021 03:00:35 GMT

GET
H/1.1 200
OK museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 15 KB
16 KB 335ms
112ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:35 GMT
Last-Modified: Mon, 19 Oct 2020 08:06:08 GMT
Server: nginx
ETag: "5f8d48f0-3dcc"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 15820
Expires: Thu, 21 Oct 2021 03:00:35 GMT

GET
H/1.1 200
OK museosans-300italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 23 KB
23 KB 367ms
206ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:35 GMT
Last-Modified: Mon, 19 Oct 2020 08:06:05 GMT
Server: nginx
ETag: "5f8d48ed-5bac"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 23468
Expires: Thu, 21 Oct 2021 03:00:35 GMT

GET
H2 200 Tara-headshot.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/ 13 KB
13 KB 12ms
7ms Image
image/jpeg 2600:9000:20eb:4a00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/Tara-headshot.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 00:04:39 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront), 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
last-modified: Fri, 17 Aug 2018 16:22:08 GMT
server: AmazonS3
age: 1738557
etag: "dee18dfeea6de13bec60c1e5237eb723"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 13097
x-amz-cf-id: BO88YQdHpMBfrEHreETDhldbEABm1yiFKz1TEiJPhzbMDRtNQvAmcA==
expires: Sat, 17 Aug 2019 16:22:07 GMT

GET
H2 200 subscribe2.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/ 8 KB
9 KB 12ms
8ms Image
image/jpeg 2600:9000:20eb:4a00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 08:11:35 GMT
via: 1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront), 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
last-modified: Tue, 19 Feb 2019 20:14:58 GMT
server: AmazonS3
age: 2486941
etag: "5ba45563f793f39ef6baf02645651654"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 8281
x-amz-cf-id: dAKI16h_l4-IaKz9FVxAEDEeNIdI6rDcMZeqlpWM2VHe7bnlPuBt5g==
expires: Wed, 19 Feb 2020 20:14:57 GMT

GET
H2 200 Barnes-and-Noble-300x218.png
media.threatpost.com/wp-content/uploads/sites/103/2020/10/15092649/ 55 KB
55 KB 22ms
18ms Image
image/png 2600:9000:20eb:4a00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/15092649/Barnes-and-Noble-300x218.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dd23262003e6e02632ce21ad378415b54ca35487e4babb3559a357ab43c169f4

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 15 Oct 2020 13:58:26 GMT
via: 1.1 f038e7175be9761825b2eefc2b0a832e.cloudfront.net (CloudFront), 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
last-modified: Thu, 15 Oct 2020 13:26:50 GMT
server: AmazonS3
age: 478930
etag: "b79c763434b633231720805a33f97ef9"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA2-C1
accept-ranges: bytes
content-length: 55856
x-amz-cf-id: IqnQOeXExNjOfpdngvyFWOzwcDHjYg6KUcBlMm4FK5bNIf1hnkTJ1Q==
expires: Fri, 15 Oct 2021 13:26:49 GMT

GET
H2 200 drugs-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/10/20115540/ 21 KB
22 KB 12ms
9ms Image
image/jpeg 2600:9000:20eb:4a00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/20115540/drugs-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dab8633fc2faa7b14bf368bccf7713f5f80d50d7f7a00efe40ed4034f0c9a0cc

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 20 Oct 2020 16:23:21 GMT
via: 1.1 d0be2eec997f966c9c7eb03ae2f75c30.cloudfront.net (CloudFront), 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
last-modified: Tue, 20 Oct 2020 15:55:55 GMT
server: AmazonS3
age: 38235
etag: "73e9958fc468395124715d38cc5cb179"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA2-C1
accept-ranges: bytes
content-length: 21578
x-amz-cf-id: vsWM7wT3uei7miSKhjuFsoUw2XWfS6044pOG_Qophmeu4gqlOR_3TQ==
expires: Wed, 20 Oct 2021 15:55:52 GMT

GET
H2 200 safari-540x270.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2020/10/19165134/ 23 KB
23 KB 14ms
11ms Image
image/jpeg 2600:9000:20eb:4a00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/19165134/safari-540x270.jpeg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ac288c5485ce485a00c71d652e7ce84ac2c4c6aa573cab4bd1b40e19e99fb2a9

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 20 Oct 2020 13:00:40 GMT
via: 1.1 c26b8e74df43cd99786e716221463d0c.cloudfront.net (CloudFront), 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
last-modified: Mon, 19 Oct 2020 20:51:37 GMT
server: AmazonS3
age: 50395
etag: "031b06a80eaddb83e766adaf574594c9"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA2-C1
accept-ranges: bytes
content-length: 23350
x-amz-cf-id: r5f_gnTprBiGujUHqCLBbvfK_tw2AmqF_KXeyv6YkMKQG0bBP0MZ4A==
expires: Tue, 19 Oct 2021 20:51:36 GMT

GET
H2 200 edd-video--540x270.png
media.threatpost.com/wp-content/uploads/sites/103/2020/10/19151920/ 165 KB
166 KB 16ms
13ms Image
image/png 2600:9000:20eb:4a00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/19151920/edd-video--540x270.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 11f703b0d3af3df0bfed0d1584122d295604c8a44f24719e5a942934a0d32386

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 19 Oct 2020 19:23:11 GMT
via: 1.1 a9aeb6a2d302af49e6afb35d62b60576.cloudfront.net (CloudFront), 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
last-modified: Mon, 19 Oct 2020 19:19:45 GMT
server: AmazonS3
age: 113845
etag: "3f97a5ac64ffddb62b4653c0cd5833d5"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: MUC51-C1, FRA2-C1
accept-ranges: bytes
content-length: 169470
x-amz-cf-id: IAdlK_DaseOgVftJKHx9NfRb8xUt-VHLeL0bwAw8wBx0_scUVwoWtg==
expires: Tue, 19 Oct 2021 19:19:41 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/T9w1ROdplctW2nVKvNJYXH8o/ 341 KB
134 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/T9w1ROdplctW2nVKvNJYXH8o/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54f3aa37078dcd01911c9da1a5fd753b5834dde5acfd90c5bd55243bba87cf6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 02:45:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 927
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136962
x-xss-protection: 0
last-modified: Mon, 12 Oct 2020 04:11:53 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 21 Oct 2021 02:45:08 GMT

GET
H/1.1 200
OK mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 828 B
722 B 646ms
115ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Oct 2020 08:06:05 GMT
Server: nginx
ETag: W/"5f8d48ed-33c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 28 Oct 2020 03:00:36 GMT

GET
H/1.1 200
OK twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 868 B
847 B 625ms
113ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Oct 2020 08:06:08 GMT
Server: nginx
ETag: W/"5f8d48f0-364"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 28 Oct 2020 03:00:36 GMT

GET
H2 200 QR-Code-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2020/09/15133828/ 8 KB
9 KB 11ms
7ms Image
image/png 2600:9000:20eb:4a00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/15133828/QR-Code-64x64.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9f4d5cca9c79886cc27246836d97c89aaf7853b2a42b09801660cb9a3df67424

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 15 Oct 2020 20:15:01 GMT
via: 1.1 3c2fca5c3988bc152e874a83fac74f4a.cloudfront.net (CloudFront), 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
last-modified: Tue, 15 Sep 2020 17:58:41 GMT
server: AmazonS3
age: 456335
etag: "f2a1360e4c2d784aff00a9f87f6bb703"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA2-C1
accept-ranges: bytes
content-length: 8421
x-amz-cf-id: 4nIdO_9Dx9C-kXHQzxKP-wW7XvBKlc7Akpq9rew3JuD5WPPO-iqhPA==
expires: Wed, 15 Sep 2021 17:58:37 GMT

GET
H2 200 botnet-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/11/14090552/ 2 KB
2 KB 11ms
8ms Image
image/jpeg 2600:9000:20eb:4a00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/11/14090552/botnet-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6ceb2be119d08740867f19d7f3e5c2230050de29e4eb48a588b86af1a5b7db57

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 15 Oct 2020 18:02:17 GMT
via: 1.1 04599a8a3c6eb66f23e5ae02d1ec4cf2.cloudfront.net (CloudFront), 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
last-modified: Thu, 14 Nov 2019 14:06:22 GMT
server: AmazonS3
age: 464299
etag: "985f90dddb9367ad3b074a54645a8bc3"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA2-C1
accept-ranges: bytes
content-length: 1866
x-amz-cf-id: 8A43ntIn0SnPfOotOyoh1GA81aQPNXfVR0f1WZRhDgyV-sAqtOPccQ==
expires: Fri, 13 Nov 2020 14:06:19 GMT

GET
H2 200 work-from-home-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/18135511/ 2 KB
2 KB 12ms
9ms Image
image/jpeg 2600:9000:20eb:4a00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/18135511/work-from-home-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 17:57:04 GMT
via: 1.1 8033f9c6b87a03b2eca7c2db5157e10e.cloudfront.net (CloudFront), 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
last-modified: Fri, 18 Sep 2020 17:55:32 GMT
server: AmazonS3
age: 2797412
etag: "fd4942a0704785b24b44d177f4a57d86"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA2-C1
accept-ranges: bytes
content-length: 2098
x-amz-cf-id: EKWGHQgWY5Bw9rI3skrdA0xE6AI1gymJTq7jcqJ9Wsfo4iI-6vkoLA==
expires: Sat, 18 Sep 2021 17:55:28 GMT

GET
H2 200 zero-trust-b_w-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/07100716/ 3 KB
3 KB 11ms
8ms Image
image/jpeg 2600:9000:20eb:4a00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/07100716/zero-trust-b_w-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 039f2a12a4fefd4b33bcae31f1f2f17d12cf51f4e6301792ada3885f412a2761

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 15 Oct 2020 20:15:01 GMT
via: 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront), 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
last-modified: Mon, 07 Sep 2020 14:07:21 GMT
server: AmazonS3
age: 456335
etag: "5fb2f76c4c77c7e774eb0dc933ab39f0"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA2-C1
accept-ranges: bytes
content-length: 2602
x-amz-cf-id: FvMMc-iQK7t4kOtloQijhNiHVwyLHeWTy39ea8MpzGye9FrqOmrwHA==
expires: Tue, 07 Sep 2021 14:07:19 GMT

GET
H2 200 social_media-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/08/26112855/ 3 KB
3 KB 13ms
10ms Image
image/jpeg 2600:9000:20eb:4a00:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/08/26112855/social_media-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:4a00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 791135f98b21bbd99c1cbcd56e2827cab155856c144602a8749a57acaa5aa813

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 17:54:56 GMT
via: 1.1 16dc09493f48bbc1fd2cdd6e175a94f7.cloudfront.net (CloudFront), 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
last-modified: Mon, 26 Aug 2019 15:29:14 GMT
server: AmazonS3
age: 2797540
etag: "fcf0de78ef3c45c8f8256c7cec2c35c0"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA2-C1
accept-ranges: bytes
content-length: 2834
x-amz-cf-id: 4Bf9yieL4D-AfsTiEQNRjZ5xY-1n94nky-_LufCf94RsNwJ2wWHBqg==
expires: Tue, 25 Aug 2020 15:29:11 GMT

GET
H/1.1 200
OK mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 812 B
722 B 398ms
115ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Oct 2020 08:06:05 GMT
Server: nginx
ETag: W/"5f8d48ed-32c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 28 Oct 2020 03:00:36 GMT

GET
H/1.1 200
OK logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 10 KB
10 KB 330ms
110ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603094765
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 21 Oct 2020 03:00:36 GMT
Last-Modified: Mon, 19 Oct 2020 08:06:05 GMT
Server: nginx
ETag: "5f8d48ed-260a"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 9738
Expires: Wed, 28 Oct 2020 03:00:36 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 6286
date: Wed, 21 Oct 2020 01:15:49 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Wed, 21 Oct 2020 03:15:49 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 7ms
6ms Script
application/javascript 2620:116:800d:21:51e4:db4b:4436:b305
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:35 GMT
content-encoding: gzip
etag: "O/+l6c17R2TQ0JQMJXOiXA=="
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Wed, 28 Oct 2020 03:00:35 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 94ms
30ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:35 GMT
content-encoding: gzip
age: 19684
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4059-HHN
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1603249236.848525,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 124ms
48ms XHR
application/javascript 52.222.182.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.182.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-122.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:15:38 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 9898
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Wed, 30 Sep 2020 05:43:29 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 a6e1678aced1951bb094538ec62256f5.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: HAM50-C1
x-amz-cf-id: X5wMmI13O2DKADM12YIOy78HC5Eb3qoIE9U-h2GMmo3MxwLuVeaxCA==

GET
H2 200 connatix.player.css
cds.connatix.com/p/68605/ 54 KB
9 KB 30ms
30ms Stylesheet
text/css 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/68605/connatix.player.css
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3e3bed6d3324b9b6076462d26269e9ac5f39df2627a1554dffa00e071e5cec28

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:35 GMT
content-encoding: gzip
age: 70100
x-cache: HIT, HIT
status: 200
content-length: 8798
x-served-by: cache-dca17765-DCA, cache-fra19170-FRA
access-control-allow-origin: *
last-modified: Mon, 19 Oct 2020 15:29:28 GMT
x-timer: S1603249236.845539,VS0,VE0
etag: "0dd96801331fec84b0ba4a8a2a695960"
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 2, 4016

GET
H2 200 rules-p-_7kVx0t9Jqj90.js Show response
rules.quantcount.com/ 3 B
356 B 420ms
420ms Script
application/x-javascript 2600:9000:2093:3800:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2093:3800:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:17 GMT
via: 1.1 7b39f60eed6e589bf869ce2ecfe6ab8c.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 20
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=300
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: JjOvGMV8dWRB011PJ7q9UsgzOIuijFC5tpzSL-uTLvUuAd6bgf6mog==

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
125 B 13ms
13ms XHR
text/plain 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&aip=1&a=276084916&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&ul=en-us&de=UTF-8&dt=Barnes%20%26%20Noble%20Hack%3A%20A%20Reading%20List%20for%20Phishers%20and%20Crooks%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=219903899&gjid=1887336665&cid=398866975.1603249236&tid=UA-35676203-21&_gid=1584199466.1603249236&_r=1&gtm=2wg9u1PM29HLF&z=1187611373

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:35 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
63 B 6ms
6ms Image
image/gif 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&aip=1&a=276084916&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&ul=en-us&de=UTF-8&dt=Barnes%20%26%20Noble%20Hack%3A%20A%20Reading%20List%20for%20Phishers%20and%20Crooks%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=YEDAAEABAAAAAC~&jid=&gjid=&cid=398866975.1603249236&tid=UA-35676203-21&_gid=1584199466.1603249236&gtm=2wg9u1PM29HLF&z=622383386

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Oct 2020 03:00:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 86383
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK v1 Show response
geo.ipify.org/api/ 382 B
1 KB 698ms
301ms XHR
application/json 64.140.160.2
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL

https://geo.ipify.org/api/v1?apiKey=at_riPAQYz3EiQ6JhsH05bmtozma13RA

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.140.160.2 Los Angeles, United States, ASN18450 (WEBNX, US),

Reverse DNS

threatintelligenceplatform.com

Software

nginx /

Resource Hash

093ee8573c58af3b9ac0f59c675cd706101f7a5d67bf30d91d9ae67b8f66933e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private
Transfer-Encoding: chunked
Connection: keep-alive

GET
H2 200 flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/ 236 B
567 B 274ms
274ms Image
image/svg+xml 2600:9000:2156:1800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=5138f213
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=5138f213
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Wed, 21 Oct 2020 03:00:36 GMT
content-encoding: gzip
last-modified: Mon, 19 Oct 2020 08:06:03 GMT
server: nginx
x-amz-cf-pop: FRA50-C1
etag: W/"5f8d48eb-ec"
x-cache: Miss from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=604800, public
x-amz-cf-id: F9QRBmXscY_zuZRA_5XkyGLGvmlyjaSO1wKIRU_ZJJL_uYzK8q3tog==
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
expires: Wed, 28 Oct 2020 03:00:36 GMT

GET
H2 200 fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 75 KB
76 KB 428ms
411ms Font
font/woff2 2600:9000:2156:1800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=5138f213
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Origin: https://threatpost.com
Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=5138f213
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:36 GMT
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 77160
pragma: public
last-modified: Mon, 19 Oct 2020 08:06:04 GMT
server: nginx
etag: "5f8d48ec-12d68"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
x-amz-cf-id: yYOouJFYs-P_P2iSBLj99XcoHWIAw0c_1H8QFkBWh6WW0it2-MByyg==
expires: Thu, 21 Oct 2021 03:00:36 GMT

GET
H/1.1 200
OK widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html
platform.twitter.com/widgets/ Frame 2607 0
0 7ms
6ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fthreatpost.com
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40B4) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 538232
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Wed, 21 Oct 2020 03:00:35 GMT
Etag: "9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified: Thu, 01 Oct 2020 21:50:01 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40B4)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 5825

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame 4E5D 0
0 25ms
24ms Document
text/html 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&theme=standard&size=normal&cb=jinghziip9gg

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-S02F+8KuoJjYv5Q2N1+OcA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&theme=standard&size=normal&cb=jinghziip9gg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 21 Oct 2020 03:00:35 GMT
content-security-policy: script-src 'report-sample' 'nonce-S02F+8KuoJjYv5Q2N1+OcA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10681
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
87 B 15ms
15ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-35676203-21&cid=398866975.1603249236&jid=219903899&gjid=1887336665&_gid=1584199466.1603249236&_u=YEBAAEAAAAAAAC~&z=707329454

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 21 Oct 2020 03:00:35 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 400 / Show response
graph.facebook.com/ 202 B
586 B 85ms
70ms XHR
application/json 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9e8a225b88cd582fa98606ed751e34a9626f0e333170d7409fd12413001178cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status: 400
x-fb-rev: 1002854973
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 149
pragma: no-cache
x-fb-debug: cMqNZ8g6+L5AMqI3E6OCXnyBaqNYGn7GwTMmequy9JZMy2ih3WiO779qJpX1Yp+GKJQZjk4SsLQn+xIp68G6oQ==
x-fb-trace-id: FcC/1H2FmO7
date: Wed, 21 Oct 2020 03:00:36 GMT
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: AKlBedBJgF5p_61Z6FBQ405
cache-control: no-store
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 195ms
180ms Script
text/html 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&format=jsonp&callback=jQuery112405318143551125627_1603249235490&_=1603249235491
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 info.json Show response
www.reddit.com/api/ 102 B
1 KB 283ms
193ms XHR
application/json 199.232.53.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.53.140 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:36 GMT
via: 1.1 varnish
x-content-type-options: nosniff
status: 200
content-length: 102
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
x-moose: majestic
server: snooserv
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
accept-ranges: bytes
expires: -1

GET
H/1.1 200
OK button.63c51c903061d0dbd843c41e8a00aa5a.js Show response
platform.twitter.com/js/ 7 KB
3 KB 7ms
6ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.63c51c903061d0dbd843c41e8a00aa5a.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/41A1) /
Resource Hash: e0a70c5d116d9c823c7d7958ecea2a7926315fac156e390bd7dc8a5fa088cdc3

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 01 Oct 2020 21:49:51 GMT
Server: ECS (fcn/41A1)
Age: 538233
Etag: "62d4b0301f07768d13f3ee5de8633739+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 2294

GET
H/1.1 200
OK horizon_tweet.716ef7f4c155526f8ec8e60dbd2fbf56.js Show response
platform.twitter.com/js/ 6 KB
3 KB 38ms
30ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/horizon_tweet.716ef7f4c155526f8ec8e60dbd2fbf56.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4188) /
Resource Hash: b8e8fe9b8ca280dc3c982691064e62ba97c8f2c192a17dfe74430c7cf73cb4de

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 01 Oct 2020 21:49:51 GMT
Server: ECS (fcn/4188)
Age: 538233
Etag: "15d6bf68a8d65b293e52ddc833724ed4+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 2195

POST
H/1.1 200
OK pls Show response
capi.connatix.com/core/ Frame E218 6 KB
2 KB 569ms
134ms XHR
multipart/form-data 52.15.169.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=68605
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.169.204 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-15-169-204.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: 8886ecb43022319b929c038f01bad068960dad91b67870278ae2398a68267da9

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1890

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
263 B 31ms
30ms Image
image/gif 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-35676203-21&cid=398866975.1603249236&jid=219903899&_u=YEBAAEAAAAAAAC~&z=89175998

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
106 B 28ms
28ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-35676203-21&cid=398866975.1603249236&jid=219903899&_u=YEBAAEAAAAAAAC~&z=89175998

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame D1A7 0
0 28ms
27ms Document
text/html 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&theme=light&size=normal&cb=7lfy5git43ym

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-lxjoBkWUoNhaeYdXYuKoPw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&theme=light&size=normal&cb=7lfy5git43ym
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 21 Oct 2020 03:00:36 GMT
content-security-policy: script-src 'report-sample' 'nonce-lxjoBkWUoNhaeYdXYuKoPw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10709
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK e Show response
capi.connatix.com/tr/ Frame E218 0
323 B 500ms
122ms XHR
multipart/form-data 52.15.169.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/e
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.169.204 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-15-169-204.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 adsct
t.co/i/ 43 B
448 B 249ms
159ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 106
pragma: no-cache
last-modified: Wed, 21 Oct 2020 03:00:36 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 0c16599ba294689ace6d3d207d862bd2
x-transaction: 000c744100ddba17
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK follow_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
platform.twitter.com/widgets/ Frame D84D 0
0 7ms
6ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/follow_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/41A1) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 538232
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Wed, 21 Oct 2020 03:00:36 GMT
Etag: "fa16f6b5a5d1ee2100b485fa457112a6+gzip"
Last-Modified: Thu, 01 Oct 2020 21:49:53 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/41A1)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 13661

GET
H/1.1 200
OK index.html
platform.twitter.com/embed/ Frame 2121 0
0 7ms
6ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/index.html?creatorScreenName=threatpost&dnt=true&embedId=twitter-widget-1&frame=false&hideCard=false&hideThread=false&id=1316704190010396673&lang=en&origin=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&siteScreenName=threatpost&theme=light&widgetsVersion=ed20a2b%3A1601588405575&width=500px
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40FC) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 333
Cache-Control: public, max-age=1800
Content-Type: text/html; charset=utf-8
Date: Wed, 21 Oct 2020 03:00:36 GMT
Etag: "5349d12bea368508533f7a71f7df5727"
Last-Modified: Wed, 14 Oct 2020 21:28:12 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40FC)
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 577

GET
H2 200 arj Show response
teachingaids-d.openx.net/w/1.0/ 113 KB
11 KB 732ms
345ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=833be28b-5c7c-4e09-89d2-a552367214c6%2C833be28b-5c7c-4e09-89d2-a552367214c6%2C62a1c08d-550e-447d-be72-9baf7c93772c%2C5d89e9e2-0ad2-454e-b012-03a009424956%2C5d89e9e2-0ad2-454e-b012-03a009424956&nocache=1603249236373&gdpr=0&x_gdpr_f=1&pubcid=200fac27-e58a-4dc0-8bfb-df67694deba5&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divIds=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash: 623e7246c817a2d709db56d2c9b3072c5fd9ad41e22cff31291d6a9136a1b2ec

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:37 GMT
content-encoding: gzip
server: OXGW/16.195.1
status: 200
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 11321
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ 653 B
755 B 372ms
154ms XHR
application/json 136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 90ec250badd2212734a2b40cd802a9143d9028850a33394cd8b892adc58e6192

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 21 Oct 2020 03:00:36 GMT
content-encoding: gzip
server: envoy
status: 200
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 42
content-length: 326

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 25 B
287 B 214ms
127ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=438654&v=7.2&r=%7B%22id%22%3A%22118c4ef72890d57%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22129eaf6b8ed893e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2213d0faa7843664e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2214f952c16e0e54f%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22129eaf6b8ed893e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22129eaf6b8ed893e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2213d0faa7843664e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22336x280%22%7D%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2214f952c16e0e54f%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d02505ea3afce2c13db4659c9ef49b5a6939aec38340c1e16e9471683a9fddaf

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:36 GMT
content-encoding: gzip
server: Apache
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 45
x-akamai-path-stats: [3:1877:82123]
expires: Wed, 21 Oct 2020 03:00:36 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
115 B 181ms
95ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 21 Oct 2020 03:00:36 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H2 200 adreq Show response
ads.servenobid.com/ 14 KB
3 KB 184ms
89ms XHR
application/json 54.76.211.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=267
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.211.112 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-211-112.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6ce73b5cd70fb619db9c1b6a4391b2bb00101d002788f308766800b8ebb1eca8

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 21 Oct 2020 03:00:36 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
status: 200
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials: true

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
710 B 116ms
34ms XHR
application/json 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:36 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.242:80
AN-X-Request-Uuid: 14955aad-8bf7-4b8e-aa19-1ca779600671
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 10 KB
6 KB 186ms
78ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&tk_flint=pbjs_lite_v4.10.0&x_source.tid=833be28b-5c7c-4e09-89d2-a552367214c6&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.8307310427591978
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 652fceb7d30594ed27e66da1bfa09d6118a60dd3b51da1d5ed287e07438c81a1

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 4255
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 188ms
80ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&tk_flint=pbjs_lite_v4.10.0&x_source.tid=62a1c08d-550e-447d-be72-9baf7c93772c&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.6250253257387894
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 1a43c74864844bfddbd01ca30caeb8fb5b8534cf72b03132b37bba0c13860844

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:36 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 188ms
81ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&tk_flint=pbjs_lite_v4.10.0&x_source.tid=5d89e9e2-0ad2-454e-b012-03a009424956&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7968100008163628
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: ae68612063622372d01d3b119c53de3530fdf5f6be1f05e230a0304d2f0ed668

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:36 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 5 KB
4 KB 223ms
116ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&tk_flint=pbjs_lite_v4.10.0&x_source.tid=5d89e9e2-0ad2-454e-b012-03a009424956&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.35820473462359215
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: aca770b3bd6ea5361b43a392c4b5180c3c4ebe777e25cdd6bbffd4a9bca09066

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 2279
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET

ADTECH;apid=1A98429974-1349-11eb-a249-12e1ea48904a;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=5757b8a8adb0631;misc=1603249236388
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5757b8a8adb0631;misc=1603249236388;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1603249235;v=2;cmd=bid;cors=yes;alias=5757b8a8adb0631;misc=1603249236388
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A98429974-1349-11eb-a249-12e1ea48904a;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=5757b8a8adb0631;misc=16...

0
0

GET
H2

200

ADTECH;apid=1A981943c6-1349-11eb-8fbe-120f1417a350;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=58ab6d214ecd838;misc=1603249236389 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=58ab6d214ecd838;misc=1603249236389;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=58ab6d214ecd838;misc=1603249236389
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A981943c6-1349-11eb-8fbe-120f1417a350;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=58ab6d214ecd838;misc=16...

1 KB
2 KB

180ms
180ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A981943c6-1349-11eb-8fbe-120f1417a350;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=58ab6d214ecd838;misc=1603249236389
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: bf3ddcb81919410585121c9a8234bdaf8b6f8d47e059c34c7f2d8c475249ad37

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:37 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:37 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A981943c6-1349-11eb-8fbe-120f1417a350;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=58ab6d214ecd838;misc=1603249236389
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A981951e0-1349-11eb-a7df-1204ea82ed4e;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=5976d28b140ef96;misc=1603249236389 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=5976d28b140ef96;misc=1603249236389;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=5976d28b140ef96;misc=1603249236389
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A981951e0-1349-11eb-a7df-1204ea82ed4e;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=5976d28b140ef96;misc=16...

1 KB
2 KB

181ms
181ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A981951e0-1349-11eb-a7df-1204ea82ed4e;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=5976d28b140ef96;misc=1603249236389
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 9dafe15de32062af9dedee3ff6a64b81a1bb78a924a9e6a7f21a180cc75b8c27

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:37 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:37 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A981951e0-1349-11eb-a7df-1204ea82ed4e;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=5976d28b140ef96;misc=1603249236389
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET

ADTECH;apid=1A984186e2-1349-11eb-93a5-12d220623a1c;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=608a22ceaf3a146;misc=1603249236389
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=608a22ceaf3a146;misc=1603249236389;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=608a22ceaf3a146;misc=1603249236389
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A984186e2-1349-11eb-93a5-12d220623a1c;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=608a22ceaf3a146;misc=16...

0
0

GET
H2

200

ADTECH;apid=1A98197d50-1349-11eb-aa26-1249c31fdca2;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=619298acdcd12e7;misc=1603249236389 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=619298acdcd12e7;misc=1603249236389;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=619298acdcd12e7;misc=1603249236389
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A98197d50-1349-11eb-aa26-1249c31fdca2;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=619298acdcd12e7;misc=16...

1 KB
2 KB

146ms
146ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A98197d50-1349-11eb-aa26-1249c31fdca2;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=619298acdcd12e7;misc=1603249236389
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 64c1fcfbb417c6196b85f27e7ecbc583e19368fe18cc30b9184fb29c7f66d2be

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:37 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:37 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A98197d50-1349-11eb-aa26-1249c31fdca2;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=619298acdcd12e7;misc=1603249236389
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
755 B 203ms
34ms XHR
application/json 72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.10.0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: a72430eff8a50ab94fa52d392e7116f6e6d1480672b400b61a0c5eefb61fcc7d

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
168 B 404ms
112ms XHR
application/json 165.227.252.242
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 165.227.252.242 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 200
date: Wed, 21 Oct 2020 03:00:36 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com
content-length: 16
vary: Origin
content-type: application/json

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
311 B 264ms
97ms XHR
application/json 52.28.149.230
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=4.10.0&referrer=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&tmax=1200&gdpr=false

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.149.230 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-149-230.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:36 GMT
x-auction-status: 12, 12, 12
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
709 B 163ms
66ms XHR
application/json 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:36 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.38:80
AN-X-Request-Uuid: 9730fda2-9edc-4518-a13f-79ba1f59b6c8
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
369 B 99ms
94ms XHR
text/javascript 52.222.182.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&pid=dBJwxmzdNdoZ6&cb=0&ws=1600x1200&v=7.55.00&t=1200&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.182.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-122.ham50.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:36 GMT
via: 1.1 9ed78f83b2bb44dc950eb2bc8dff85f0.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: HAM50-C1
status: 200
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: AfJeeJN0nbYRXAUVFgo4y_aptOd-UmtIeiM5CYG6OL19_92-kmJPZQ==

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame 9499 0
0 20ms
20ms Document
text/html 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=115h1rt5dmcc

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-LSfUDl+KPARNGQVWrz0ozw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=115h1rt5dmcc
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 21 Oct 2020 03:00:36 GMT
content-security-policy: script-src 'report-sample' 'nonce-LSfUDl+KPARNGQVWrz0ozw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1174
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK sr Show response
capi.connatix.com/tr/ Frame E218 0
323 B 122ms
122ms XHR
multipart/form-data 52.15.169.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sr?v=68605
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.169.204 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-15-169-204.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H/1.1 200
OK analytics.js Show response
s.srvsynd.com/2/234175/ 4 KB
2 KB 216ms
48ms Script
text/javascript 18.203.131.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.srvsynd.com/2/234175/analytics.js?dt=2341751597675869250012&di=threatpost.com&ui=00000000-0000-0000-0000-000000000000&md=2&ap=undefined&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&de=2&to=3&pv=371bf0ca-4de5-467b-846a-629d86778e70

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

df08bfb12ce96decde5f9aec75cef91cc86bad2e2eb2c034de2338c9d44ff683

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: gzip
Vary: *
Content-Type: text/javascript; charset=utf-8
Cache-Control: no-cache, no-store, must-revalidate, no-transform, private, max-age=0
Strict-Transport-Security: max-age=31536000; includeSubDomains
Timing-Allow-Origin: *
Content-Length: 2043
Expires: 0

GET
H2 200 3_media.bin Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame E218 232 B
469 B 93ms
30ms XHR
application/octet-stream 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/3_media.bin
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:36 GMT
content-encoding: gzip
age: 903223
x-cache: HIT, HIT
status: 200
content-length: 204
x-served-by: cache-bwi5138-BWI, cache-fra19144-FRA
last-modified: Thu, 17 Sep 2020 01:42:41 GMT
x-timer: S1603249237.988852,VS0,VE1
etag: "796c77896c9738780ae744fd3eb73483"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 1.png
img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/ 4 KB
5 KB 41ms
32ms Image
image/webp 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/1.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 98170098ad5b9e0e27bc80b4fab39889cb6437246979ee85680f64bb77d03a08

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:36 GMT
via: 1.1 varnish, 1.1 varnish
age: 2220443
x-cache: HIT, HIT
fastly-io-info: ifsz=8114 idim=288x42 ifmt=png ofsz=4328 odim=288x42 ofmt=webp
status: 200
fastly-stats: io=1
content-encoding: gzip
content-length: 4351
x-served-by: cache-dca17763-DCA, cache-fra19170-FRA
x-timer: S1603249237.943064,VS0,VE0
etag: "E00cBQTrMvE7BFKf7WtTa6oGFTVX3QMTXtfExBtu+i8"
vary: Accept
x-amz-request-id: 73558CDC7A440D38
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 2, 2

GET
H2 200 pixel;r=2012648638;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F;fpan=1;fpa=P0-641523876-1603249236924;ns=...
pixel.quantserve.com/ 35 B
372 B 8ms
8ms Image
image/gif 2620:116:800d:21:51e4:db4b:4436:b305
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=2012648638;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F;fpan=1;fpa=P0-641523876-1603249236924;ns=0;ce=1;qjs=1;qv=3364aec3-20201006003021;cm=;gdpr=0;ref=;d=threatpost.com;je=0;sr=1600x1200x24;dst=1;et=1603249236924;tzo=-120;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2020%2F10%2F15094255%2FBarne%2Ctype.article%2Ctitle.Barnes%20%26%20Noble%20Hack%3A%20A%20Reading%20List%20for%20Phishers%20and%20Crooks%2Cdescription.Customers'%20lists%20of%20book%20purchases%20along%20with%20email%20addresses%20and%20more%20could%20hav%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:36 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
status: 200
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame BAF2 0
0 21ms
21ms Document
text/html 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=lll98xmfia41

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-A21OTtyR5U4qYMsCXT6rdw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=lll98xmfia41
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 21 Oct 2020 03:00:36 GMT
content-security-policy: script-src 'report-sample' 'nonce-A21OTtyR5U4qYMsCXT6rdw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1173
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK postback Show response
s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/ 0
145 B 211ms
48ms XHR
text/plain 18.203.131.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/postback?oz_pl=1&ui=00000000-0000-0000-0000-000000000000&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&to=3&dt=2341751597675869250012&di=threatpost.com&de=2&pv=371bf0ca-4de5-467b-846a-629d86778e70&ci=234175&md=2&ap=undefined
Requested by: Host: s.srvsynd.com
URL: https://s.srvsynd.com/2/234175/analytics.js?dt=2341751597675869250012&di=threatpost.com&ui=00000000-0000-0000-0000-000000000000&md=2&ap=undefined&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&de=2&to=3&pv=371bf0ca-4de5-467b-846a-629d86778e70
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 21 Oct 2020 03:00:36 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H/1.1 200
OK main.js Show response
s.srvsynd.com/2/4.78.0/ 126 KB
37 KB 61ms
60ms Script
text/javascript 18.203.131.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.srvsynd.com/2/4.78.0/main.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

1a4615d389c0304ba5ec2028cd81ce4cd3ff85bf20176e19d90a1e3ec9725636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 21 Oct 2020 03:00:36 GMT
Content-Encoding: br
Vary: Origin, Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: public, no-transform, immutable, max-age=999999999
Strict-Transport-Security: max-age=31536000; includeSubDomains
Timing-Allow-Origin: *
Content-Length: 37505
Expires: Sat, 29 Jun 2052 00:54:39 GMT

POST
H/1.1 200
OK ao Show response
capi.connatix.com/tr/ Frame E218 0
323 B 122ms
122ms XHR
multipart/form-data 52.15.169.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ao?v=68605
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.169.204 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-15-169-204.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 21 Oct 2020 03:00:37 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK ps Show response
capi.connatix.com/tr/ Frame E218 0
323 B 243ms
122ms XHR
multipart/form-data 52.15.169.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ps?v=68605
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.169.204 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-15-169-204.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 21 Oct 2020 03:00:37 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 1_th.jpg
img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ 2 KB
2 KB 30ms
30ms Image
image/webp 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:37 GMT
via: 1.1 varnish, 1.1 varnish
age: 2260652
x-cache: HIT, HIT
fastly-io-info: ifsz=36645 idim=2560x1440 ifmt=jpeg ofsz=2098 odim=400x225 ofmt=webp
status: 200
fastly-stats: io=1
content-encoding: gzip
content-length: 2066
x-served-by: cache-dca17763-DCA, cache-fra19170-FRA
x-timer: S1603249237.080611,VS0,VE0
etag: "iDhG33Z1a+GgxtfhSqjNbZ1Iz0hjRhSMeN4Q5WPVjm0"
vary: Accept
x-amz-request-id: 9718C29D2B1AEC8D
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1, 2

GET
H2 200 prebid3.25.0-1.js Show response
cds.connatix.com/p/plugins/ Frame E218 286 KB
89 KB 31ms
31ms Script
application/javascript 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:37 GMT
content-encoding: gzip
age: 3172592
x-cache: HIT, HIT
status: 200
content-length: 90468
x-served-by: cache-dca17733-DCA, cache-fra19170-FRA
access-control-allow-origin: *
last-modified: Mon, 14 Sep 2020 09:43:49 GMT
x-timer: S1603249237.082010,VS0,VE0
etag: "9c38c88a790efaae20de0f5391a27029"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 2, 7923

GET
H2 200 playlist.m3u8 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame E218 309 B
349 B 31ms
30ms XHR
application/x-mpegurl 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/playlist.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:37 GMT
content-encoding: gzip
age: 1136624
x-cache: HIT, HIT
status: 200
content-length: 164
x-served-by: cache-bwi5132-BWI, cache-fra19144-FRA
last-modified: Mon, 07 Sep 2020 18:49:42 GMT
x-timer: S1603249237.096356,VS0,VE1
etag: "8a966507b13615ecdc1330a4bc9dcfe1"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 1

POST
H/1.1 200
OK postback Show response
s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/ 0
145 B 150ms
55ms XHR
text/plain 18.203.131.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/postback?ui=00000000-0000-0000-0000-000000000000&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&to=3&dt=2341751597675869250012&di=threatpost.com&de=2&pv=371bf0ca-4de5-467b-846a-629d86778e70&ci=234175&md=2&ap=undefined&oz_tc=AB3vBSgD-gRLctQW&oz_sc=ed0aa95f6814ec014b3376d8&oz_st=1603249236997&oz_v=4.78.0&dp=threatpost.com&oz_df=115&oz_l=11007&cv=3
Requested by: Host: s.srvsynd.com
URL: https://s.srvsynd.com/2/4.78.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 21 Oct 2020 03:00:36 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

POST
H/1.1 200
OK postback Show response
s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/ 0
145 B 194ms
48ms XHR
text/plain 18.203.131.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/postback?oz_pl=1&ui=00000000-0000-0000-0000-000000000000&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&to=3&dt=2341751597675869250012&di=threatpost.com&de=2&pv=371bf0ca-4de5-467b-846a-629d86778e70&ci=234175&md=2&ap=undefined
Requested by: Host: s.srvsynd.com
URL: https://s.srvsynd.com/2/234175/analytics.js?dt=2341751597675869250012&di=threatpost.com&ui=00000000-0000-0000-0000-000000000000&md=2&ap=undefined&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&de=2&to=3&pv=371bf0ca-4de5-467b-846a-629d86778e70
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 21 Oct 2020 03:00:36 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 200 0.m3u8 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame E218 5 KB
1 KB 31ms
30ms XHR
application/x-mpegurl 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:37 GMT
content-encoding: gzip
age: 1963714
x-cache: HIT, HIT
status: 200
content-length: 959
x-served-by: cache-bwi5151-BWI, cache-fra19144-FRA
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
x-timer: S1603249237.180198,VS0,VE1
etag: "3a71266b043248350b2f39a55da8294e"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 2, 1

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
650 B 250ms
161ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 121
pragma: no-cache
last-modified: Wed, 21 Oct 2020 03:00:37 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 2180dc36b2531cbc878baf4efc15ce0e
x-transaction: 002325c200f8fa5e
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
BLOB 200
OK 87750575-4aed-42eb-8745-f0d1e4210ac7
https://threatpost.com/ 476 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://threatpost.com/87750575-4aed-42eb-8745-f0d1e4210ac7
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e811b97dc60cf37a74f0bffee4222c2697e409c2cc78548e47b3384926c4338

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 476

POST
H/1.1 200
OK postback Show response
s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/ 0
145 B 53ms
53ms XHR
text/plain 18.203.131.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/postback?ui=00000000-0000-0000-0000-000000000000&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&to=3&dt=2341751597675869250012&di=threatpost.com&de=2&pv=371bf0ca-4de5-467b-846a-629d86778e70&ci=234175&md=2&ap=undefined&oz_tc=AB3vBSgD-gRLctQW&oz_sc=ed0aa95f6814ec014b3376d8&oz_st=1603249236997&oz_v=4.78.0&dp=threatpost.com&oz_df=295&oz_l=7223&cv=3
Requested by: Host: s.srvsynd.com
URL: https://s.srvsynd.com/2/4.78.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 21 Oct 2020 03:00:36 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame E218 0
59 B 77ms
77ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 21 Oct 2020 03:00:37 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame E218 92 B
285 B 220ms
220ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=6104c564-f42f-489a-a271-e1c3806f4592&nocache=1603249237325&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882779&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:37 GMT
via: 1.1 google
server: OXGW/16.195.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame E218 0
59 B 159ms
159ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 21 Oct 2020 03:00:37 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame E218 24 B
436 B 199ms
134ms XHR
application/json 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435871&v=8.1&r=%7B%22id%22%3A%227db2d0d2dc79e8%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2288337ec45c6516%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b058422b486c77ab4efc5aecc11d7c1e4e21e05ba22ce6daaa5bb95eae20a1ec

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:37 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 44
Expires: Wed, 21 Oct 2020 03:00:37 GMT

GET cygnus
as-sec.casalemedia.com/ Frame E218 0
0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame E218 19 B
710 B 34ms
34ms XHR
application/json 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:37 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.177:80
AN-X-Request-Uuid: 8f867b0f-a21d-4326-a5db-686cc1486412
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame E218 0
215 B 138ms
39ms XHR
application/json 18.197.185.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.185.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-185-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame E218 92 B
282 B 219ms
219ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=510932be-8718-478d-abb4-1a2ab516ce9a&nocache=1603249237335&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882778&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:37 GMT
via: 1.1 google
server: OXGW/16.195.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame E218 19 B
710 B 34ms
34ms XHR
application/json 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:37 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.241:80
AN-X-Request-Uuid: c8238ec2-ffe0-484b-8eb0-9e15d7310c95
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 30ms
30ms Other 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Wed, 21 Oct 2020 03:00:37 GMT
x-served-by: cache-fra19144-FRA
x-cache: HIT
x-cache-hits: 0
x-timer: S1603249237.360941,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame E218 1 KB
2 KB 30ms
30ms XHR
video/mp4 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-1428

Response headers

date: Wed, 21 Oct 2020 03:00:37 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 1963711
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5137-BWI, cache-fra19144-FRA
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 0-1428/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1603249237.391112,VS0,VE0
access-control-allow-origin: *
Content-Length: 1429
x-cache-hits: 2, 1

POST
H/1.1 200
OK postback Show response
s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/ 0
145 B 49ms
49ms XHR
text/plain 18.203.131.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/postback?ui=00000000-0000-0000-0000-000000000000&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&to=3&dt=2341751597675869250012&di=threatpost.com&de=2&pv=371bf0ca-4de5-467b-846a-629d86778e70&ci=234175&md=2&ap=undefined&oz_tc=AB3vBSgD-gRLctQW&oz_sc=ed0aa95f6814ec014b3376d8&oz_st=1603249236997&oz_v=4.78.0&dp=threatpost.com&oz_df=401&oz_l=62&cv=3
Requested by: Host: s.srvsynd.com
URL: https://s.srvsynd.com/2/4.78.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 21 Oct 2020 03:00:37 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 30ms
30ms Other 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Wed, 21 Oct 2020 03:00:37 GMT
x-served-by: cache-fra19144-FRA
x-cache: HIT
x-cache-hits: 0
x-timer: S1603249237.423909,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame E218 444 KB
445 KB 31ms
31ms XHR
video/mp4 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=1429-456334

Response headers

date: Wed, 21 Oct 2020 03:00:37 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 1963711
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5137-BWI, cache-fra19144-FRA
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 1429-456334/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1603249237.454751,VS0,VE0
access-control-allow-origin: *
Content-Length: 454906
x-cache-hits: 2, 2

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
170 B 154ms
154ms Image
image/gif 104.244.42.136
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?dnt=1&l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22threatpost%22%2C%22widget_creator_screen_name%22%3A%22threatpost%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1603249237452%2C%22dnt%22%3Atrue%2C%22client_version%22%3A%22ed20a2b%3A1601588405575%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.136 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 114
pragma: no-cache
last-modified: Wed, 21 Oct 2020 03:00:37 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 15456ca5c601ae092aa22ee0ef259404
x-transaction: 009ef8ab0038542a
expires: Tue, 31 Mar 1981 05:00:00 GMT

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 30ms
30ms Other 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Wed, 21 Oct 2020 03:00:37 GMT
x-served-by: cache-fra19144-FRA
x-cache: HIT
x-cache-hits: 0
x-timer: S1603249238.577000,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame E218 390 KB
390 KB 31ms
31ms XHR
video/mp4 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=456335-855191

Response headers

date: Wed, 21 Oct 2020 03:00:37 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 1963711
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5137-BWI, cache-fra19144-FRA
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 456335-855191/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1603249238.607805,VS0,VE0
access-control-allow-origin: *
Content-Length: 398857
x-cache-hits: 2, 3

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
168 B 15ms
14ms Script
application/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 21 Oct 2020 03:00:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
168 B 16ms
15ms Script
application/javascript 2a00:1450:4001:81b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 21 Oct 2020 03:00:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 43 KB
15 KB 686ms
499ms XHR
text/plain 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1212914056381423&correlator=1602829434861152&output=ldjh&impl=fifs&eid=21067447%2C21067718%2C21067753&vrg=2020101501&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201021&iu_parts=21707124336%2CThreatPost-970x250-ATF%2CThreatPost-300x250-ATF%2CThreatPost-300x600-ATF%2CThreatPost-2x2-Skin&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2&prev_scp=amznbid%3D2%26amznp%3D2%26hb_adid_openx%3D688636295f476c1%26hb_bidder_openx%3Dopenx%26hb_adid_rubicon%3D66006f209a6ddf5%26hb_bidder_rubicon%3Drubicon%26hb_adid_nobid%3D63bee37c5f1b162%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D2.02%26hb_adid%3D688636295f476c1%26hb_bidder%3Dopenx%7Camznbid%3D2%26amznp%3D2%26hb_adid_openx%3D70e3203f337a34a%26hb_bidder_openx%3Dopenx%26hb_adid_nobid%3D641c20fa6cb00b7%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D2.02%26hb_adid%3D70e3203f337a34a%26hb_bidder%3Dopenx%7Camznbid%3D2%26amznp%3D2%26hb_adid_openx%3D712444ee779fdfe%26hb_bidder_openx%3Dopenx%26hb_adid_rubicon%3D67c69134ca0b1a5%26hb_bidder_rubicon%3Drubicon%26hb_adid_nobid%3D65517913e775896%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D2.02%26hb_adid%3D712444ee779fdfe%26hb_bidder%3Dopenx%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fbarnes-noble-hack-phishers-crooks%252F160148%252F%26urlquery%3Dgoogfc%26contentid%3D160148%26category%3Dbreach%26contenttags%3Dbarnes-noble%252Ccyberattack%252Cdata-breach%252Cemail-notice%252Cfraud%252Chack%252Cnook-outage%252Cpersonal%252Cpersonal-information%252Cphishing%252Cpii%252Cpurchase-history%252Cransomware%252Creading-lists%252Ctransaction-history&cookie_enabled=1&bc=31&abxe=1&lmt=1603249237&dt=1603249237599&dlt=1603249233867&idt=1534&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C1082%2C1082%2C0&adys=10%2C257%2C1503%2C0&adks=1015519800%2C654286612%2C375389812%2C3385906655&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&dssz=60&icsg=175934755844096&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90%7C300x250%7C300x250%7C1600x2&msz=728x90%7C300x250%7C300x250%7C1600x2&ga_vid=398866975.1603249236&ga_sid=1603249238&ga_hid=276084916&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

ceefab1961090d49423fabaa6d8d90f7f6a73c3e69e1297132848291d46c2981

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14977
x-xss-protection: 0
google-lineitem-id: 5260381574,5260381574,5260381574,5283645110
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138299274423,138299645356,138299645359,138301519116
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
a26a165e8e9d5dd7aa15809c2f2fe6a7.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 59ms
14ms Other
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://a26a165e8e9d5dd7aa15809c2f2fe6a7.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 6ms
6ms Other
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

POST
H/1.1 200
OK postback Show response
s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/ 0
145 B 48ms
48ms XHR
text/plain 18.203.131.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/postback?ui=00000000-0000-0000-0000-000000000000&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&to=3&dt=2341751597675869250012&di=threatpost.com&de=2&pv=371bf0ca-4de5-467b-846a-629d86778e70&ci=234175&md=2&ap=undefined&oz_tc=AB3vBSgD-gRLctQW&oz_sc=ed0aa95f6814ec014b3376d8&oz_st=1603249236997&oz_v=4.78.0&dp=threatpost.com&oz_df=625&oz_l=83&cv=3
Requested by: Host: s.srvsynd.com
URL: https://s.srvsynd.com/2/4.78.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 21 Oct 2020 03:00:37 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

POST
H/1.1 200
OK mq Show response
capi.connatix.com/tr/ Frame E218 0
323 B 122ms
122ms XHR
multipart/form-data 52.15.169.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/mq?v=68605
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.169.204 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-15-169-204.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 21 Oct 2020 03:00:37 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK postback Show response
s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/ 0
145 B 49ms
49ms XHR
text/plain 18.203.131.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/postback?ui=00000000-0000-0000-0000-000000000000&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&to=3&dt=2341751597675869250012&di=threatpost.com&de=2&pv=371bf0ca-4de5-467b-846a-629d86778e70&ci=234175&md=2&ap=undefined&oz_tc=AB3vBSgD-gRLctQW&oz_sc=ed0aa95f6814ec014b3376d8&oz_st=1603249236997&oz_v=4.78.0&dp=threatpost.com&oz_df=1196&oz_l=89&cv=3
Requested by: Host: s.srvsynd.com
URL: https://s.srvsynd.com/2/4.78.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 21 Oct 2020 03:00:37 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 200 bl-04a3385-d751150c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 0B86 94 KB
27 KB 37ms
36ms Script
application/javascript 99.86.2.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-d751150c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-42.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9f77bf6ecbc06589bf03b9b673dec4cd51648ed1200ff242a6b53530b2cbccf5

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:32:58 GMT
content-encoding: gzip
age: 8861
x-cache: Hit from cloudfront
status: 200
content-length: 27159
x-amz-meta-git_commit: 04a3385
last-modified: Wed, 21 Oct 2020 00:29:10 GMT
server: AmazonS3
etag: "153e5781d1abd9808988bbfad02fc43e"
x-amz-version-id: H3e_7cWHLkRgnk8h19cVrYjzyOS4Zz7b
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: G3MnfvZiOyKAdRUECD5IzE_XqIExxXBE1i9h1Uuf27Z7gc6gMBezmQ==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 0B86 61 KB
21 KB 37ms
37ms Script
application/javascript 99.86.2.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-42.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 11 Oct 2020 18:00:05 GMT
content-encoding: gzip
age: 810034
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 9QHBUCt4n9Buh3rbIYFUd1a-aVfc3moSzRA6K1YDLA-AKD5kxJfjtA==

GET
H3-Q050 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0B86 75 KB
28 KB 69ms
54ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0349c6db8579ded17b40059444ff3608658a0151d652723873166b36011010c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603106895779640"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28917
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H2 200 bl-04a3385-d751150c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame D545 94 KB
27 KB 44ms
44ms Script
application/javascript 99.86.2.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-d751150c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-42.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9f77bf6ecbc06589bf03b9b673dec4cd51648ed1200ff242a6b53530b2cbccf5

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:32:58 GMT
content-encoding: gzip
age: 8861
x-cache: Hit from cloudfront
status: 200
content-length: 27159
x-amz-meta-git_commit: 04a3385
last-modified: Wed, 21 Oct 2020 00:29:10 GMT
server: AmazonS3
etag: "153e5781d1abd9808988bbfad02fc43e"
x-amz-version-id: H3e_7cWHLkRgnk8h19cVrYjzyOS4Zz7b
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: Pf4EMW6MQAgQ8jxhMGP50yYKkMbenAkewaomZAG9IvU2iwsqIrpiDQ==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame D545 61 KB
21 KB 45ms
44ms Script
application/javascript 99.86.2.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-42.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 11 Oct 2020 18:00:05 GMT
content-encoding: gzip
age: 810034
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: mt3jy-rINfQZrOFhTyF1LnCr0AhnvVrqrgi3u7yeki8mGOoZKSF5UQ==

GET
H3-Q050 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame D545 75 KB
29 KB 29ms
23ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0349c6db8579ded17b40059444ff3608658a0151d652723873166b36011010c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603106895779640"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28917
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H2 200 bl-04a3385-d751150c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame D8C8 94 KB
27 KB 44ms
43ms Script
application/javascript 99.86.2.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-d751150c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-42.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9f77bf6ecbc06589bf03b9b673dec4cd51648ed1200ff242a6b53530b2cbccf5

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:32:58 GMT
content-encoding: gzip
age: 8861
x-cache: Hit from cloudfront
status: 200
content-length: 27159
x-amz-meta-git_commit: 04a3385
last-modified: Wed, 21 Oct 2020 00:29:10 GMT
server: AmazonS3
etag: "153e5781d1abd9808988bbfad02fc43e"
x-amz-version-id: H3e_7cWHLkRgnk8h19cVrYjzyOS4Zz7b
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: BuPcr97wvmbxBimR7oqUSMoBSSx93igHwMNxok0NDnYPLTebN4c5YA==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame D8C8 61 KB
21 KB 44ms
43ms Script
application/javascript 99.86.2.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-42.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 11 Oct 2020 18:00:05 GMT
content-encoding: gzip
age: 810034
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: MXJ4UcdcWVY3_djVDCymXiVFa0N1mpmBYHFZVoj-GnZGl4IP76FUHQ==

GET
H3-Q050 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame D8C8 75 KB
28 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0349c6db8579ded17b40059444ff3608658a0151d652723873166b36011010c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603106895779640"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28917
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H3-Q050 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78b478e2a5cf6e2bb0f4042cd8cc3e9be88a42e80e8b39c219c5cc0f2e98a41e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603106895779640"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27616
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H2 200 bl-04a3385-d751150c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame A7C2 94 KB
27 KB 34ms
33ms Script
application/javascript 99.86.2.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-d751150c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-42.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9f77bf6ecbc06589bf03b9b673dec4cd51648ed1200ff242a6b53530b2cbccf5

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:32:58 GMT
content-encoding: gzip
age: 8861
x-cache: Hit from cloudfront
status: 200
content-length: 27159
x-amz-meta-git_commit: 04a3385
last-modified: Wed, 21 Oct 2020 00:29:10 GMT
server: AmazonS3
etag: "153e5781d1abd9808988bbfad02fc43e"
x-amz-version-id: H3e_7cWHLkRgnk8h19cVrYjzyOS4Zz7b
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: f29t88QaMFIDbAcr9xs3TU76I2X1t5XKZhIkESbvO2MyHIMko2FwLw==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame A7C2 61 KB
21 KB 34ms
33ms Script
application/javascript 99.86.2.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.2.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-2-42.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 11 Oct 2020 18:00:05 GMT
content-encoding: gzip
age: 810034
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: SBS9-CzC8LP9JVvx0C0P9dxJA5MYI0r2Hx7vY6mLs0ombICzyqFsgw==

GET
H3-Q050 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame A7C2 330 B
491 B 30ms
14ms Image
image/png 2a00:1450:4001:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 01:25:35 GMT
x-content-type-options: nosniff
age: 5703
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Oct 2021 01:25:35 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20201019/r20110914/ Frame A7C2 17 KB
8 KB 28ms
13ms Script
text/javascript 2a00:1450:4001:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20201019/r20110914/abg_lite_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0168b952e652e23883e037050fe02ef96b309e96fbb0807a554b0a989801eef9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 00:51:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7202
x-xss-protection: 0
server: cafe
etag: 8929338423558124349
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 Nov 2020 00:51:51 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20201019/r20110914/client/ Frame A7C2 3 KB
1 KB 29ms
14ms Script
text/javascript 2a00:1450:4001:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20201019/r20110914/client/window_focus_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d2da3bdfb97c04360c684feeaac2a007c4a391f0b7623a0294f5c8eb3a91afc4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 20 Oct 2020 22:10:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17414
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1335
x-xss-protection: 0
server: cafe
etag: 1884878862150193934
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 Nov 2020 22:10:24 GMT

GET
H3-Q050 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame A7C2 75 KB
28 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0349c6db8579ded17b40059444ff3608658a0151d652723873166b36011010c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603106895779640"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28917
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 38ms
18ms XHR
application/json 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020101501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

394c891106fefec5da26b02e23ae36b884736ccc30fa0ca7c9832c29dd212f8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6582
x-xss-protection: 0

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 0B86 0
0 203ms
202ms Fetch
image/gif 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsun3B2TFJoeW4z5P5bU_7Fowmts4vH1iVziE9D69FBcWHTKBCtH7UVGOtDnunWSCxCq-i1OeeE3jeFsQtDKxxnhsngWzWBae8uh52HoKCqtJ86NhF708d09qwnf0aC7amwinEosMgqZGCbChhIGV3XTuraxtAUHvADlQlNLoLew9Cuki0b18Lw_Xf5SOP4_XawRYpkWWho1vwZsR9FmfTjYsF1-gMTkrXix_LSfjJrN-03Tmr0GAJngpWKBFFRJx2xGTJtmWxcTEaZQyYPg0VoYYziArQ&sai=AMfl-YQVkoNx5WNpqt72RMT6PAArVBltypybN6n5tEfN_P2ruVT4Y86-pT6ZKm6q8eQLZ4H08mV68_Kk823qTnjxI11Aa6O0KSVQokVifbNlSZ9X_XTUvOIVGAtjmfapvyWi&sig=Cg0ArKJSzDz5Mnelo-7kEAE&urlfix=1&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 21 Oct 2020 03:00:38 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H2 200 placement.js Show response
displayf-tm.everesttech.net/feed/ Frame 0B86 23 KB
4 KB 110ms
58ms Script
text/plain 151.101.130.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://displayf-tm.everesttech.net/feed/placement.js?id=Kxj2ilefT2dP544VKFNQ&site_id=42vc2CAK9ZQZTebpGwqV&rand=2934524081383684452&tm_auction_id=688e6f86-21c9-45c3-88a9-f595b9c971e4.1&didtype=UNK&bi=B09wtF9oVaJB7W9waAz-mdL5pNfPWWteA--_ExXKu-3IaXm2imcq5oZ9pJmkrYz5x1XU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVgnXLkpZPXVZkzdcVkRNYW1ZuWofgwkqJmb5N3NoOiTNzIKfSzAx5fICfImMOKd_u&page_url=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&seller_id=540705207&tm_user_agent=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&q=H4sIAAAAAAAAAG2RP0zUYBjGbY8T7gbE40jIDabeYIDY0u_rfxz0OLiD9ArH3YEnC_nafqUf12tLW-BwZGRBGUlMnHVzJOpg4uLg5OigcTOaEAYHJ0E0xug7vMOT9_kl7_Nkso_ePb_6te_LyMjg8NvCy3R2ItkNMbceBOseRiGJOSvoTprEtnHElewmjrZx1MCbWzhOcgfp0dNP6WJe721A4mGnBe26JIoremVhaezDtwMK5hN1o6E3Ss4uicRQh1CpCVX1wZvXT69M5-NmnbQXl4Brz865Xme1aW5bh1TPCO4Tz0OTEsczYwayiJ8EsXuLmfcT7DFnArPYZNoM4NeAuCaNM6Uw9PBdbOokmZQEhRNkZkyfaxm1m4xHOpipYqsTjDNlNwq6eFIVOJ4TAS9wMmCayEER-eU6ohhTkG1VUBwLqKJiQ0fAgmJpmi1jHjrQlI-pG7KqYtlRZRYCS2NFyRJYVUUa60iaZGqWpgAscuAzJQ08fA9yeRFuW7Bc0rXVpdUWNsPqzuZKYTBxI4ySMIiT83iZlHbp55zcPqUyksgrvAR55TuVryQu7yCMus17uluZjYyqAffoTNJlUTdmAdqn81Fishf1sDaJQw_tQu2Qzv0rP6H7YpLgZ3T_lt_xgx3_lK5k_6Byg3-fF_5LLg6LHM82WtMs5CEPeAhYIOylKtl0EGK_N3Ty6jFVSC03Z4rna_z3W1Mp0g2nr1XOGpjtJTjykVePiIXLITGIFQWLZ-Z2PbOfujxADVGj1FHqgnecYrP0jJ6jgVLMls8lF61jf6IPKhIPL1eWa7X5-lS_UWob8wszd6jrAH1cbh1TL34At2LiqdgCAAA*&click_url=https%3A%2F%2Fteachingaids-d.openx.net%2Fw%2F1.0%2Frc%3Fai%3D1c7f7f46-9295-4afe-8a8f-c464c6ced9f7%26ts%3D2DAABBgABAAECAAIBAAsAAgAAAgYcGAp6MVZaUjFnUXNvHBbcnaqXoary8qcBFqmvxojp5u6--AEAHBaAs8LEvLq00hkW1be-lOTHv9WGAQAWqJH9-AsVBBEoJDIwMGZhYzI3LWU1OGEtNGRjMC04YmZiLWRmNjc2OTRkZWJhNQAsHBUCABwVAgAcFQIAABwmwOnvgwQVBBUEJr7p74MEFu6G1IME1tIfFtIfFtIfFmQWZBZkFmQWjCkAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW9vahgAQWrL-6gAQW7v3sgwQW5vzsgwQVGBwUtAEUsAsAFQQmjCkWjCkWjCkRNQ4mjCkALCwWhpfKnMTht47RARa3uLTjyJqF1u4BABaokf34CwYo9vahgAQWrL-6gAQW5vzsgwQW7v3sgwQYCjQxMTc4NDkzNjAWxFwWjCklBBa6CRgGNDYxMTUxFQKW_tSGAxERGAJPWAx6FLgBFIQGABYCGANydGKBANwbBIgKYmlkX3NvdXJjZQVTU1JUQghiaWRfdXVpZCQ0ZTVhMTQ5My1iMjg3LTRjZDctYTA3NS01OTMwY2YzY2U2MGYYZGVsaXZlcnlfbWVkaXVtX2NhdGVnb3J5A1dFQiFyZXRyaWV2ZWRfZnJvbV9zc3J0Yl9lcG9jaF9taWxsaXMNMTYwMzI0OTIzNzAzNQCsOAZsZy5jb20AAAA%26r%3D&uoo=0&tm_os_group=other&tm_device_group=unknown
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.z-SNAPSHOT) /
Resource Hash: 547c1f6045c38b1742dda3108d3454dd647e70654229d7d85a39034cf8390709

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
vary: Accept-Encoding, User-Agent
x-pt: P=6006 0=0
access-control-allow-origin: *
x-cache: MISS
status: 200
x-region: EU-East
x-served-by: cache-cph20620-CPH
server: Jetty(9.4.z-SNAPSHOT)
x-timer: S1603249239.550710,VS0,VE40
x-failover: none
via: 1.1 varnish
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 ri
ox-delivery-prod-1-europe-west1.openx.net/w/1.0/ Frame 0B86 43 B
237 B 607ms
217ms Image
image/gif 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ox-delivery-prod-1-europe-west1.openx.net/w/1.0/ri?ai=1c7f7f46-9295-4afe-8a8f-c464c6ced9f7&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&ts=2DAABBgABAAECAAIBAAsAAgAAAgYcGAp6MVZaUjFnUXNvHBbcnaqXoary8qcBFqmvxojp5u6--AEAHBaAs8LEvLq00hkW1be-lOTHv9WGAQAWqJH9-AsVBBEoJDIwMGZhYzI3LWU1OGEtNGRjMC04YmZiLWRmNjc2OTRkZWJhNQAsHBUCABwVAgAcFQIAABwmwOnvgwQVBBUEJr7p74MEFu6G1IME1tIfFtIfFtIfFmQWZBZkFmQWjCkAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW9vahgAQWrL-6gAQW7v3sgwQW5vzsgwQVGBwUtAEUsAsAFQQmjCkWjCkWjCkRNQ4mjCkALCwWhpfKnMTht47RARa3uLTjyJqF1u4BABaokf34CwYo9vahgAQWrL-6gAQW5vzsgwQW7v3sgwQYCjQxMTc4NDkzNjAWxFwWjCklBBa6CRgGNDYxMTUxFQKW_tSGAxERGAJPWAx6FLgBFIQGABYCGANydGKBANwbBIgKYmlkX3NvdXJjZQVTU1JUQghiaWRfdXVpZCQ0ZTVhMTQ5My1iMjg3LTRjZDctYTA3NS01OTMwY2YzY2U2MGYYZGVsaXZlcnlfbWVkaXVtX2NhdGVnb3J5A1dFQiFyZXRyaWV2ZWRfZnJvbV9zc3J0Yl9lcG9jaF9taWxsaXMNMTYwMzI0OTIzNzAzNQCsOAZsZy5jb20AAAA
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.195.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:39 GMT
via: 1.1 google
server: OXGW/16.195.1
p3p: CP="CUR ADM OUR NOR STA NID"
status: 200
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK e.png
rtb-lb-event-tm-ams-tm.everesttech.net/rtb/ Frame 0B86 85 B
375 B 154ms
35ms Image
image/png 185.148.48.55
TUBEMOGUL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-lb-event-tm-ams-tm.everesttech.net/rtb/e.png?e=win&aid=688e6f86-21c9-45c3-88a9-f595b9c971e4.1&cp=2358112&slot=1&x_price=AAABdUkZ7DLJGzJbbu4G5MaqTlkpMyQLk1G5tg&ets=1603249237010&tz=Europe%2FBerlin&source=openx&fc=20&fci=1&country=DK&region=17&mc=48&ap=0&ut=0&vis=UNKNOWN&site=42vc2CAK9ZQZTebpGwqV&bp=2630000&curr=USD&exr=1.0&fid=Kxj2ilefT2dP544VKFNQ&c=4117849360&ccurr=USD&cuxr=1.0&a=461151&ca=711022&st=DISPLAY&sh=90&sw=728&rid=919&mp=143&psk=42vc2CAK9ZQZTebpGwqV&cfc=0&cfci=0&dur=-1&cityid=77035&metroid=-1&countryid=58&postalid=-1&duration=10&v=1&auth=AwsqeE_WjUMByPKviRsp_kugPT0&x_r=sUr3wQ
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.148.48.55 , Netherlands, ASN23539 (TUBEMOGUL, US),
Reverse DNS
Software: Jetty(9.4.z-SNAPSHOT) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:38 GMT
X-PT: P=332 0=0
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate
Connection: close
Server: Jetty(9.4.z-SNAPSHOT)
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 imp
statsf-tm.everesttech.net/stats/1/ Frame 0B86 85 B
354 B 192ms
123ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://statsf-tm.everesttech.net/stats/1/imp?sessId=688e6f86-21c9-45c3-88a9-f595b9c971e4.1&cpKey=t8jRKRAfyir4pK227L3G&mpKey=Kxj2ilefT2dP544VKFNQ&adKey=sSPiXOQ1hdEHhlkZSbvc&psId=42vc2CAK9ZQZTebpGwqV&burl=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&w=728&h=90&bi=B09wtF9oVaJB7W9waAz-mdL5pNfPWWteA--_ExXKu-3IaXm2imcq5oZ9pJmkrYz5x1XU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVgnXLkpZPXVZkzdcVkRNYW1ZuWofgwkqJmb5N3NoOiTNzIKfSzAx5fICfImMOKd_u&price=AAABdUkZ7DLJGzJbbu4G5MaqTlkpMyQLk1G5tg&PG=F&seller_id=540705207&campaignKey=Fth0faeamSYKhFErMGM2&bidderZone=tm-ams-1a&bidderHost=rtb-bidder-display29&bidderGroup=rtb-bidder-display&env=site&conn=unknown&s=H4sIAAAAAAAAAAHQAC__Dxtb6893ypAZ8ZJOT4jEZzcdLCUdmjQh3whULDKmkglcWRZBIPDBvfzef8w5n5GWcxhVCk0NAlfLFInxjozdLsC_4_BjsY4WBsa17gqABre1buISW5iOYLyevBV-pOmTKRDMLHYzNPntpNpTNomxpN2CHBCjQtjjDgi_yDl1AkYO1ToEZtmSZ27EDVt90xDyyNNO0HlwqygxjV44nmqTPQ7cDlpK09TBuHaX6XmP0Y-aPwOnpXJfVAAROlbGmMYlYZU3hZZBx7K3Jg9vMCmb_8UBYtXQAAAA&date=1603249237011&auth=e60758d20462cf5ed9ea1c4ae218335b&vinst=t&rurl=Unknown&wd=0
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.8.v20171121) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
via: 1.1 varnish
x-pt: P=400
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status: 200
x-cache-hits: 0
x-region: EU-East
content-length: 85
x-served-by: cache-fra19140-FRA
pragma: no-cache
server: Jetty(9.4.8.v20171121)
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 27ms
13ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a32b89473df6ced5953684278e431ae4a01141364fab23812960a0d69c5ab3ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1601937181905197"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6302
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame D545 0
0 190ms
190ms Fetch
image/gif 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstWRDAcT13BIP3glyL5KogqkbtFZ1pa77Pnw94KBwo3rrTvBALG5lhum6w87c-3p3QbszckLxmHIBhbn0vEo8eLaDhy2_7O47TERJ2321DvryB7WWgFc_aLDacA3FDNg3Rj53O0mYlmDHHqgXnADityFNM00IrH-yiLRHB3wb-7fR-heZ-lbJOoh6rF51dh-InRNfTT9S8SkGLsMffI2_SbMAdTzx6W44Ue6t6s7MYcpBQtge7Pwm7zCoj7WSc7kQK1n4X0eJV4ueBPYohu5KWpISaeOA&sai=AMfl-YSMS1bFXXz8d-8R-TtrTHUa0-Aw_7RERjFa2WZgBx-vW4O6NtwHey_tKerBqiJPXov9ENAZNLTsqYK0GmqUBubQAKJ1e-tdZHJ-2Zdc0xc34UudQgWzDbRu7TE7EkAs&sig=Cg0ArKJSzILG8Ri__YjmEAE&urlfix=1&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 21 Oct 2020 03:00:38 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H2 200 placement.js Show response
displayf-tm.everesttech.net/feed/ Frame D545 23 KB
4 KB 59ms
57ms Script
text/plain 151.101.130.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://displayf-tm.everesttech.net/feed/placement.js?id=Kxj2ilefT2dP544VKFNQ&site_id=42vc2CAK9ZQZTebpGwqV&rand=-7323601134905194093&tm_auction_id=395dac77-3868-4341-8481-6f97381fceb3.1&didtype=UNK&bi=B09AcQeBMT2tLWkKO7ku4jL-h8CvcoyGr88_kpswWgN5PMABH9yrw5gIVKMFdd3gWdOU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVo4ng6vfr9OBEqat2mWLeM-Xlbf_vb6QnPoPkjncPhGFzIKfSzAx5fICfImMOKd_u&page_url=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&seller_id=540705207&tm_user_agent=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&q=H4sIAAAAAAAAAG2Rz0_TYBjHbceA7QBkTkN2MHUHA8SW933brh0edAw6sSuMbfyQy_K2fbsVurZ072B4JPGCMUSOJCae9cZNDh5MvPgv6MHEmxcJiRw8CaIxRp_Dc_jm-X6S5_tNfDOLT5RG4_q1r48_DGfexJMTdCckQjMImh7BodsRrKA9abq2TSKhYNdItEWiKtnskg5N7cdHTz_Hs2m9t45cjzh1ZFdkSVrWtfnFsU9n-wxKU3W9qlcLzo4bSaGOkFIWS-rT9-9eDU-nbb_SJR7VIO7ilW7hgdTrlQ-YnhE8cj0PT8oC4MYMbLk-DTqtO9ycT4nHnQvcQo1b5SBoQKkhj3OFMPTICjF1l07KoiKIOW5Mv183yrc5z90gXIlYG8E4V2xFQZtMqqIABAkCUchBroYdHLm_XIcMZ4o5WxUVx4KqpNjIEYmoWPm8nSMAOcjMHTO3xLxsY0tReFHNqbwkSpBXJRXyOSeviCp0LGKKAvzCyIPPPsJUWkJbFioW9Pza4lqdmGFpe3M5M0RbEcE0DDr0Il4ulr_yc07unjIJWQIKkBFQvjNpjbaAgwlu1x7qLW02MkoG2mUTtM3jdoeHeI9NR9TkL-vhbbcTengHSAds6l_5JdvXcSk5Yge6_oYfbPunrJb8g0oN_X2e-S85e1USAF-tT_MIIAABgjwUd2NaMh6ExO-NnLx9wWRiS7WZ7MUa__3WVMxth9M3tPMGZnuURD72KpFrkWLoGq4VBQvn5tVKYi_WP8iMMKPMYeySdxzjk-yMnmKhkk0WL6QWbhJ_og8pMkD92lK5PFeZGjAKq8bc_Mw95ubrpqCfbR89_wHzb9wv2AIAAA**&click_url=https%3A%2F%2Fteachingaids-d.openx.net%2Fw%2F1.0%2Frc%3Fai%3D1c7f7f46-9295-4afe-8a8f-c464c6ced9f7%26ts%3D2DAABBgABAAECAAIBAAsAAgAAAgUcGApVVFhXWlVoeWhmHBbcnaqXoary8qcBFqmvxojp5u6--AEAHBbqrarb7YWKxx8W2Y_m8t3YjbWiAQAWqJH9-AsVBBEoJDIwMGZhYzI3LWU1OGEtNGRjMC04YmZiLWRmNjc2OTRkZWJhNQAsHBUCABwVAgAcFQIAABwm0unvgwQVBBUEJr7p74MEFu6G1IME1tIfFtIfFtIfFmQWZBZkFmQWjCkAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW9vahgAQWrL-6gAQWkP7sgwQW5vzsgwQVGBwU9AMU2AQAFQQmjCkWjCkWjCkRNQ4mjCkALCwWgo3Chued1t1yFpnFgf6Ymsj-9gEAFqiR_fgLBij29qGABBasv7qABBbm_OyDBBaQ_uyDBBgKNDExNzg0OTM1NxbEXBaMKSUEFroJGAY0NjExNTEVApb-1IYDEREYAk9YDHoU-AMU2gQAFgIYA3J0YoEA3BsEiApiaWRfc291cmNlBVNTUlRCCGJpZF91dWlkJGFjZDgzOTI3LWIzOGItNDc2OS1hZjcwLWUxZGNiZjgyNzJhYhhkZWxpdmVyeV9tZWRpdW1fY2F0ZWdvcnkDV0VCIXJldHJpZXZlZF9mcm9tX3NzcnRiX2Vwb2NoX21pbGxpcw0xNjAzMjQ5MjM3MDM4AKw4BmxnLmNvbQAAAA%26r%3D&uoo=0&tm_os_group=other&tm_device_group=unknown
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.z-SNAPSHOT) /
Resource Hash: b0cdf4390008c0a3a6f316560cb20600370a196f7632a06f2b53418ddced0ca8

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
vary: Accept-Encoding, User-Agent
x-pt: P=6247 0=0
access-control-allow-origin: *
x-cache: MISS
status: 200
x-region: EU-East
x-served-by: cache-cph20620-CPH
server: Jetty(9.4.z-SNAPSHOT)
x-timer: S1603249239.590006,VS0,VE39
x-failover: none
via: 1.1 varnish
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 ri
ox-delivery-prod-1-europe-west1.openx.net/w/1.0/ Frame D545 43 B
105 B 520ms
220ms Image
image/gif 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ox-delivery-prod-1-europe-west1.openx.net/w/1.0/ri?ai=1c7f7f46-9295-4afe-8a8f-c464c6ced9f7&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&ts=2DAABBgABAAECAAIBAAsAAgAAAgUcGApVVFhXWlVoeWhmHBbcnaqXoary8qcBFqmvxojp5u6--AEAHBbqrarb7YWKxx8W2Y_m8t3YjbWiAQAWqJH9-AsVBBEoJDIwMGZhYzI3LWU1OGEtNGRjMC04YmZiLWRmNjc2OTRkZWJhNQAsHBUCABwVAgAcFQIAABwm0unvgwQVBBUEJr7p74MEFu6G1IME1tIfFtIfFtIfFmQWZBZkFmQWjCkAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW9vahgAQWrL-6gAQWkP7sgwQW5vzsgwQVGBwU9AMU2AQAFQQmjCkWjCkWjCkRNQ4mjCkALCwWgo3Chued1t1yFpnFgf6Ymsj-9gEAFqiR_fgLBij29qGABBasv7qABBbm_OyDBBaQ_uyDBBgKNDExNzg0OTM1NxbEXBaMKSUEFroJGAY0NjExNTEVApb-1IYDEREYAk9YDHoU-AMU2gQAFgIYA3J0YoEA3BsEiApiaWRfc291cmNlBVNTUlRCCGJpZF91dWlkJGFjZDgzOTI3LWIzOGItNDc2OS1hZjcwLWUxZGNiZjgyNzJhYhhkZWxpdmVyeV9tZWRpdW1fY2F0ZWdvcnkDV0VCIXJldHJpZXZlZF9mcm9tX3NzcnRiX2Vwb2NoX21pbGxpcw0xNjAzMjQ5MjM3MDM4AKw4BmxnLmNvbQAAAA
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.195.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:39 GMT
via: 1.1 google
server: OXGW/16.195.1
p3p: CP="CUR ADM OUR NOR STA NID"
status: 200
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK e.png
rtb-lb-event-tm-ams-tm.everesttech.net/rtb/ Frame D545 85 B
375 B 137ms
35ms Image
image/png 185.148.48.55
TUBEMOGUL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-lb-event-tm-ams-tm.everesttech.net/rtb/e.png?e=win&aid=395dac77-3868-4341-8481-6f97381fceb3.1&cp=2358112&slot=1&x_price=AAABdUkZ7DTrsVBRv70xDdNF9upMvWPXZLVbGw&ets=1603249237008&tz=Europe%2FBerlin&source=openx&fc=20&fci=1&country=DK&region=17&mc=48&ap=0&ut=0&vis=UNKNOWN&site=42vc2CAK9ZQZTebpGwqV&bp=2630000&curr=USD&exr=1.0&fid=Kxj2ilefT2dP544VKFNQ&c=4117849357&ccurr=USD&cuxr=1.0&a=461151&ca=711022&st=DISPLAY&sh=250&sw=300&rid=919&mp=143&psk=42vc2CAK9ZQZTebpGwqV&cfc=0&cfci=0&dur=-1&cityid=77035&metroid=-1&countryid=58&postalid=-1&duration=10&v=1&auth=k-atLiNrBdV4W95GXgbmmwRhSM4&x_r=amrzWQ
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.148.48.55 , Netherlands, ASN23539 (TUBEMOGUL, US),
Reverse DNS
Software: Jetty(9.4.z-SNAPSHOT) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:38 GMT
X-PT: P=275 0=0
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate
Connection: close
Server: Jetty(9.4.z-SNAPSHOT)
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 imp
statsf-tm.everesttech.net/stats/1/ Frame D545 85 B
130 B 124ms
124ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://statsf-tm.everesttech.net/stats/1/imp?sessId=395dac77-3868-4341-8481-6f97381fceb3.1&cpKey=t8jRKRAfyir4pK227L3G&mpKey=Kxj2ilefT2dP544VKFNQ&adKey=dnPueltF1auaWuAJ4xxL&psId=42vc2CAK9ZQZTebpGwqV&burl=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&w=300&h=250&bi=B09AcQeBMT2tLWkKO7ku4jL-h8CvcoyGr88_kpswWgN5PMABH9yrw5gIVKMFdd3gWdOU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVo4ng6vfr9OBEqat2mWLeM-Xlbf_vb6QnPoPkjncPhGFzIKfSzAx5fICfImMOKd_u&price=AAABdUkZ7DTrsVBRv70xDdNF9upMvWPXZLVbGw&PG=F&seller_id=540705207&campaignKey=Fth0faeamSYKhFErMGM2&bidderZone=tm-ams-1a&bidderHost=rtb-bidder-display04&bidderGroup=rtb-bidder-display&env=site&conn=unknown&s=H4sIAAAAAAAAAAHQAC__hrt6qfvcF0X5CQG4TfatEz_l1PSRmt-9MP3rTBMALLP1M9_9jSzHF9ymEGeTPMCntomhHFtghHo1T-9UaML9Lqdn4pJcn11BMtMw6ZvlVkcPXVEVFdETrs_woveQwKU3Tnu_FJwry00m12aASE23qQ4XlbqsbVIEHGiVgh6Ugdiminam50v3mtPy1C4GcSkBUZS4OgyfgCGtphQ17yI5RpPtXb7KArCCWL7vF3JDsJyHlOcBT-qTSEY77PBK__UxlL2gmwG1qhTTEmEP9o13f-S06qfQAAAA&date=1603249237010&auth=b24e56ea4087304d3cc26f21e0f94b06&vinst=t&rurl=Unknown&wd=0
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.8.v20171121) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
via: 1.1 varnish
x-pt: P=238
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status: 200
x-cache-hits: 0
x-region: EU-East
content-length: 85
x-served-by: cache-fra19140-FRA
pragma: no-cache
server: Jetty(9.4.8.v20171121)
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame D8C8 0
0 193ms
193ms Fetch
image/gif 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssEPlXq7dv8N_a095X3KNdd0T93tAqm4tOGRLy3SQTe7xS_niQszA3wxv4BB34hbhWyJVYTN3eXIFXMpHXaH_lflwv6ikNdGnD5F0Hb2issYuBgCx-4cppexLeOeX9oaECjidVnS0AKkt4-XIOHpF2crssHM--FLaRW2RhaFeGkW25vbRIX5D5O540MV_K4m75yoXUyYBAWIlXuVF7mrhoUe8Boc1eFYC_eJROgr0-pE2DFyFrVFG0xlky-4hi2yNIk-L71MDVI62HsaqKOaUQoBImQ9Q&sai=AMfl-YRMvznhkl9_PWqa21RhMUW4nYY-zdMizadbeazfirRswD0jc5GE-K3mfPJEU8FfNw-3rYFpxvpyPME4DDavvGZlrP2gHHtEPqpga1JsSVxxnhxDLTwTO434nOz78r9m&sig=Cg0ArKJSzCbOq4DOn_MbEAE&urlfix=1&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 21 Oct 2020 03:00:38 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H2 200 placement.js Show response
displayf-tm.everesttech.net/feed/ Frame D8C8 23 KB
4 KB 59ms
58ms Script
text/plain 151.101.130.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://displayf-tm.everesttech.net/feed/placement.js?id=Kxj2ilefT2dP544VKFNQ&site_id=42vc2CAK9ZQZTebpGwqV&rand=6640366496795808057&tm_auction_id=5a42b701-f33d-4eb7-bbda-6b4f5f6db3ca.1&didtype=UNK&bi=B09pLzRCtwSuxt2hMVk_ECY-Pw6lHu9EwGsnbarrq8lVHaUmV_3ZqZuukg5Ijb29aOjU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVo4ng6vfr9OBEqat2mWLeM-Xlbf_vb6QnPoPkjncPhGFzIKfSzAx5fICfImMOKd_u&page_url=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&seller_id=540705207&tm_user_agent=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&q=H4sIAAAAAAAAAG2RP0wTYRjGvSsF2gGx1oR0MGcHA8S7fvfdvxYHLYWreD0obfkjC_nu7jv6wfXuuH6F4shIYoiMTA5O6uTI4EB0Mbo4O5g4mBgHwqCJOgiiMUbf4R2evM8veZ8ncfjpW2vhdSW4dGH_VSrzLJ4cpVshFlaCYMXDKCRtwQ5aOYs4Do6EolPH0QaOani9g9s0tRsfOn4fz6aN7iokHnYb0Kkqsjxv6NOzw-8-7zIwTfOrNaNWdLdIJIcGhFpFKufvvXzx-Px42vGrHexRXUQdtNAp3pa73coe0zWDu8TzUE4RADdsIpv4NGg3r3NTPsUedyJwM3VukRPBsigvKyNcMQw9vIAtg9CcImmCpHLDxq2GWbnGeWQNc2VsrwUjXKkZBS2cy0sCEGQRSIIqcnXkooj8cu0znCWpTl7SXFvMy5oDXQlLml0oOCoG0IWWesBcVZAMLQ2IvCtJDi9jS-Mty0G8asmu4qqOJdlIED8ySv_9t2IqLcMNG5aKRmFpdqmBrbC8uT6fGaDNCCMaBm16Gi8XK5z7OUc3jpmEIgMNKBBoX5m0TpvARRi16neMpj4ZmWUTbrMJ2uJRq82LaIdNR9Tiz-rhHdIOPbQlKXts6l_5EdvTJhQ_Zfs6_pofbPrHrJ78g0oN_H2e-S85e1EWAF9rjPMQQCACKPKitB3Tk_EgxH538OjwAZOJzdUnsqdr5PdbYzHSCscv6ycNTHYpjnzkVSNi41JITGJHwcyJebGa2In19jODzBCzHzvjHcT4JDthpFhRyyZLp1ITrWB_tAdqCoC9-lylMlUd6zOLi-bU9MRN5sqTN0dfvj__8PAHeSBV-NgCAAA*&click_url=https%3A%2F%2Fteachingaids-d.openx.net%2Fw%2F1.0%2Frc%3Fai%3D1c7f7f46-9295-4afe-8a8f-c464c6ced9f7%26ts%3D2DAABBgABAAECAAIBAAsAAgAAAgYcGApBQlV0eERtak9iHBbcnaqXoary8qcBFqmvxojp5u6--AEAHBah6u2d_5npxyYW75Pf9ZOk9M7vAQAWqJH9-AsVBBEoJDIwMGZhYzI3LWU1OGEtNGRjMC04YmZiLWRmNjc2OTRkZWJhNQAsHBUCABwVAgAcFQIAABwm1unvgwQVBBUEJr7p74MEFu6G1IME1tIfFtIfFtIfFmQWZBZkFmQWjCkAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW9vahgAQWrL-6gAQWkP7sgwQW5vzsgwQVGBwU9AMU2AQAFQQmjCkWjCkWjCkRNQ4mjCkALCwW7rrqs77A28K0ARbrsJKJlKzKpYgBABaokf34CwYo9vahgAQWrL-6gAQW5vzsgwQWkP7sgwQYCjQxMTc4NDkzNTcWxFwWjCklBBa6CRgGNDYxMTUxFQKW_tSGAxERGAJPWAx6FPgDFNoEABYCGANydGKBANwbBIgKYmlkX3NvdXJjZQVTU1JUQghiaWRfdXVpZCRiMTYxNGRlOS0xZDFlLTRmNzYtYTA0OC0wMGE4ZDA5M2U2NjgYZGVsaXZlcnlfbWVkaXVtX2NhdGVnb3J5A1dFQiFyZXRyaWV2ZWRfZnJvbV9zc3J0Yl9lcG9jaF9taWxsaXMNMTYwMzI0OTIzNzAzOQCsOAZsZy5jb20AAAA%26r%3D&uoo=0&tm_os_group=other&tm_device_group=unknown
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.z-SNAPSHOT) /
Resource Hash: ece45974d4ef75b5c717db442d421ad39822e5b7e024e3832e99d6dfac9b4431

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
vary: Accept-Encoding, User-Agent
x-pt: P=6286 0=0
access-control-allow-origin: *
x-cache: MISS
status: 200
x-region: EU-East
x-served-by: cache-cph20620-CPH
server: Jetty(9.4.z-SNAPSHOT)
x-timer: S1603249239.650809,VS0,VE40
x-failover: none
via: 1.1 varnish
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 ri
ox-delivery-prod-1-europe-west1.openx.net/w/1.0/ Frame D8C8 43 B
105 B 458ms
218ms Image
image/gif 34.95.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ox-delivery-prod-1-europe-west1.openx.net/w/1.0/ri?ai=1c7f7f46-9295-4afe-8a8f-c464c6ced9f7&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&ts=2DAABBgABAAECAAIBAAsAAgAAAgYcGApBQlV0eERtak9iHBbcnaqXoary8qcBFqmvxojp5u6--AEAHBah6u2d_5npxyYW75Pf9ZOk9M7vAQAWqJH9-AsVBBEoJDIwMGZhYzI3LWU1OGEtNGRjMC04YmZiLWRmNjc2OTRkZWJhNQAsHBUCABwVAgAcFQIAABwm1unvgwQVBBUEJr7p74MEFu6G1IME1tIfFtIfFtIfFmQWZBZkFmQWjCkAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW9vahgAQWrL-6gAQWkP7sgwQW5vzsgwQVGBwU9AMU2AQAFQQmjCkWjCkWjCkRNQ4mjCkALCwW7rrqs77A28K0ARbrsJKJlKzKpYgBABaokf34CwYo9vahgAQWrL-6gAQW5vzsgwQWkP7sgwQYCjQxMTc4NDkzNTcWxFwWjCklBBa6CRgGNDYxMTUxFQKW_tSGAxERGAJPWAx6FPgDFNoEABYCGANydGKBANwbBIgKYmlkX3NvdXJjZQVTU1JUQghiaWRfdXVpZCRiMTYxNGRlOS0xZDFlLTRmNzYtYTA0OC0wMGE4ZDA5M2U2NjgYZGVsaXZlcnlfbWVkaXVtX2NhdGVnb3J5A1dFQiFyZXRyaWV2ZWRfZnJvbV9zc3J0Yl9lcG9jaF9taWxsaXMNMTYwMzI0OTIzNzAzOQCsOAZsZy5jb20AAAA
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.195.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:39 GMT
via: 1.1 google
server: OXGW/16.195.1
p3p: CP="CUR ADM OUR NOR STA NID"
status: 200
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK e.png
rtb-lb-event-tm-ams-tm.everesttech.net/rtb/ Frame D8C8 85 B
375 B 105ms
35ms Image
image/png 185.148.48.55
TUBEMOGUL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-lb-event-tm-ams-tm.everesttech.net/rtb/e.png?e=win&aid=5a42b701-f33d-4eb7-bbda-6b4f5f6db3ca.1&cp=2358112&slot=1&x_price=AAABdUkZ7DV1LnNkUNcFrRVPbr5P19W8Kth8xg&ets=1603249237006&tz=Europe%2FBerlin&source=openx&fc=20&fci=1&country=DK&region=17&mc=48&ap=0&ut=0&vis=UNKNOWN&site=42vc2CAK9ZQZTebpGwqV&bp=2630000&curr=USD&exr=1.0&fid=Kxj2ilefT2dP544VKFNQ&c=4117849357&ccurr=USD&cuxr=1.0&a=461151&ca=711022&st=DISPLAY&sh=250&sw=300&rid=919&mp=143&psk=42vc2CAK9ZQZTebpGwqV&cfc=0&cfci=0&dur=-1&cityid=77035&metroid=-1&countryid=58&postalid=-1&duration=10&v=1&auth=xmL_vdTypUWpmm3TOelm42UCTPA&x_r=1J83jg
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.148.48.55 , Netherlands, ASN23539 (TUBEMOGUL, US),
Reverse DNS
Software: Jetty(9.4.z-SNAPSHOT) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:38 GMT
X-PT: P=285 0=0
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate
Connection: close
Server: Jetty(9.4.z-SNAPSHOT)
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 imp
statsf-tm.everesttech.net/stats/1/ Frame D8C8 85 B
152 B 404ms
404ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://statsf-tm.everesttech.net/stats/1/imp?sessId=5a42b701-f33d-4eb7-bbda-6b4f5f6db3ca.1&cpKey=t8jRKRAfyir4pK227L3G&mpKey=Kxj2ilefT2dP544VKFNQ&adKey=dnPueltF1auaWuAJ4xxL&psId=42vc2CAK9ZQZTebpGwqV&burl=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&w=300&h=250&bi=B09pLzRCtwSuxt2hMVk_ECY-Pw6lHu9EwGsnbarrq8lVHaUmV_3ZqZuukg5Ijb29aOjU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVo4ng6vfr9OBEqat2mWLeM-Xlbf_vb6QnPoPkjncPhGFzIKfSzAx5fICfImMOKd_u&price=AAABdUkZ7DV1LnNkUNcFrRVPbr5P19W8Kth8xg&PG=F&seller_id=540705207&campaignKey=Fth0faeamSYKhFErMGM2&bidderZone=tm-ams-1a&bidderHost=rtb-bidder-display35&bidderGroup=rtb-bidder-display&env=site&conn=unknown&s=H4sIAAAAAAAAAAHQAC__ACR819Jdk2t9Jgzp7nxswD4_yEDkZ3ZWAfOKjw8NBhXQwi_U3e8snLnK5w3XqvTWxll0X5ghJx2zby0cZO52QilBhtVNS1hjq8SytfNGV0BVTPYrT4gdXy4lunvcUW5j5_xSTUSLIRPeKW2z87H2XMsuEMZC7SF4zVDLEiK6pymjEYyH6tohRy7pgQAASZItvOnUp0NBIe3q6uifgUGNz8T2jvLvUscVUTgoutPz7cEBj_6CpiP6S9ganaAfl9hrrtkog0tGFeN7dU6vgkJo_qMaz8PQAAAA&date=1603249237007&auth=0213425c8653509029359ec0b73da395&vinst=t&rurl=Unknown&wd=0
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.8.v20171121) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
via: 1.1 varnish
x-pt: P=184
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status: 200
x-cache-hits: 0
x-region: EU-East
content-length: 85
x-served-by: cache-fra19140-FRA
pragma: no-cache
server: Jetty(9.4.8.v20171121)
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame A7C2 0
0 193ms
193ms Fetch
image/gif 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssU0ZHQ5ssU0pPvMH3fKLi2vrEMfA8iCXZpR3lxV8frfdRnsOuJqYYqSGzWkYrw10k6ooGUVvA2XR_1yDtzh24Oi4hQ_pyJ-N-igsLTIvhFDhErHWbcXtppKvRRX_ZhXd5ckX6B2PWAcDQtNxS597rG7YnjBxtrHIHm7PJlQsPYX75xtEhwb6OmF1KR2wfRRvi0lsxWMZv2DpBx7b_W5cw-b2PoU95WWzXbupRXkR0hMvhwl1CkNsNe2xOvGev8pmd2bAapvAGeiPEl4YtiNA&sai=AMfl-YQlR40FH8-o1fHiCgoEVL7TbN6cejsJG3ZUZIfBzqJPF0dZDozfZrR_rykEXYXqiHWwcTreOOYgGZT-dO_jWJs3RPGANzzIBp_3peK9lhGxGvhTouZiXwteBA0mLkeJ&sig=Cg0ArKJSzE9SJA0uE3h5EAE&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 21 Oct 2020 03:00:38 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame A7C2 0
159 B 190ms
190ms Image
image/gif 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstgZX0nj6KwF-W0VzdBzPwAAIM2QjX_-E7dTosEqW2cUNySdyeJ4I5Tsd_rJVUU_xwOgZ6pBpFCCLw2MO1YrmKcf4DyIu5FMR1vV0VDyAqaKLcBSQY_iT1177wv_tbDno12GDBGFcxrotTj0VViVPCBqniSWwjq054GiwwIx2mm-icHEbMwr5iTfw-Vs0bjOUfVKg236SdrucGZLPzeqfeRLkyIvFdbwM2jwZ64YByUKdf29L454ZLznLVkXxEiMqGq2a6YB7u-wXXAZRrzvLU7&sai=AMfl-YQ3egFkfEc_owpqe9nvIULuAuwqFTvCuy7xN7FSxmcPaCrs7rsUll2EC4o8CmfJyLMrJfK0nI-c_KBWKoJWNIgTS3AY4MPIvKgLivdZlep5DGdPDuv9PnOuCUVNbTOC&sig=Cg0ArKJSzJiQMIVagpQ2EAE&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 21 Oct 2020 03:00:38 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 21 Oct 2020 03:00:38 GMT

GET
DATA 200
OK truncated
/ Frame A7C2 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b685a9d5446783028d80e6ee1e5b594030d290ab7aa0cb1392d65e314f379160

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0B86 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0aea9c7eb33dfe2476417b29441d3bb996fd49da89719f718d9af579d114d1cd

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame D545 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99e8873689e21de4d952fded0ee8a7d9cda044d86e09b8a28bd7b63ddd7cf223

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame D8C8 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0029dc7b6b47e3465a6c53c393b75e0b2de156033ad7e59d4e63e01bb49e806f

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/218/ Frame F5A0 0
0 6ms
6ms Document
text/html 2a00:1450:4001:816::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/218/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/218/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4867
date: Tue, 20 Oct 2020 22:58:01 GMT
expires: Wed, 20 Oct 2021 22:58:01 GMT
last-modified: Fri, 25 Sep 2020 19:26:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 14557
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 display-20200422.js Show response
playtime.tubemogul.com/ud/prod/ad_plugins/release/ Frame 311E 15 KB
5 KB 115ms
28ms Script
text/javascript 93.184.221.64
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://playtime.tubemogul.com/ud/prod/ad_plugins/release/display-20200422.js?auction_id=688e6f86-21c9-45c3-88a9-f595b9c971e4.1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.221.64 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ska/F78F) /
Resource Hash: d95737e9085d1883aab902de31e24aa714649559b1cb2b97e9857a8e4fb99b8c

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
last-modified: Wed, 22 Apr 2020 22:11:50 GMT
server: ECAcc (ska/F78F)
age: 8642
status: 200
etag: "1497680590"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 5412
expires: Thu, 22 Oct 2020 03:00:38 GMT

GET
H2 200 display-20200422.js Show response
playtime.tubemogul.com/ud/prod/ad_plugins/release/ Frame 763A 15 KB
5 KB 99ms
31ms Script
text/javascript 93.184.221.64
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://playtime.tubemogul.com/ud/prod/ad_plugins/release/display-20200422.js?auction_id=395dac77-3868-4341-8481-6f97381fceb3.1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.221.64 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ska/F78F) /
Resource Hash: d95737e9085d1883aab902de31e24aa714649559b1cb2b97e9857a8e4fb99b8c

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
last-modified: Wed, 22 Apr 2020 22:11:50 GMT
server: ECAcc (ska/F78F)
age: 8642
status: 200
etag: "1497680590"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 5412
expires: Thu, 22 Oct 2020 03:00:38 GMT

GET
H2 200 display-20200422.js Show response
playtime.tubemogul.com/ud/prod/ad_plugins/release/ Frame A2D8 15 KB
5 KB 76ms
33ms Script
text/javascript 93.184.221.64
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://playtime.tubemogul.com/ud/prod/ad_plugins/release/display-20200422.js?auction_id=5a42b701-f33d-4eb7-bbda-6b4f5f6db3ca.1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.221.64 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ska/F78F) /
Resource Hash: d95737e9085d1883aab902de31e24aa714649559b1cb2b97e9857a8e4fb99b8c

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:38 GMT
content-encoding: gzip
last-modified: Wed, 22 Apr 2020 22:11:50 GMT
server: ECAcc (ska/F78F)
age: 8642
status: 200
etag: "1497680590"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 5412
expires: Thu, 22 Oct 2020 03:00:38 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
200 B 16ms
15ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=218&t=2&li=gpt_2020101501&jk=1212914056381423&bg=!ExClEDDNAAUZK2QAGVjiig8bhC6bWwIAAABSUgAAAA4KAhoczBYNKSkeHprO7_y_WFVYZXYL-jrlHMCKZNhJZoCtbdqmRttCXZOH6DV-EAkpFWnC2ZTaSb7wnpVKkBOptT9gfWDW4UD6SyP0ViZPOFHtswaVpShPVLX76210Lum5bzNwC8XI1TWZeWyLIkOyOEYgRYQBSEWHeS92cMvQ1MKe9dDB8X5iGFOvUvU-lhAEaNOBJZLSrt2ZLgXjtkSPvGZ5Wxk-3DJZ27oULGvPyhlJfDUHkSCMTG4fQMn4uDnAW0wIMdsF9C9acliejYZWFBrbAyqvHvAch6WYtf03IZ2ODd1Vpl8F1EJnCu8xCoIR12l0h69IwPzhpbBSXPdYWNtIYl7nNHmJRRvuZ3eJ69MetiihqS0Jt6lyeq2L8sx4OQbUSvdUr54KMv1_bRZVk-CWVBib2OnW5XOQ8MLKH-Y5jYRI9uH2CGmHE4sMaEMmlkhk3pkx1RR0mlNxX_kUPIFzIxpby6RVRzaOPIdCRYGpb_11M9C0c9HG_iAjAp5x4ee-cFl6WXKN_BY8ZNY28IUVoUmkxxDqlVwFk9qZmonaWfCbVnFbI0--MNiZiVekXo416leZUc2pm9n6cBEW3uN6Wk0mdpzvH-4XjMKDLM7f1eWIzPxX85qtxQnJb3jF1zpYNwd9KOaD6AHKAw2Jd8Pd6f42A6NUXhrrwlfLqZmqx0HUyi1WGsaFQP3AtusnklCgbWRYDZAhOCMwmQGn3KYQptj-VfkdIXR2hdXN0UDsvjWF7dkiPaX_KZUuwwdMmtQKgBFzinLodCW_Zhp7nUJ_HrBJWaW6BTfq1rKFac6ubP9YDWKY4ylBg0kNBnmr83iCpwTJ4zuCX_GkFblTu3ZWjjiWCTgy4t-zQuvocabh41FquLXfiJXcH2dOxuOZUaanOdggUe3yQxlgBwDHVdrniCZIzvaAsdb4RzuDAiefomdH-SoeJOWmk2fbZUP6rp4n9tOgQxrLhlCuhMGvQIHR1nc3f1HFyIQVea9UZXtrNpWpcL4TXqlUqn8mAE4JHthzVHpjcOX-RFw5eGWZpHpOOPkGeB8_2nTe1bX5jiIHSFxrn4egfIOYQgeyVQVkBLlvrEtDlScqzIu5BrrD0W2inao6JKIYoH2YMDxaF4N2w6bb-WddK16JhdeGpLZ_tsDc8YEIvT3JTvSQeBqK5VPRool6KPC1jqWiMNIkNit7HhNEzC6ptzJHkLIj9d30sR7HVidegbjD3SiCpu49ibtxECufenvN8MiuOCXXvMkdr0O5BIoUg1Cx0kA7_trxbw882luc

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

B24755943.284036622;dc_pre=CKblo-vYxOwCFc_Fuwgd0NoBYg;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238575;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_cons...
ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/ Frame 311E
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238575;dc_lat=;dc_rdid=;tag_for_child_directed_trea...
https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_pre=CKblo-vYxOwCFc_Fuwgd0NoBYg;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238575;dc_lat=;dc...

42 B
64 B

441ms
244ms

Image
image/gif

142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_pre=CKblo-vYxOwCFc_Fuwgd0NoBYg;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238575;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D?

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.74.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:39 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_pre=CKblo-vYxOwCFc_Fuwgd0NoBYg;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238575;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D?
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 renderstart
statsf-tm.everesttech.net/stats/1/ Frame 311E 85 B
129 B 402ms
401ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://statsf-tm.everesttech.net/stats/1/renderstart?sessId=688e6f86-21c9-45c3-88a9-f595b9c971e4.1&price=&env=site&adKey=sSPiXOQ1hdEHhlkZSbvc&rt=HTML5&conn=unknown&did=&psId=42vc2CAK9ZQZTebpGwqV&didtype=UNK&s=H4sIAAAAAAAAAAEgAd_-TlweGxbfQBc3pjScPzRYf5d_WtetrCbsoYRlWPvZpi0_CSuvvfwhb29VlZhRu9RufG3eB2-OpNLXjEQ4j3Kyv6BPfP8JAvnC_7s3aSS7v60BKq-pPd6wdTjnqhhW8TBmuAvkrY-ywDbt2QEcJ4KEX2BizfIQdkZg5SfFtOlPvgIcqck63euab40fAsKFlvwT3SVdj4WE657CjLdDE1VMjmlUmLBL_7bdXd6zf2j6p77wqOy5aMNTsDagV0QvdtVrFTecOkESpfxCK3Lkc0AJ7qd4R1uqfLIxoiRJbx7YB4yZv8-HD5qxlauybQjhxtgrNsUrfHl3jHLwURJ6kI70ssz8AHYNgF39vY3JlzDzun0WjXk6pYvtQ_LZ0Odfju_0MjQ5MyABAAA&date=1603249238576&mpKey=Kxj2ilefT2dP544VKFNQ&bi=B09wtF9oVaJB7W9waAz-mdL5pNfPWWteA--_ExXKu-3IaXm2imcq5oZ9pJmkrYz5x1XU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVgnXLkpZPXVZkzdcVkRNYW1ZuWofgwkqJmb5N3NoOiTNzIKfSzAx5fICfImMOKd_u&cpKey=t8jRKRAfyir4pK227L3G&seller_id=540705207&auth=5a45c80790076b44f79e23729d70231f&PG=F&vinst=t&burl=about%3Ablank&rurl=https%3A%2F%2Fthreatpost.com&astv=20200624&apv=A20200422
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.8.v20171121) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
via: 1.1 varnish
x-pt: P=322
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status: 200
x-cache-hits: 0
x-region: EU-East
content-length: 85
x-served-by: cache-fra19140-FRA
pragma: no-cache
server: Jetty(9.4.8.v20171121)
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
expires: Wed, 21 Oct 2020 03:00:39 GMT

GET
H2 200 14492063_594826668.jpg
playtime.tubemogul.com/ad_overlays/ Frame 311E 57 KB
57 KB 31ms
30ms Image
image/jpeg 93.184.221.64
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://playtime.tubemogul.com/ad_overlays/14492063_594826668.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.221.64 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ska/F776) /
Resource Hash: 06ba0310ca5ed094903ff6524f0ebb8b27ee83c1c88ca5112e0ea6643205350e

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
last-modified: Thu, 08 Oct 2020 08:41:29 GMT
server: ECAcc (ska/F776)
age: 65876
etag: "2775283977"
status: 200
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 58062
expires: Thu, 22 Oct 2020 03:00:39 GMT

GET
H2 200 rendercomplete
statsf-tm.everesttech.net/stats/1/ Frame 311E 85 B
129 B 415ms
414ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://statsf-tm.everesttech.net/stats/1/rendercomplete?sessId=688e6f86-21c9-45c3-88a9-f595b9c971e4.1&price=&env=site&adKey=sSPiXOQ1hdEHhlkZSbvc&rt=HTML5&conn=unknown&did=&psId=42vc2CAK9ZQZTebpGwqV&didtype=UNK&s=H4sIAAAAAAAAAAEgAd_-TlweGxbfQBc3pjScPzRYf5d_WtetrCbsoYRlWPvZpi0_CSuvvfwhb29VlZhRu9RufG3eB2-OpNLXjEQ4j3Kyv6BPfP8JAvnC_7s3aSS7v60BKq-pPd6wdTjnqhhW8TBmuAvkrY-ywDbt2QEcJ4KEX2BizfIQdkZg5SfFtOlPvgIcqck63euab40fAsKFlvwT3SVdj4WE657CjLdDE1VMjmlUmLBL_7bdXd6zf2j6p77wqOy5aMNTsDagV0QvdtVrFTecOkESpfxCK3Lkc0AJ7qd4R1uqfLIxoiRJbx7YB4yZv8-HD5qxlauybQjhxtgrNsUrfHl3jHLwURJ6kI70ssz8AHYNgF39vY3JlzDzun0WjXk6pYvtQ_LZ0Odfju_0MjQ5MyABAAA&date=1603249238576&mpKey=Kxj2ilefT2dP544VKFNQ&bi=B09wtF9oVaJB7W9waAz-mdL5pNfPWWteA--_ExXKu-3IaXm2imcq5oZ9pJmkrYz5x1XU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVgnXLkpZPXVZkzdcVkRNYW1ZuWofgwkqJmb5N3NoOiTNzIKfSzAx5fICfImMOKd_u&cpKey=t8jRKRAfyir4pK227L3G&seller_id=540705207&auth=5a45c80790076b44f79e23729d70231f&PG=F&vinst=t&burl=about%3Ablank&rurl=https%3A%2F%2Fthreatpost.com&astv=20200624&apv=A20200422
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.8.v20171121) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
via: 1.1 varnish
x-pt: P=270
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status: 200
x-cache-hits: 0
x-region: EU-East
content-length: 85
x-served-by: cache-fra19140-FRA
pragma: no-cache
server: Jetty(9.4.8.v20171121)
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
expires: Wed, 21 Oct 2020 03:00:39 GMT

GET
H2 200 viewability-4ecc60.js Show response
playtime.tubemogul.com/ud/prod/pullins/ Frame 311E 13 KB
5 KB 32ms
32ms Script
text/javascript 93.184.221.64
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://playtime.tubemogul.com/ud/prod/pullins/viewability-4ecc60.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.221.64 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ska/F6E3) /
Resource Hash: acbb4843744ac6db6dbca6976f2cd20ed3cfffdbfc6f859272a4ce91ed0c816a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
content-encoding: gzip
last-modified: Sat, 17 Aug 2019 00:07:58 GMT
server: ECAcc (ska/F6E3)
age: 23864
status: 200
etag: "357480411"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 4629
expires: Thu, 22 Oct 2020 03:00:39 GMT

GET
H3-Q050

200

B24755943.284036622;dc_pre=CKjno-vYxOwCFSuAgwcdmckHNg;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238614;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_cons...
ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/ Frame 763A
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238614;dc_lat=;dc_rdid=;tag_for_child_directed_trea...
https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_pre=CKjno-vYxOwCFSuAgwcdmckHNg;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238614;dc_lat=;dc...

42 B
523 B

405ms
208ms

Image
image/gif

142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_pre=CKjno-vYxOwCFSuAgwcdmckHNg;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238614;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D?

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.74.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:39 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_pre=CKjno-vYxOwCFSuAgwcdmckHNg;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238614;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D?
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 renderstart
statsf-tm.everesttech.net/stats/1/ Frame 763A 85 B
129 B 125ms
124ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://statsf-tm.everesttech.net/stats/1/renderstart?price=&auth=361cb38920e3b729ad0618a22cc3c234&conn=unknown&mpKey=Kxj2ilefT2dP544VKFNQ&bi=B09AcQeBMT2tLWkKO7ku4jL-h8CvcoyGr88_kpswWgN5PMABH9yrw5gIVKMFdd3gWdOU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVo4ng6vfr9OBEqat2mWLeM-Xlbf_vb6QnPoPkjncPhGFzIKfSzAx5fICfImMOKd_u&did=&adKey=dnPueltF1auaWuAJ4xxL&s=H4sIAAAAAAAAAAEgAd_-qe4nyWVVRYEMGkd_YqySnG_NEuL680TtyH5_o4Bi8qDY8SF-hoNcD5eSqkKNxZ97LJO0nWchxEwRHEwoG-gs7AEvdWkjWrngfB2AD9Oe09t6NCFnQ1u-q1dh6ANe8Bum5WKYwWUkAU9Ce7CcnEAanaLGw9gBjO-72ThRuPR3DlJUrSl1s7TJDPGw_eYQ_aYRDl4785ektTzgCaiGwUAFquZ6epKIZjW7e5Glsd_hI5GoMkDnSGjzSNIP9nKIPx2emmvjx4mGeyc_qWq0Be39O7sXbDpmIPVcUOanIRH42ojuDZkwuVfXlyCauHFsbUhrC6Vf0_HhztUIpRhQgfqRmIuo-kpQpzZDRoWVrKszMDkXfYAS0yEgMUcXLydNY8TXVp8SFyABAAA&date=1603249238614&PG=F&cpKey=t8jRKRAfyir4pK227L3G&rt=HTML5&psId=42vc2CAK9ZQZTebpGwqV&env=site&sessId=395dac77-3868-4341-8481-6f97381fceb3.1&didtype=UNK&seller_id=540705207&vinst=t&burl=about%3Ablank&rurl=https%3A%2F%2Fthreatpost.com&astv=20200624&apv=A20200422
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.8.v20171121) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
via: 1.1 varnish
x-pt: P=280
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status: 200
x-cache-hits: 0
x-region: EU-East
content-length: 85
x-served-by: cache-fra19140-FRA
pragma: no-cache
server: Jetty(9.4.8.v20171121)
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
expires: Wed, 21 Oct 2020 03:00:39 GMT

GET
H2 200 14492051_1957681467.jpg
playtime.tubemogul.com/ad_overlays/ Frame 763A 64 KB
64 KB 28ms
27ms Image
image/jpeg 93.184.221.64
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://playtime.tubemogul.com/ad_overlays/14492051_1957681467.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.221.64 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ska/F6BA) /
Resource Hash: 6dcd2dd793a451a5a912d39e43bac99ea84d6dbdbd24aa7f0c23dbf840d2bc69

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
last-modified: Thu, 08 Oct 2020 08:41:03 GMT
server: ECAcc (ska/F6BA)
age: 65954
etag: "2302272967"
status: 200
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 65788
expires: Thu, 22 Oct 2020 03:00:39 GMT

GET
H2 200 rendercomplete
statsf-tm.everesttech.net/stats/1/ Frame 763A 85 B
153 B 123ms
123ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://statsf-tm.everesttech.net/stats/1/rendercomplete?price=&auth=361cb38920e3b729ad0618a22cc3c234&conn=unknown&mpKey=Kxj2ilefT2dP544VKFNQ&bi=B09AcQeBMT2tLWkKO7ku4jL-h8CvcoyGr88_kpswWgN5PMABH9yrw5gIVKMFdd3gWdOU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVo4ng6vfr9OBEqat2mWLeM-Xlbf_vb6QnPoPkjncPhGFzIKfSzAx5fICfImMOKd_u&did=&adKey=dnPueltF1auaWuAJ4xxL&s=H4sIAAAAAAAAAAEgAd_-qe4nyWVVRYEMGkd_YqySnG_NEuL680TtyH5_o4Bi8qDY8SF-hoNcD5eSqkKNxZ97LJO0nWchxEwRHEwoG-gs7AEvdWkjWrngfB2AD9Oe09t6NCFnQ1u-q1dh6ANe8Bum5WKYwWUkAU9Ce7CcnEAanaLGw9gBjO-72ThRuPR3DlJUrSl1s7TJDPGw_eYQ_aYRDl4785ektTzgCaiGwUAFquZ6epKIZjW7e5Glsd_hI5GoMkDnSGjzSNIP9nKIPx2emmvjx4mGeyc_qWq0Be39O7sXbDpmIPVcUOanIRH42ojuDZkwuVfXlyCauHFsbUhrC6Vf0_HhztUIpRhQgfqRmIuo-kpQpzZDRoWVrKszMDkXfYAS0yEgMUcXLydNY8TXVp8SFyABAAA&date=1603249238614&PG=F&cpKey=t8jRKRAfyir4pK227L3G&rt=HTML5&psId=42vc2CAK9ZQZTebpGwqV&env=site&sessId=395dac77-3868-4341-8481-6f97381fceb3.1&didtype=UNK&seller_id=540705207&vinst=t&burl=about%3Ablank&rurl=https%3A%2F%2Fthreatpost.com&astv=20200624&apv=A20200422
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.8.v20171121) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
via: 1.1 varnish
x-pt: P=260
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status: 200
x-cache-hits: 0
x-region: EU-East
content-length: 85
x-served-by: cache-fra19140-FRA
pragma: no-cache
server: Jetty(9.4.8.v20171121)
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
expires: Wed, 21 Oct 2020 03:00:39 GMT

GET
H2 200 viewability-4ecc60.js Show response
playtime.tubemogul.com/ud/prod/pullins/ Frame 763A 13 KB
5 KB 28ms
27ms Script
text/javascript 93.184.221.64
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://playtime.tubemogul.com/ud/prod/pullins/viewability-4ecc60.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.221.64 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ska/F6E3) /
Resource Hash: acbb4843744ac6db6dbca6976f2cd20ed3cfffdbfc6f859272a4ce91ed0c816a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
content-encoding: gzip
last-modified: Sat, 17 Aug 2019 00:07:58 GMT
server: ECAcc (ska/F6E3)
age: 23864
status: 200
etag: "357480411"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 4629
expires: Thu, 22 Oct 2020 03:00:39 GMT

GET
H2 200 14492051_1957681467.jpg
playtime.tubemogul.com/ad_overlays/ Frame A2D8 64 KB
64 KB 28ms
27ms Image
image/jpeg 93.184.221.64
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://playtime.tubemogul.com/ad_overlays/14492051_1957681467.jpg
Requested by: Host: playtime.tubemogul.com
URL: https://playtime.tubemogul.com/ud/prod/ad_plugins/release/display-20200422.js?auction_id=5a42b701-f33d-4eb7-bbda-6b4f5f6db3ca.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.221.64 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ska/F6BA) /
Resource Hash: 6dcd2dd793a451a5a912d39e43bac99ea84d6dbdbd24aa7f0c23dbf840d2bc69

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
last-modified: Thu, 08 Oct 2020 08:41:03 GMT
server: ECAcc (ska/F6BA)
age: 65954
etag: "2302272967"
status: 200
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 65788
expires: Thu, 22 Oct 2020 03:00:39 GMT

GET
H3-Q050

200

B24755943.284036622;dc_pre=CNvpo-vYxOwCFUSIOAodUywJ-Q;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238676;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_cons...
ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/ Frame A2D8
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238676;dc_lat=;dc_rdid=;tag_for_child_directed_trea...
https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_pre=CNvpo-vYxOwCFUSIOAodUywJ-Q;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238676;dc_lat=;dc...

42 B
64 B

440ms
243ms

Image
image/gif

142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_pre=CNvpo-vYxOwCFUSIOAodUywJ-Q;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238676;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D?

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.74.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:39 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N905548.3929476ADOBEADCLOUD_DK_H/B24755943.284036622;dc_pre=CNvpo-vYxOwCFUSIOAodUywJ-Q;dc_trk_aid=477910422;dc_trk_cid=138853949;ord=1603249238676;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D?
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 renderstart
statsf-tm.everesttech.net/stats/1/ Frame A2D8 85 B
129 B 126ms
125ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://statsf-tm.everesttech.net/stats/1/renderstart?sessId=5a42b701-f33d-4eb7-bbda-6b4f5f6db3ca.1&price=&env=site&adKey=dnPueltF1auaWuAJ4xxL&rt=HTML5&conn=unknown&did=&psId=42vc2CAK9ZQZTebpGwqV&didtype=UNK&s=H4sIAAAAAAAAAAEgAd_-EZX2N_WVos6uNvncuYTZDjJtBxFysoPCnveuTLUN-Q0acae5ENUHaEGS8fRilzqsLos1-A2UF5zoZ90CM2ZrXtGr9gE0Oafr-66iNoRXziApofqCRkhm6DfqRGo66De7pe_dQHdSoantB7M7rix-VW53OA_HRePvn0pPL7tThQhQQjvstOZwqzkGWxL-wcDrC84yJapEJFYugT8MSkNR_PKpMKboU7wwFE_ygLJMuLfhgKtq5_wVMjnZiTDeD4rkJdnSXRdoE8w2gakzqF8E_fyyPHbq0BzKryAt_-5mi5MiU_AMLHx6OtoIMngotyrTsTo4_xDjeC-J7Mnn7Q2nHU3fjOxpU36PrWCh90P1R8vsEMedvNDaR_l4iBoKdMaY6uM7dCABAAA&date=1603249238676&mpKey=Kxj2ilefT2dP544VKFNQ&bi=B09pLzRCtwSuxt2hMVk_ECY-Pw6lHu9EwGsnbarrq8lVHaUmV_3ZqZuukg5Ijb29aOjU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVo4ng6vfr9OBEqat2mWLeM-Xlbf_vb6QnPoPkjncPhGFzIKfSzAx5fICfImMOKd_u&cpKey=t8jRKRAfyir4pK227L3G&seller_id=540705207&auth=9e646a8a65ee2b6f045e611353385b16&PG=F&vinst=t&burl=about%3Ablank&rurl=https%3A%2F%2Fthreatpost.com&astv=20200624&apv=A20200422
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.8.v20171121) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
via: 1.1 varnish
x-pt: P=142
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status: 200
x-cache-hits: 0
x-region: EU-East
content-length: 85
x-served-by: cache-fra19140-FRA
pragma: no-cache
server: Jetty(9.4.8.v20171121)
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
expires: Wed, 21 Oct 2020 03:00:39 GMT

GET
H2 200 rendercomplete
statsf-tm.everesttech.net/stats/1/ Frame A2D8 85 B
129 B 119ms
118ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://statsf-tm.everesttech.net/stats/1/rendercomplete?sessId=5a42b701-f33d-4eb7-bbda-6b4f5f6db3ca.1&price=&env=site&adKey=dnPueltF1auaWuAJ4xxL&rt=HTML5&conn=unknown&did=&psId=42vc2CAK9ZQZTebpGwqV&didtype=UNK&s=H4sIAAAAAAAAAAEgAd_-EZX2N_WVos6uNvncuYTZDjJtBxFysoPCnveuTLUN-Q0acae5ENUHaEGS8fRilzqsLos1-A2UF5zoZ90CM2ZrXtGr9gE0Oafr-66iNoRXziApofqCRkhm6DfqRGo66De7pe_dQHdSoantB7M7rix-VW53OA_HRePvn0pPL7tThQhQQjvstOZwqzkGWxL-wcDrC84yJapEJFYugT8MSkNR_PKpMKboU7wwFE_ygLJMuLfhgKtq5_wVMjnZiTDeD4rkJdnSXRdoE8w2gakzqF8E_fyyPHbq0BzKryAt_-5mi5MiU_AMLHx6OtoIMngotyrTsTo4_xDjeC-J7Mnn7Q2nHU3fjOxpU36PrWCh90P1R8vsEMedvNDaR_l4iBoKdMaY6uM7dCABAAA&date=1603249238676&mpKey=Kxj2ilefT2dP544VKFNQ&bi=B09pLzRCtwSuxt2hMVk_ECY-Pw6lHu9EwGsnbarrq8lVHaUmV_3ZqZuukg5Ijb29aOjU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVo4ng6vfr9OBEqat2mWLeM-Xlbf_vb6QnPoPkjncPhGFzIKfSzAx5fICfImMOKd_u&cpKey=t8jRKRAfyir4pK227L3G&seller_id=540705207&auth=9e646a8a65ee2b6f045e611353385b16&PG=F&vinst=t&burl=about%3Ablank&rurl=https%3A%2F%2Fthreatpost.com&astv=20200624&apv=A20200422
Requested by: Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.8.v20171121) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
via: 1.1 varnish
x-pt: P=140
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status: 200
x-cache-hits: 0
x-region: EU-East
content-length: 85
x-served-by: cache-fra19140-FRA
pragma: no-cache
server: Jetty(9.4.8.v20171121)
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
expires: Wed, 21 Oct 2020 03:00:39 GMT

GET
H2 200 viewability-4ecc60.js Show response
playtime.tubemogul.com/ud/prod/pullins/ Frame A2D8 13 KB
5 KB 28ms
27ms Script
text/javascript 93.184.221.64
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://playtime.tubemogul.com/ud/prod/pullins/viewability-4ecc60.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.221.64 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ska/F6E3) /
Resource Hash: acbb4843744ac6db6dbca6976f2cd20ed3cfffdbfc6f859272a4ce91ed0c816a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:39 GMT
content-encoding: gzip
last-modified: Sat, 17 Aug 2019 00:07:58 GMT
server: ECAcc (ska/F6E3)
age: 23864
status: 200
etag: "357480411"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 4629
expires: Thu, 22 Oct 2020 03:00:39 GMT

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame 0B86 0
44 B 191ms
191ms Image
image/gif 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstYP9yicCzW5vCHOKuLW1lAFjv_-wmdjj2yhDb2HkFfS7-7sGfF9P2MZJOZl5f9GcKA1QzsOxKCBZ_maGSMy6jlSSPEZlC1GFg8b8_oZpy97TT2jqHgbHGzpRW6so8ieg7ZVtKBOZ7xv7vI0rMxBehM1gRmuyhj4aZ54uj5v8dv8wlhwvSCnJO4DmDtcJ5I2yxKYQLHwHGx9UYoaFStnRuAcl_LHwDXFb16ZxGJJgy0rnWC1aLjzO76z2Lj_BPgAEqp8kGAtChZJsqy3dPeU_7GhD0XfnYB&sai=AMfl-YROSG4mtvKDXJ0bk6OyPitCPP8U0cKWW5cYty4PonYg-POUfNVfKvT4g_10CaixSB8KgKrKblRU3-KGJwgdWvoHg8Bs6kaVehdyi4oZsgrTwD1uPqzSX-ZXOESLYZtG&sig=Cg0ArKJSzOQtM_88ZSyLEAE&urlfix=1&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 21 Oct 2020 03:00:39 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame D8C8 0
21 B 189ms
189ms Image
image/gif 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsutmhZYRky_vhwfwwZevIzdYFhCgTBM6p_KtCTFec04AKieHsHZ5Ep1fNhxzM2Zd4l1X07pWLJY32AC0_Wr-2dhPlQw4m46cqZrt7AHxBMA3snUa9qGMtCQgP8H8RqUbbOssUSHgA4jxDqW2QBOTvxcw5LD_8p28Oc3wmdDAodvEcqZ1jnXCHOryFZrqM6_KdkgArh4GpwBV_h_fEXECHYwsj0ay5Dh6orYVgb-st6EF4OvP5RbCJUtVfvosI2adadABze9trUtiD1EnDfx13eQ-CMzQXW2&sai=AMfl-YR7hskGA52El0KLa3o-A0ZMChNpXq1SIcGKaxsdXVG0PO7RV0zloxBHsAj3j0wZfN3HJ9h5A490Md10pTwiN_5_367z2bBw03dexM71ban8ZL40CsqJFM7d95wTHqZC&sig=Cg0ArKJSzOLTkK1PX3WWEAE&urlfix=1&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 21 Oct 2020 03:00:39 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame D545 0
21 B 192ms
192ms Image
image/gif 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst1vnv162SS4lRcYdpD1ES9o8uqty3AGsvF6N0ZvELt8CWrXJLKsK1JzqFLN_y8ioXb0RhOSiU6aLwoxNd7Vf5TVFd2l552a2vy0GRVZAy_TqsE-O9ZwwGC7t7eLUYG2l0zYUXAE_y5qqQs-gPFc7uvx6JgxXZTWGQiqisQY3WDQaYvXR1rShApyBb-zwEkhlfOf3g6HjkFcYmaq5GLhLcETRxGFdrG47KoExlwOC4z4m5G-LYZBUKNH_Z22wOY8CmSjVtvucPOaDmf75FbmJDXg5NZBvOS&sai=AMfl-YT2VkwUVJkbvVjwD0rP_mDVHVdZ9qLwNJPHV2eY1O1II35ArmkwPWEs1eum_v4uuSC5LKO_LN55lEs3y8SMNFEN76HUSaBhHKIQZjygQo40BvEzhvXFS3jHhfrle0nW&sig=Cg0ArKJSzCUeNjbj1am0EAE&urlfix=1&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 21 Oct 2020 03:00:39 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

POST
H/1.1 200
OK sv Show response
capi.connatix.com/tr/ Frame E218 0
323 B 122ms
122ms XHR
multipart/form-data 52.15.169.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sv?v=68605
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.169.204 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-15-169-204.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 21 Oct 2020 03:00:39 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 vimp
statsf-tm.everesttech.net/stats/1/ Frame 763A 85 B
176 B 127ms
126ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://statsf-tm.everesttech.net/stats/1/vimp?price=&auth=361cb38920e3b729ad0618a22cc3c234&conn=unknown&mpKey=Kxj2ilefT2dP544VKFNQ&bi=B09AcQeBMT2tLWkKO7ku4jL-h8CvcoyGr88_kpswWgN5PMABH9yrw5gIVKMFdd3gWdOU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVo4ng6vfr9OBEqat2mWLeM-Xlbf_vb6QnPoPkjncPhGFzIKfSzAx5fICfImMOKd_u&did=&adKey=dnPueltF1auaWuAJ4xxL&s=H4sIAAAAAAAAAAEgAd_-qe4nyWVVRYEMGkd_YqySnG_NEuL680TtyH5_o4Bi8qDY8SF-hoNcD5eSqkKNxZ97LJO0nWchxEwRHEwoG-gs7AEvdWkjWrngfB2AD9Oe09t6NCFnQ1u-q1dh6ANe8Bum5WKYwWUkAU9Ce7CcnEAanaLGw9gBjO-72ThRuPR3DlJUrSl1s7TJDPGw_eYQ_aYRDl4785ektTzgCaiGwUAFquZ6epKIZjW7e5Glsd_hI5GoMkDnSGjzSNIP9nKIPx2emmvjx4mGeyc_qWq0Be39O7sXbDpmIPVcUOanIRH42ojuDZkwuVfXlyCauHFsbUhrC6Vf0_HhztUIpRhQgfqRmIuo-kpQpzZDRoWVrKszMDkXfYAS0yEgMUcXLydNY8TXVp8SFyABAAA&date=1603249238614&PG=F&cpKey=t8jRKRAfyir4pK227L3G&rt=HTML5&psId=42vc2CAK9ZQZTebpGwqV&env=site&sessId=395dac77-3868-4341-8481-6f97381fceb3.1&didtype=UNK&seller_id=540705207&vinst=t&burl=about%3Ablank&rurl=https%3A%2F%2Fthreatpost.com&astv=20200624&apv=A20200422&w=300&h=250&pw=300&ph=250&vw=300&vh=250&vwbl=t&vver=20190817&vpct=100&ifr=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.8.v20171121) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:40 GMT
via: 1.1 varnish
x-pt: P=595
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status: 200
x-cache-hits: 0
x-region: EU-East
content-length: 85
x-served-by: cache-fra19140-FRA
pragma: no-cache
server: Jetty(9.4.8.v20171121)
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
expires: Wed, 21 Oct 2020 03:00:40 GMT

GET
H2 200 vimp
statsf-tm.everesttech.net/stats/1/ Frame 311E 85 B
130 B 123ms
123ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://statsf-tm.everesttech.net/stats/1/vimp?sessId=688e6f86-21c9-45c3-88a9-f595b9c971e4.1&price=&env=site&adKey=sSPiXOQ1hdEHhlkZSbvc&rt=HTML5&conn=unknown&did=&psId=42vc2CAK9ZQZTebpGwqV&didtype=UNK&s=H4sIAAAAAAAAAAEgAd_-TlweGxbfQBc3pjScPzRYf5d_WtetrCbsoYRlWPvZpi0_CSuvvfwhb29VlZhRu9RufG3eB2-OpNLXjEQ4j3Kyv6BPfP8JAvnC_7s3aSS7v60BKq-pPd6wdTjnqhhW8TBmuAvkrY-ywDbt2QEcJ4KEX2BizfIQdkZg5SfFtOlPvgIcqck63euab40fAsKFlvwT3SVdj4WE657CjLdDE1VMjmlUmLBL_7bdXd6zf2j6p77wqOy5aMNTsDagV0QvdtVrFTecOkESpfxCK3Lkc0AJ7qd4R1uqfLIxoiRJbx7YB4yZv8-HD5qxlauybQjhxtgrNsUrfHl3jHLwURJ6kI70ssz8AHYNgF39vY3JlzDzun0WjXk6pYvtQ_LZ0Odfju_0MjQ5MyABAAA&date=1603249238576&mpKey=Kxj2ilefT2dP544VKFNQ&bi=B09wtF9oVaJB7W9waAz-mdL5pNfPWWteA--_ExXKu-3IaXm2imcq5oZ9pJmkrYz5x1XU9vWk--HN7cJ7XUA3heJbDGlwhcQkYF-rBt15m7pRm8ExPIQlYhUXLUk2MMLLBeRoAL4EUt4hYX6xaGKzPrndN15KS_-S5NIujYNktHFJCQbP7kznu9Z1LBlSlSzdNqVgnXLkpZPXVZkzdcVkRNYW1ZuWofgwkqJmb5N3NoOiTNzIKfSzAx5fICfImMOKd_u&cpKey=t8jRKRAfyir4pK227L3G&seller_id=540705207&auth=5a45c80790076b44f79e23729d70231f&PG=F&vinst=t&burl=about%3Ablank&rurl=https%3A%2F%2Fthreatpost.com&astv=20200624&apv=A20200422&w=728&h=90&pw=728&ph=90&vw=728&vh=90&vwbl=t&vver=20190817&vpct=100&ifr=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.8.v20171121) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:40 GMT
via: 1.1 varnish
x-pt: P=189
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
status: 200
x-cache-hits: 0
x-region: EU-East
content-length: 85
x-served-by: cache-fra19140-FRA
pragma: no-cache
server: Jetty(9.4.8.v20171121)
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
expires: Wed, 21 Oct 2020 03:00:40 GMT

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 0B86 42 B
93 B 15ms
14ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsujwfC3tqQyTySbxSkjMS4I-xnK_PXDteRFuJnAfT8LdXtgR-wp1UdJcuYjjM05xEl1O5rIVjjsV4Ncq-VDL7cJPuKOmB07snMS8ccrsIo&sig=Cg0ArKJSzNd_P_N4N7lYEAE&adk=1015519800&tt=-1&bs=1600%2C1200&mtos=1010,1010,1010,1010,1010&tos=1010,0,0,0,0&p=10,436,100,1164&mcvt=1010&rs=3&ht=0&tfs=432&tls=1442&mc=1&lte=-1&bas=0&bac=0&met=ie&avms=nio&niot_obs=331&niot_cbk=340&md=2&btr=0&cpmav=0&lm=2&rst=1603249238341&dlt&rpt=490&isd=0&msd=0&xdi=0&postrxl=1&bmi=1&tmout=1&ps=1600%2C5454&scs=1600%2C1200&pt=-1&bin=4&deb=1-0-0-12-5-11-11-0-0-0&tvt=1439&is=728%2C90&iframe_loc=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&r=v&id=osdim&vs=4&uc=12&upc=2&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20201019

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame D545 42 B
65 B 15ms
15ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvzstiPuxOGhWK26WR3_DBlaT1kn93PnRPtpvfvziw44hTkSHo0-Ip-oldRuzsAiD5gZqQwnUGpb8ZRpuJCkNpoMzerA6yi79N6Md5E3XU&sig=Cg0ArKJSzGpj3WvMnJFPEAE&adk=654286612&tt=-1&bs=1600%2C1200&mtos=1009,1009,1009,1009,1009&tos=1009,0,0,0,0&p=257,1082,507,1382&mcvt=1009&rs=3&ht=0&tfs=420&tls=1429&mc=1&lte=-1&bas=0&bac=0&met=ie&avms=nio&niot_obs=319&niot_cbk=325&md=2&btr=0&cpmav=0&lm=2&rst=1603249238343&dlt&rpt=490&isd=0&msd=0&xdi=0&postrxl=1&bmi=1&tmout=1&ps=1600%2C5454&scs=1600%2C1200&pt=-1&bin=4&deb=1-0-0-12-4-11-11-0-0-0&tvt=1427&is=300%2C250&iframe_loc=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&r=v&id=osdim&vs=4&uc=12&upc=2&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20201019

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame CA51 0
0 95ms
31ms Document
text/html 151.101.113.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 17037
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: W/"5e7a2cb3-cefd"
Expires: Fri, 04 Sep 2020 06:04:52 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish 1.1 varnish
Accept-Ranges: bytes
Date: Wed, 21 Oct 2020 03:00:40 GMT
Age: 75255
X-Served-By: cache-lga21981-LGA, cache-hhn4029-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1, 666728
X-Timer: S1603249240.453915,VS0,VE0
Vary: Accept-Encoding

GET
H2

200

pd
u.openx.net/w/1.0/ Frame 017D
Redirect Chain

https://u.openx.net/w/1.0/pd
https://u.openx.net/w/1.0/pd?cc=1

0
0

214ms
214ms

Document
text/html

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd?cc=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=47579ecc-bbe8-47f7-8224-9dccded743b0|1603249240
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=47579ecc-bbe8-47f7-8224-9dccded743b0|1603249240; Version=1; Expires=Thu, 21-Oct-2021 03:00:40 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1603249240|gekin0vNiygu; Version=1; Expires=Thu, 05-Nov-2020 03:00:40 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.195.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 21 Oct 2020 03:00:40 GMT
content-type: text/html
content-length: 420
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

status: 302
set-cookie: i=47579ecc-bbe8-47f7-8224-9dccded743b0|1603249240; Version=1; Expires=Thu, 21-Oct-2021 03:00:40 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.195.1
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://u.openx.net/w/1.0/pd?cc=1
date: Wed, 21 Oct 2020 03:00:40 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 9335 0
0 92ms
30ms Document
text/html 151.101.113.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 17037
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: W/"5e7a2cb3-cefd"
Expires: Fri, 04 Sep 2020 06:04:52 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish 1.1 varnish
Accept-Ranges: bytes
Date: Wed, 21 Oct 2020 03:00:40 GMT
Age: 75254
X-Served-By: cache-lga21981-LGA, cache-hhn4051-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1, 694696
X-Timer: S1603249240.454066,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 70DE 0
0 101ms
33ms Document
text/html 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1136
Date: Wed, 21 Oct 2020 03:00:40 GMT
Connection: keep-alive

GET
H2

200

pd
u.openx.net/w/1.0/ Frame 3BBA
Redirect Chain

https://u.openx.net/w/1.0/pd
https://u.openx.net/w/1.0/pd?cc=1

0
0

215ms
215ms

Document
text/html

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd?cc=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=e4e4f180-6627-4a6e-bbe2-8853c3d1c108|1603249240
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=e4e4f180-6627-4a6e-bbe2-8853c3d1c108|1603249240; Version=1; Expires=Thu, 21-Oct-2021 03:00:40 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1603249240|gekin0vNiygu; Version=1; Expires=Thu, 05-Nov-2020 03:00:40 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.195.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 21 Oct 2020 03:00:40 GMT
content-type: text/html
content-length: 421
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

status: 302
set-cookie: i=e4e4f180-6627-4a6e-bbe2-8853c3d1c108|1603249240; Version=1; Expires=Thu, 21-Oct-2021 03:00:40 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.195.1
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://u.openx.net/w/1.0/pd?cc=1
date: Wed, 21 Oct 2020 03:00:40 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 65F5 0
0 96ms
32ms Document
text/html 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1136
Date: Wed, 21 Oct 2020 03:00:40 GMT
Connection: keep-alive

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 8297 0
0 107ms
34ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=78506
Expires: Thu, 22 Oct 2020 00:49:06 GMT
Date: Wed, 21 Oct 2020 03:00:40 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 1B64 0
0 112ms
34ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=78506
Expires: Thu, 22 Oct 2020 00:49:06 GMT
Date: Wed, 21 Oct 2020 03:00:40 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55986/ Frame E218
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_...
https://pixel.advertising.com/ups/55986/sync?uid=X4_kWAAAAHGB1zLL&_origin=0&gdpr=0&gdpr_consent=&_test=X4_kWAAAAHGB1zLL
https://pixel.advertising.com/ups/55986/sync?uid=X4_kWAAAAHGB1zLL&_origin=0&gdpr=0&gdpr_consent=&_test=X4_kWAAAAHGB1zLL&verify=true
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X4_kWAAAAHGB1zLL&_origin=0&gdpr=0&gdpr_consent=&_test=X4_kWAAAAHGB1zLL&apid=UP9a44e9df-1349-11eb-8a35-06f064b6781c

0
963 B

100ms
34ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55986/sync?uid=X4_kWAAAAHGB1zLL&_origin=0&gdpr=0&gdpr_consent=&_test=X4_kWAAAAHGB1zLL&apid=UP9a44e9df-1349-11eb-8a35-06f064b6781c

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 21 Oct 2020 03:00:40 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Wed, 21 Oct 2020 03:00:40 GMT
location: https://ups.analytics.yahoo.com/ups/55986/sync?uid=X4_kWAAAAHGB1zLL&_origin=0&gdpr=0&gdpr_consent=&_test=X4_kWAAAAHGB1zLL&apid=UP9a44e9df-1349-11eb-8a35-06f064b6781c
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame E218
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
https://pixel.advertising.com/ups/57304/sync?uid=CAESEISIfWuhsa0mJFhy_6lEbbg&google_cver=1
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEISIfWuhsa0mJFhy_6lEbbg&google_cver=1&apid=UP9a44e9df-1349-11eb-8a35-06f064b6781c

0
975 B

34ms
34ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEISIfWuhsa0mJFhy_6lEbbg&google_cver=1&apid=UP9a44e9df-1349-11eb-8a35-06f064b6781c

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 21 Oct 2020 03:00:40 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Wed, 21 Oct 2020 03:00:40 GMT
location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEISIfWuhsa0mJFhy_6lEbbg&google_cver=1&apid=UP9a44e9df-1349-11eb-8a35-06f064b6781c
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

sync
pixel.advertising.com/ups/55953/ Frame E218
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
https://pixel.advertising.com/ups/55953/sync?uid=aaf800f2-dc58-45fd-a68d-a390db7a2db6&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=aaf800f2-dc58-45fd-a68d-a390db7a2db6

0
124 B

111ms
42ms

Image
text/plain

52.28.254.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55953/sync?uid=aaf800f2-dc58-45fd-a68d-a390db7a2db6&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=aaf800f2-dc58-45fd-a68d-a390db7a2db6

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.254.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 21 Oct 2020 03:00:40 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:40 GMT
x-aspnet-version: 4.0.30319
status: 302
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.advertising.com/ups/55953/sync?uid=aaf800f2-dc58-45fd-a68d-a390db7a2db6&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=aaf800f2-dc58-45fd-a68d-a390db7a2db6
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 369

GET
H2 200 %7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame E218 43 B
839 B 130ms
41ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 03:00:40 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H/1.1 200
OK postback Show response
s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/ 0
145 B 49ms
49ms XHR
text/plain 18.203.131.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/postback?ui=00000000-0000-0000-0000-000000000000&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&to=3&dt=2341751597675869250012&di=threatpost.com&de=2&pv=371bf0ca-4de5-467b-846a-629d86778e70&ci=234175&md=2&ap=undefined&oz_tc=AB3vBSgD-gRLctQW&oz_sc=ed0aa95f6814ec014b3376d8&oz_st=1603249236997&oz_v=4.78.0&dp=threatpost.com&oz_df=4196&oz_l=341&cv=3
Requested by: Host: s.srvsynd.com
URL: https://s.srvsynd.com/2/4.78.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 21 Oct 2020 03:00:40 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

POST
H/1.1 200
OK abt Show response
capi.connatix.com/tr/ Frame E218 0
323 B 124ms
124ms XHR
multipart/form-data 52.15.169.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/abt?v=68605
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.169.204 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-15-169-204.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 21 Oct 2020 03:00:42 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK postback Show response
s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/ 0
145 B 49ms
49ms XHR
text/plain 18.203.131.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/postback?ui=00000000-0000-0000-0000-000000000000&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&to=3&dt=2341751597675869250012&di=threatpost.com&de=2&pv=371bf0ca-4de5-467b-846a-629d86778e70&ci=234175&md=2&ap=undefined&oz_tc=AB3vBSgD-gRLctQW&oz_sc=ed0aa95f6814ec014b3376d8&oz_st=1603249236997&oz_v=4.78.0&dp=threatpost.com&oz_df=5196&oz_l=649&cv=3
Requested by: Host: s.srvsynd.com
URL: https://s.srvsynd.com/2/4.78.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 21 Oct 2020 03:00:41 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2

200

sync
eb2.3lift.com/ Frame 553E
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

0
0

59ms
57ms

Document
text/html

54.93.138.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.93.138.105 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tluid=4386369254758921923
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

status: 200
date: Wed, 21 Oct 2020 03:00:42 GMT
content-type: text/html; charset=utf-8
content-length: 496
set-cookie: sync=CgoIgQIQwIXoyNQuCgoIoQEQwIXoyNQuCgoI4gEQwIXoyNQuCgoI5gEQwIXoyNQuCgoIhwIQwIXoyNQuCgkIORDAhejI1C4KCQg6EMCF6MjULgoJCAsQwIXoyNQuCgkIXxDAhejI1C4KCQgfEMCF6MjULg==; Max-Age=7776000; Expires=Tue, 19 Jan 2021 03:00:42 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=4386369254758921923; Max-Age=7776000; Expires=Tue, 19 Jan 2021 03:00:42 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

status: 302
date: Wed, 21 Oct 2020 03:00:42 GMT
content-length: 0
set-cookie: tluid=4386369254758921923; Max-Age=7776000; Expires=Tue, 19 Jan 2021 03:00:42 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 5229 0
0 31ms
31ms Document
text/html 151.101.113.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

Connection: keep-alive
Content-Length: 17037
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: W/"5e7a2cb3-cefd"
Expires: Fri, 04 Sep 2020 06:04:52 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish 1.1 varnish
Accept-Ranges: bytes
Date: Wed, 21 Oct 2020 03:00:42 GMT
Age: 75257
X-Served-By: cache-lga21981-LGA, cache-hhn4051-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1, 694704
X-Timer: S1603249243.616684,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame DCE9 0
0 50ms
49ms Document
text/html 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1136
Date: Wed, 21 Oct 2020 03:00:42 GMT
Connection: keep-alive

GET
H2 200 pd
eu-u.openx.net/w/1.0/ Frame 6B5C 0
0 215ms
214ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: pd=v2|1603249240|gekin0vNiygu; i=e4e4f180-6627-4a6e-bbe2-8853c3d1c108|1603249240
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=e4e4f180-6627-4a6e-bbe2-8853c3d1c108|1603249240; Version=1; Expires=Thu, 21-Oct-2021 03:00:42 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1603249240.2|kiiygevNgun0.mWgqsLommOns; Version=1; Expires=Thu, 05-Nov-2020 03:00:42 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.195.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 21 Oct 2020 03:00:42 GMT
content-type: text/html
content-length: 316
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H2 200 sync.html
public.servenobid.com/ Frame 0CF1 0
0 79ms
11ms Document
text/html 2620:1ec:bdf::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: public.servenobid.com
:scheme: https
:path: /sync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

status: 200
cache-control: max-age=86400
content-type: text/html
content-encoding: br
last-modified: Tue, 20 Oct 2020 23:27:37 GMT
accept-ranges: bytes
etag: "60c7d81779caee94eca54f716f095f91"
server: AmazonS3
x-cache: TCP_HIT
x-amz-id-2: 1oOstUdXoDgcNWAb+SWUymf5A1OmiNANQE76H2QEBQDeJNQK2GhHwKrO4jJT/P5F9rbPJ//BoI0=
x-amz-request-id: 0A9324FCFEDF034F
x-azure-ref-originshield: 0lHOPXwAAAAAMHbItjvsTQLNFOwTSyuJ3TE9OMjFFREdFMTUxOQA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref: 0WqSPXwAAAADl8RbMk0RbR67/tKUwIlWhRlJBMzFFREdFMDkwNgA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
date: Wed, 21 Oct 2020 03:00:41 GMT

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame AD7D 0
0 47ms
46ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; KCCH=YES; pi=156858:2; KADUSERCOOKIE=8AF3C88A-56B6-46D5-9A61-A964F7996673; chkChromeAb67Sec=1; DPSync3=1604448000%3A197_219_201%7C1603324800%3A174; SyncRTB3=1604448000%3A161_220_21_13_56_54; KRTBCOOKIE_377=22918-aaf800f2-dc58-45fd-a68d-a390db7a2db6&KRTB&23031-aaf800f2-dc58-45fd-a68d-a390db7a2db6; PUBMDCID=3; KRTBCOOKIE_391=22924-2389666468311196007; KRTBCOOKIE_336=5844-1933183322359585676; SPugT=1603249240; KRTBCOOKIE_80=16514-CAESEGhI04Zt0U_AlU5G1ToC22c&KRTB&22987-CAESEGhI04Zt0U_AlU5G1ToC22c&KRTB&23025-CAESEGhI04Zt0U_AlU5G1ToC22c; PugT=1603249241
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=78504
Expires: Thu, 22 Oct 2020 00:49:06 GMT
Date: Wed, 21 Oct 2020 03:00:42 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 5276 0
0 105ms
30ms Document
text/html 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.42.132 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Mon, 28 Sep 2020 17:02:39 GMT
ETag: "40295-123-5b062a240e9c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 238
Content-Type: text/html; charset=UTF-8
Date: Wed, 21 Oct 2020 03:00:42 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1

200
OK

2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 89B4
Redirect Chain

https://sync.serverbid.com/ss/2000891.html
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

0
0

275ms
91ms

Document
text/html

205.185.216.10
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/

Response headers

Date: Wed, 21 Oct 2020 03:00:43 GMT
Connection: Keep-Alive
Cache-Control: max-age=57550
Content-Length: 4947
Content-Type: text/html
Last-Modified: Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges: bytes
ETag: "1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id: tx00000000000000efef3a5-005f8f33a9-3eea0f7-nyc3a
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1603249243.dop208.sk1.t,1603249243.cds236.sk1.shn,1603249243.dop208.sk1.t,1603249243.cds036.sk1.c

Redirect headers

status: 302
content-length: 0
location: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control: no-cache

GET
H2 403 /
c1.adform.net/serving/cookie/match/ 0
187 B 22ms
19ms Image
text/plain 37.157.4.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match/?CC=1&party=15&gdpr=1&gdpr_consent=&curl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55944%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3d1%26gdpr_consent%3d

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:42 GMT
server: nginx
status: 403
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c3b87b9-a134-4b00-9459-e9d5d8afe79e%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253D4c3b87b9-a134-4b00-9459-e9d5d8afe79e%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID
https://prebid.a-mo.net/setuid?A=4c3b87b9-a134-4b00-9459-e9d5d8afe79e&D=&bidder=appnexus&uid=6236909604407324210

0
114 B

114ms
114ms

Image
text/plain

136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=4c3b87b9-a134-4b00-9459-e9d5d8afe79e&D=&bidder=appnexus&uid=6236909604407324210
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 21 Oct 2020 03:00:42 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy

Redirect headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:42 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.82:80
AN-X-Request-Uuid: 628cbc08-d11c-4a40-89a3-aece775151e2
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://prebid.a-mo.net/setuid?A=4c3b87b9-a134-4b00-9459-e9d5d8afe79e&D=&bidder=appnexus&uid=6236909604407324210
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 current
aol-match.dotomi.com/match/bounce/ 0
104 B 120ms
62ms Image
text/plain 2a02:fa8:8806:13::1430
VCLK-EU-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aol-match.dotomi.com/match/bounce/current?networkId=60&version=1&nuid=1A98197d50-1349-11eb-aa26-1249c31fdca2&gdpr=1&gdpr_consent=&rurl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55853%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1430 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Wed, 21 Oct 2020 03:00:42 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

204

sync
pixel.advertising.com/ups/55965/
Redirect Chain

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=hHo5aNAoNDacfzhogSwsbIN9OTmcfzk4hyV3Vp5d

0
124 B

36ms
36ms

Image
text/plain

52.28.254.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=hHo5aNAoNDacfzhogSwsbIN9OTmcfzk4hyV3Vp5d

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.254.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 21 Oct 2020 03:00:42 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:42 GMT
status: 302
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=hHo5aNAoNDacfzhogSwsbIN9OTmcfzk4hyV3Vp5d
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 sync
pixel.advertising.com/ups/56465/ 0
124 B 49ms
46ms Image
text/plain 52.28.254.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.254.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 21 Oct 2020 03:00:42 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
264 B 53ms
50ms Image
image/gif 34.249.135.160
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aoladtech&gdpr=1&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.135.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:42 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 200
cache-control: private,no-cache, must-revalidate
content-type: image/gif
content-length: 70

GET
H2

204

sync
pixel.advertising.com/ups/55946/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_hm=MUE5ODE5N2Q1MC0xMzQ5LTExZWItYWEyNi0xMjQ5YzMxZmRjYTI%3D&gdpr=1&gdpr_consent=&_origin=0
https://pixel.advertising.com/ups/55946/sync?uid=CAESEIbVbL_Z8IjERUHKa-2YaLo&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

0
124 B

39ms
33ms

Image
text/plain

52.28.254.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55946/sync?uid=CAESEIbVbL_Z8IjERUHKa-2YaLo&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.254.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 21 Oct 2020 03:00:42 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:42 GMT
server: HTTP server (unknown)
status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.advertising.com/ups/55946/sync?uid=CAESEIbVbL_Z8IjERUHKa-2YaLo&gdpr=1&gdpr_consent=&_origin=0&google_cver=1
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 334
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c3b87b9-a134-4b00-9459-e9d5d8afe79e%26D%3D%26bidder%3Dindex_rtb%26uid%3D
https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c3b87b9-a134-4b00-9459-e9d5d8afe79e%26D%3D%26bidder%3Dindex_rtb%26uid%3D&C=1
https://prebid.a-mo.net/setuid?A=4c3b87b9-a134-4b00-9459-e9d5d8afe79e&D=&bidder=index_rtb&uid=X4.kXLlQJLcAAHZFJ2IAAABI%26698

0
141 B

119ms
118ms

Image
text/plain

136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=4c3b87b9-a134-4b00-9459-e9d5d8afe79e&D=&bidder=index_rtb&uid=X4.kXLlQJLcAAHZFJ2IAAABI%26698
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 21 Oct 2020 03:00:44 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 6
server: envoy

Redirect headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:44 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://prebid.a-mo.net/setuid?A=4c3b87b9-a134-4b00-9459-e9d5d8afe79e&D=&bidder=index_rtb&uid=X4.kXLlQJLcAAHZFJ2IAAABI%26698
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 320
Expires: Wed, 21 Oct 2020 03:00:44 GMT

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c3b87b9-a134-4b00-9459-e9d5d8afe79e%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c3b87b9-a134-4b00-9459-e9d5d8afe79e%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID&sovrn_retry=true
https://prebid.a-mo.net/setuid?A=4c3b87b9-a134-4b00-9459-e9d5d8afe79e&D=&bidder=sovrn&uid=7de0e4fa93dafcadc7953f2f

0
140 B

115ms
115ms

Image
text/plain

136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=4c3b87b9-a134-4b00-9459-e9d5d8afe79e&D=&bidder=sovrn&uid=7de0e4fa93dafcadc7953f2f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 21 Oct 2020 03:00:42 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy

Redirect headers

Date: Wed, 21 Oct 2020 03:00:42 GMT
Server: nginx
Location: https://prebid.a-mo.net/setuid?A=4c3b87b9-a134-4b00-9459-e9d5d8afe79e&D=&bidder=sovrn&uid=7de0e4fa93dafcadc7953f2f
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

POST
H/1.1 200
OK postback Show response
s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/ 0
145 B 94ms
91ms XHR
text/plain 18.203.131.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.srvsynd.com/2/4.78.0/234175/AB3vBSgD-gRLctQW/postback?ui=00000000-0000-0000-0000-000000000000&sr=connatix.com&pp=329085709478694&ti=x518184472229981129035241816064&to=3&dt=2341751597675869250012&di=threatpost.com&de=2&pv=371bf0ca-4de5-467b-846a-629d86778e70&ci=234175&md=2&ap=undefined&oz_tc=AB3vBSgD-gRLctQW&oz_sc=ed0aa95f6814ec014b3376d8&oz_st=1603249236997&oz_v=4.78.0&dp=threatpost.com&oz_df=6263&oz_l=93&cv=3
Requested by: Host: s.srvsynd.com
URL: https://s.srvsynd.com/2/4.78.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.131.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/barnes-noble-hack-phishers-crooks/160148/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 21 Oct 2020 03:00:42 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

POST
H/1.1 200
OK st Show response
capi.connatix.com/tr/ Frame E218 0
323 B 122ms
122ms XHR
multipart/form-data 52.15.169.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/st?v=68605
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.15.169.204 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-15-169-204.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 21 Oct 2020 03:00:43 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame E218 0
59 B 84ms
83ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 21 Oct 2020 03:00:46 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame E218 92 B
282 B 227ms
226ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=14b86d66-7701-4fcc-9aa5-1ba79da68ea2&nocache=1603249247070&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882779&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:47 GMT
via: 1.1 google
server: OXGW/16.195.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame E218 0
59 B 79ms
79ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 21 Oct 2020 03:00:47 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET cygnus
as-sec.casalemedia.com/ Frame E218 0
0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame E218 19 B
710 B 34ms
33ms XHR
application/json 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:47 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.182:80
AN-X-Request-Uuid: c2298ea6-354b-4081-98d1-73d3515b7ca0
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame E218 0
215 B 38ms
38ms XHR
application/json 18.197.185.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.185.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-185-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame E218 92 B
282 B 223ms
222ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=e2c5c180-67a0-44cc-989f-c816860f249d&nocache=1603249247081&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882778&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 21 Oct 2020 03:00:47 GMT
via: 1.1 google
server: OXGW/16.195.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame E218 19 B
709 B 34ms
34ms XHR
application/json 185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 21 Oct 2020 03:00:47 GMT
X-Proxy-Origin: 82.102.20.235; 82.102.20.235; 718.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.17:80
AN-X-Request-Uuid: 08ffc2cb-685b-4cbf-908b-7aaf97b33c4b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 30ms
30ms Other 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Wed, 21 Oct 2020 03:00:48 GMT
x-served-by: cache-fra19144-FRA
x-cache: HIT
x-cache-hits: 0
x-timer: S1603249249.880461,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame E218 407 KB
407 KB 31ms
30ms XHR
video/mp4 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3edf0837f49625ad64af84f2a4d223b69ea99fb468ebbb2ece40286dbe64b6a1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=855192-1271452

Response headers

date: Wed, 21 Oct 2020 03:00:48 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 1963723
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5137-BWI, cache-fra19144-FRA
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 855192-1271452/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1603249249.910717,VS0,VE0
access-control-allow-origin: *
Content-Length: 416261
x-cache-hits: 2, 4

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: adserver-us.adtech.advertising.com
URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A98429974-1349-11eb-a249-12e1ea48904a;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=5757b8a8adb0631;misc=1603249236388

Domain: adserver-us.adtech.advertising.com
URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A984186e2-1349-11eb-93a5-12d220623a1c;cfp=1;rndc=1603249236;v=2;cmd=bid;cors=yes;alias=608a22ceaf3a146;misc=1603249236389

Domain: as-sec.casalemedia.com
URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435870&v=8.1&r=%7B%22id%22%3A%229df199e4f3f481%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2210aa0c358bfb6cf%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1

Domain: as-sec.casalemedia.com
URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435871&v=8.1&r=%7B%22id%22%3A%2233bef92387ca6e5%22%2C%22imp%22%3A%5B%7B%22id%22%3A%223441e5d24b391e6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1

Domain: as-sec.casalemedia.com
URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435870&v=8.1&r=%7B%22id%22%3A%22353a577be365f13%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22360e671020402f8%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fbarnes-noble-hack-phishers-crooks%2F160148%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1

Verdicts & Comments Add Verdict or Comment

309 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.threatpost.com/	1970-01-19 22:45:18	Name: __qca Value: P0-641523876-1603249236924
.threatpost.com/	1970-01-19 13:20:49	Name: _gat_UA-35676203-21 Value: 1
threatpost.com/	1970-01-19 22:06:25	Name: usprivacy Value: 1---
.threatpost.com/	1970-01-19 13:22:15	Name: _gid Value: GA1.2.1584199466.1603249236
.threatpost.com/	1970-01-20 06:52:01	Name: _ga Value: GA1.2.398866975.1603249236

59 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 372) Message: gBrowserWidth =1600
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-970x250-ATF div-gpt-ad-6794670-2
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x250-ATF div-gpt-ad-6794670-3
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x600-ATF div-gpt-ad-6794670-5
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-2x2-Skin div-gpt-ad-6794670-1
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: %cCMP: Startup v270 color: #555599
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: uspapi_init() - v0.105
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: USP: Locale=en-us gdpr= false
console-api	warning	URL: https://qd.admetricspro.com/js/threatpost/prebid.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: gAMPidentityLinkID not present, prebid configured without identyLink
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: final pbjs config
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Initial Ad Load
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: %cCMP: GVL version is 45 color: #555599
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch begin
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: checking non TCF vendor cookie
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing non-TCF consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP response tcData.eventStatus=cmpuishown tcData.cmpStatus=loaded
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP response tcData.eventStatus=cmpuishown tcData.cmpStatus=loaded
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: Locale=en-us gdpr= false
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: GDPR does not apply
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP response tcData.eventStatus=useractioncomplete tcData.cmpStatus=loaded
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=useractioncomplete
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Amazon bids returned, count=4
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: geo IP found region North Denmark
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: USP does not apply to North Denmark
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: Setting not applicable signal
console-api	warning	URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs bids returned
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gPBJSTimeoutTimer cleared
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): pbjsBidsBack
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getAdserverTargeting: >> Amazon >> Prebid
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getBidResponses:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gThisRefreshSlots=
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: console.groupEnd

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a26a165e8e9d5dd7aa15809c2f2fe6a7.safeframe.googlesyndication.com
acdn.adnxs.com
ad.doubleclick.net
ads.adaptv.advertising.com
ads.pubmatic.com
ads.servenobid.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.twitter.com
aol-match.dotomi.com
ap.lijit.com
as-sec.casalemedia.com
assets.threatpost.com
c.amazon-adsystem.com
c1.adform.net
capi.connatix.com
cd.connatix.com
cds.connatix.com
cm.g.doubleclick.net
displayf-tm.everesttech.net
e.serverbid.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
geo.ipify.org
graph.facebook.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
ib.adnxs.com
img.connatix.com
js-sec.indexww.com
kasperskycontenthub.com
match.adsrvr.org
media.threatpost.com
ox-delivery-prod-1-europe-west1.openx.net
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
platform.twitter.com
playtime.tubemogul.com
pr-bh.ybp.yahoo.com
prebid.a-mo.net
public.servenobid.com
qd.admetricspro.com
rtb-lb-event-tm-ams-tm.everesttech.net
rules.quantcount.com
s.srvsynd.com
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
ssum.casalemedia.com
static.ads-twitter.com
stats.g.doubleclick.net
statsf-tm.everesttech.net
sync-tm.everesttech.net
sync.serverbid.com
syndication.twitter.com
t.co
tagan.adlightning.com
teachingaids-d.openx.net
threatpost.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
vid.connatix.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
adserver-us.adtech.advertising.com
as-sec.casalemedia.com
104.111.215.135
104.244.42.136
104.244.42.5
104.244.42.67
136.144.59.88
142.250.74.198
151.101.112.157
151.101.113.108
151.101.130.49
151.101.14.137
151.101.14.49
165.227.252.242
172.217.23.162
18.156.0.31
18.197.185.70
18.203.131.207
185.148.48.55
185.33.221.53
185.64.189.112
199.232.53.140
2.18.233.180
2.18.234.21
205.185.216.10
206.189.254.17
216.58.206.2
23.37.42.132
2600:9000:2093:3800:6:44e3:f8c0:93a1
2600:9000:20eb:4a00:0:5c46:4f40:93a1
2600:9000:2156:1800:2:9275:3d40:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:4700:e6::ac40:c502
2620:116:800d:21:51e4:db4b:4436:b305
2620:1ec:21::14
2620:1ec:bdf::10
2a00:1288:110:c305::8000
2a00:1450:4001:800::2001
2a00:1450:4001:801::2001
2a00:1450:4001:802::2003
2a00:1450:4001:806::2008
2a00:1450:4001:808::200e
2a00:1450:4001:809::200e
2a00:1450:4001:80b::2002
2a00:1450:4001:816::2001
2a00:1450:4001:81b::2002
2a00:1450:4001:81e::2003
2a00:1450:4001:821::2004
2a00:1450:400c:c00::9a
2a02:fa8:8806:13::1430
2a03:2880:f01c:800e:face:b00c:0:2
34.249.135.160
34.95.120.147
35.173.160.135
35.244.159.8
37.157.4.29
52.15.169.204
52.222.182.122
52.28.149.230
52.28.254.214
54.76.211.112
54.93.138.105
64.140.160.2
69.173.144.143
72.251.249.13
93.184.221.64
99.86.2.42
0029dc7b6b47e3465a6c53c393b75e0b2de156033ad7e59d4e63e01bb49e806f
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c
0168b952e652e23883e037050fe02ef96b309e96fbb0807a554b0a989801eef9
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c
039f2a12a4fefd4b33bcae31f1f2f17d12cf51f4e6301792ada3885f412a2761
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06ba0310ca5ed094903ff6524f0ebb8b27ee83c1c88ca5112e0ea6643205350e
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
0727068cb5fb8e5af5d0df7d0331408939337a141048d30f38162468e0898fbb
093ee8573c58af3b9ac0f59c675cd706101f7a5d67bf30d91d9ae67b8f66933e
0aea9c7eb33dfe2476417b29441d3bb996fd49da89719f718d9af579d114d1cd
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
11f703b0d3af3df0bfed0d1584122d295604c8a44f24719e5a942934a0d32386
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
1a43c74864844bfddbd01ca30caeb8fb5b8534cf72b03132b37bba0c13860844
1a4615d389c0304ba5ec2028cd81ce4cd3ff85bf20176e19d90a1e3ec9725636
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788
21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08
2479627ad80abb56e0e670a073899c3310b76452f26cf0a5ad1a20454169191b
25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838
3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5
3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14
392cc23864e1d5ec27dc6db139581ea3da476624b962fb3b1f866248f554ae64
394c891106fefec5da26b02e23ae36b884736ccc30fa0ca7c9832c29dd212f8a
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
3e3bed6d3324b9b6076462d26269e9ac5f39df2627a1554dffa00e071e5cec28
3e811b97dc60cf37a74f0bffee4222c2697e409c2cc78548e47b3384926c4338
3edf0837f49625ad64af84f2a4d223b69ea99fb468ebbb2ece40286dbe64b6a1
41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
547c1f6045c38b1742dda3108d3454dd647e70654229d7d85a39034cf8390709
54f3aa37078dcd01911c9da1a5fd753b5834dde5acfd90c5bd55243bba87cf6d
5876f68bf30a82eb99d9ec29e561f5c925ea347243c3e022021dd87823c65813
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
623e7246c817a2d709db56d2c9b3072c5fd9ad41e22cff31291d6a9136a1b2ec
64c1fcfbb417c6196b85f27e7ecbc583e19368fe18cc30b9184fb29c7f66d2be
652fceb7d30594ed27e66da1bfa09d6118a60dd3b51da1d5ed287e07438c81a1
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2
6ce73b5cd70fb619db9c1b6a4391b2bb00101d002788f308766800b8ebb1eca8
6ceb2be119d08740867f19d7f3e5c2230050de29e4eb48a588b86af1a5b7db57
6dcd2dd793a451a5a912d39e43bac99ea84d6dbdbd24aa7f0c23dbf840d2bc69
73339d824e344121a3039b2e0e9c9353fb8132e005bb6d53249814c213520d5d
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
747a03fee397ff9cf8a76308966b2cc28f4dd00160af7610bc81ccfcb2836fab
78b478e2a5cf6e2bb0f4042cd8cc3e9be88a42e80e8b39c219c5cc0f2e98a41e
78d192cb8942beb5e6c66cc55fbe3757c3d02577b9ed2cfcb6dadb931346dd76
791135f98b21bbd99c1cbcd56e2827cab155856c144602a8749a57acaa5aa813
7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21
7f193a9fbb3d85615c9b3c7e4df23a99bec5c65e38f189b8db86ecedd1e8a2ad
81769ec6be856e69d17c22fdbf79b9e05b7c0ece06edc79db4114a8567298643
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119
8886ecb43022319b929c038f01bad068960dad91b67870278ae2398a68267da9
89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c
90ec250badd2212734a2b40cd802a9143d9028850a33394cd8b892adc58e6192
91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d
98170098ad5b9e0e27bc80b4fab39889cb6437246979ee85680f64bb77d03a08
99e8873689e21de4d952fded0ee8a7d9cda044d86e09b8a28bd7b63ddd7cf223
9dafe15de32062af9dedee3ff6a64b81a1bb78a924a9e6a7f21a180cc75b8c27
9e8a225b88cd582fa98606ed751e34a9626f0e333170d7409fd12413001178cc
9f4d5cca9c79886cc27246836d97c89aaf7853b2a42b09801660cb9a3df67424
9f77bf6ecbc06589bf03b9b673dec4cd51648ed1200ff242a6b53530b2cbccf5
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a32b89473df6ced5953684278e431ae4a01141364fab23812960a0d69c5ab3ee
a72430eff8a50ab94fa52d392e7116f6e6d1480672b400b61a0c5eefb61fcc7d
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7
ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552
ac288c5485ce485a00c71d652e7ce84ac2c4c6aa573cab4bd1b40e19e99fb2a9
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aca770b3bd6ea5361b43a392c4b5180c3c4ebe777e25cdd6bbffd4a9bca09066
acbb4843744ac6db6dbca6976f2cd20ed3cfffdbfc6f859272a4ce91ed0c816a
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
ae68612063622372d01d3b119c53de3530fdf5f6be1f05e230a0304d2f0ed668
b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02
b058422b486c77ab4efc5aecc11d7c1e4e21e05ba22ce6daaa5bb95eae20a1ec
b0cdf4390008c0a3a6f316560cb20600370a196f7632a06f2b53418ddced0ca8
b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef
b685a9d5446783028d80e6ee1e5b594030d290ab7aa0cb1392d65e314f379160
b8e8fe9b8ca280dc3c982691064e62ba97c8f2c192a17dfe74430c7cf73cb4de
bf3ddcb81919410585121c9a8234bdaf8b6f8d47e059c34c7f2d8c475249ad37
c0349c6db8579ded17b40059444ff3608658a0151d652723873166b36011010c
c327074d7cae47927f1a0814e6dbdfb01d26bf5ffd9c5a6f75bcefd695e39de4
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ceefab1961090d49423fabaa6d8d90f7f6a73c3e69e1297132848291d46c2981
d02505ea3afce2c13db4659c9ef49b5a6939aec38340c1e16e9471683a9fddaf
d2da3bdfb97c04360c684feeaac2a007c4a391f0b7623a0294f5c8eb3a91afc4
d60e5823c29324b4ace1b82980e97b3a8f5bbe2d630712287d3c539076b72d3c
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d95737e9085d1883aab902de31e24aa714649559b1cb2b97e9857a8e4fb99b8c
dab8633fc2faa7b14bf368bccf7713f5f80d50d7f7a00efe40ed4034f0c9a0cc
db26d6c8b9587ef47481a29cf0980a5573a3bb19a83bd6e74bdbec7b049f4c22
dd23262003e6e02632ce21ad378415b54ca35487e4babb3559a357ab43c169f4
dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df08bfb12ce96decde5f9aec75cef91cc86bad2e2eb2c034de2338c9d44ff683
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e0a70c5d116d9c823c7d7958ecea2a7926315fac156e390bd7dc8a5fa088cdc3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3
ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3
ece45974d4ef75b5c717db442d421ad39822e5b7e024e3832e99d6dfac9b4431
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189
fe00a828c8984aa432d60646922198377e78dba43b704e73ab70d1fd4b9458e9

threatpost.com Open in urlscan Pro 35.173.160.135 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

259 Requests

96 %HTTPS

36 %IPv6

43 Domains

76 Subdomains

65 IPs

9 Countries

3836 kBTransfer

8066 kBSize

5 Cookies

14 Outgoing links

Redirected requests

259 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Screenshot
Live screenshot

Full Image

259
Requests

96 %
HTTPS

36 %
IPv6

43
Domains

76
Subdomains

65
IPs

9
Countries

3836 kB
Transfer

8066 kB
Size

5
Cookies

259 HTTP transactions
0 data transactions