20814341p.rfihub.com Open in urlscan Pro
193.0.160.128 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://20814341p.rfihub.com/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-1...
Effective URL:
https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHE...
Submission: On January 05 via manual (January 5th 2021, 10:03:46 pm UTC) from US

Summary HTTP 22 Redirects Behaviour Indicators

Summary

This website contacted 16 IPs in 6 countries across 22 domains to perform 22 HTTP transactions. The main IP is 193.0.160.128, located in Netherlands and belongs to ROCKETFUEL, US. The main domain is 20814341p.rfihub.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 18th 2020. Valid for: 2 years.

This is the only time 20814341p.rfihub.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 9	193.0.160.128 193.0.160.128	54312 (ROCKETFUEL) (ROCKETFUEL)
1 1	216.58.207.34 216.58.207.34	15169 (GOOGLE) (GOOGLE)
2 2	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1 2	37.252.172.45 37.252.172.45	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	184.30.210.81 184.30.210.81	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	52.209.86.30 52.209.86.30	16509 (AMAZON-02) (AMAZON-02)
2 2	18.197.99.6 18.197.99.6	16509 (AMAZON-02) (AMAZON-02)
1	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
1 2	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	2a00:1288:f03... 2a00:1288:f03d:1fa::2000	10310 (YAHOO-1) (YAHOO-1)
1 3	34.120.207.148 34.120.207.148	15169 (GOOGLE) (GOOGLE)
1 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
1	2600:1f18:612... 2600:1f18:612b:4264:c45:5634:c077:8e66	14618 (AMAZON-AES) (AMAZON-AES)
1	35.177.239.109 35.177.239.109	16509 (AMAZON-02) (AMAZON-02)
1	54.72.153.48 54.72.153.48	16509 (AMAZON-02) (AMAZON-02)
1 2	35.158.9.168 35.158.9.168	16509 (AMAZON-02) (AMAZON-02)
1 2	3.125.70.222 3.125.70.222	16509 (AMAZON-02) (AMAZON-02)
2 2	151.101.114.49 151.101.114.49	54113 (FASTLY) (FASTLY)
1	104.76.200.23 104.76.200.23	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	80.252.91.53 80.252.91.53	15830 (EQUINIX-C...) (EQUINIX-CONNECT-EMEA)
1 1	65.9.7.3 65.9.7.3	16509 (AMAZON-02) (AMAZON-02)
1	34.206.167.54 34.206.167.54	14618 (AMAZON-AES) (AMAZON-AES)
22	16

9 193.0.160.128 (Netherlands) 3 redirects

ASN54312 (ROCKETFUEL, US)

20814341p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.207.34 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s24-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.172.45 (Ascension Island) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.30.210.81 (Netherlands) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-30-210-81.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
x.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.209.86.30 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-86-30.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.197.99.6 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-99-6.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.156.0.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.234.21 (Ascension Island) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:f03d:1fa::2000 (United Kingdom) 1 redirects

ASN10310 (YAHOO-1, US)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.120.207.148 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 148.207.120.34.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (Netherlands) 1 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4264:c45:5634:c077:8e66 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.177.239.109 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-177-239-109.eu-west-2.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.72.153.48 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-72-153-48.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.158.9.168 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-9-168.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.125.70.222 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-125-70-222.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.114.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.76.200.23 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-76-200-23.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.252.91.53 (Netherlands) 1 redirects

ASN15830 (EQUINIX-CONNECT-EMEA, GB)

bs.serving-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.7.3 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.206.167.54 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-167-54.compute-1.amazonaws.com

bpi.rtactivate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	rfihub.com 3 redirects 20814341p.rfihub.com a.rfihub.com p.rfihub.com	9 KB
3	rlcdn.com 1 redirects idsync.rlcdn.com	887 B
3	doubleclick.net 3 redirects cm.g.doubleclick.net	846 B
2	everesttech.net 2 redirects sync-tm.everesttech.net	587 B
2	eyeota.net 1 redirects ps.eyeota.net	1 KB
2	bidswitch.net 1 redirects x.bidswitch.net	856 B
2	spotxchange.com 1 redirects sync.search.spotxchange.com	1 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com	2 KB
2	yahoo.com 1 redirects ups.analytics.yahoo.com ads.yahoo.com	2 KB
2	advertising.com 2 redirects pixel.advertising.com	679 B
2	demdex.net 1 redirects dpm.demdex.net	2 KB
2	adnxs.com 1 redirects ib.adnxs.com	2 KB
1	rtactivate.com bpi.rtactivate.com	109 B
1	rezync.com 1 redirects live.rezync.com	790 B
1	serving-sys.com 1 redirects bs.serving-sys.com	835 B
1	media.net contextual.media.net	696 B
1	krxd.net beacon.krxd.net	337 B
1	agkn.com aa.agkn.com	238 B
1	tremorhub.com partners.tremorhub.com	183 B
1	addthis.com x.dlx.addthis.com	177 B
1	rubiconproject.com pixel.rubiconproject.com	741 B
1	bluekai.com 1 redirects stags.bluekai.com	550 B
22	22

	Domain	Requested by
6	p.rfihub.com	2 redirects
3	idsync.rlcdn.com	1 redirects
3	cm.g.doubleclick.net	3 redirects
2	sync-tm.everesttech.net	2 redirects
2	ps.eyeota.net	1 redirects
2	x.bidswitch.net	1 redirects
2	sync.search.spotxchange.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	pixel.advertising.com	2 redirects
2	dpm.demdex.net	1 redirects
2	ib.adnxs.com	1 redirects
2	20814341p.rfihub.com	1 redirects
1	bpi.rtactivate.com
1	live.rezync.com	1 redirects
1	bs.serving-sys.com	1 redirects
1	contextual.media.net
1	beacon.krxd.net
1	aa.agkn.com
1	partners.tremorhub.com
1	x.dlx.addthis.com
1	ads.yahoo.com	1 redirects
1	ups.analytics.yahoo.com
1	pixel.rubiconproject.com
1	stags.bluekai.com	1 redirects
1	a.rfihub.com
22	25

This site contains no links.

Subject Issuer	Validity	Valid
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2020-06-18` - `2022-06-18`	2 years	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2020-06-24` - `2021-02-17`	8 months	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-10-24` - `2021-04-20`	6 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-14` - `2021-04-23`	a year	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-10-15` - `2021-04-09`	6 months	crt.sh
*.search.spotxchange.com GeoTrust RSA CA 2018	`2019-03-20` - `2021-04-21`	2 years	crt.sh
*.tremorhub.com Amazon	`2020-07-25` - `2021-08-25`	a year	crt.sh
*.agkn.com RapidSSL RSA CA 2018	`2020-07-25` - `2022-09-18`	2 years	crt.sh
beacon.krxd.net DigiCert SHA2 Secure Server CA	`2020-01-30` - `2021-01-30`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
*.eyeota.net R3	`2020-12-29` - `2021-03-29`	3 months	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2020-02-25` - `2021-05-26`	a year	crt.sh
rtactivate.com Amazon	`2020-06-11` - `2021-07-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
Frame ID: 854AEC1D2F1F67103A108C0D8710D7B4
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://20814341p.rfihub.com/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.custo... HTTP 302
https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.cu... Page URL

Detected technologies

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /Jetty(?:\(([\d\.]*\d+))?/i

Jetty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /Jetty(?:\(([\d\.]*\d+))?/i

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

html /<(?:iframe|img)[^>]+adnxs\.(?:net|com)/i

Sizmek (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

html /(?:<a [^>]*href="[^/]*\/\/[^/]*serving-sys\.com\/|<img [^>]*src="[^/]*\/\/[^/]*serving-sys\.com\/)/i

Page Statistics

22
Requests

100 %
HTTPS

13 %
IPv6

22
Domains

25
Subdomains

16
IPs

6
Countries

15 kB
Transfer

4 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://20814341p.rfihub.com/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375 HTTP 302
https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MTg3MTg3ODk2NjEwODAxMjM2Ng==&forward= HTTP 302
https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MTg3MTg3ODk2NjEwODAxMjM2Ng==&forward=&google_tc= HTTP 302
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESELP9OQrUOec-I-IR3MO7YtM&google_cver=1

Request Chain 1

https://ib.adnxs.com/setuid?entity=18&code=1871878966108012366 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D1871878966108012366

Request Chain 2

https://stags.bluekai.com/site/4722?id=1871878966108012366&redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fbk_uuid%3D%24_BK_UUID%26forward%3D HTTP 302
https://p.rfihub.com/cm?bk_uuid=iMSqn99999OOXwH4&forward=

Request Chain 4

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=1871878966108012366&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1871878966108012366&redir=

Request Chain 5

https://pixel.advertising.com/ups/55856/sync?uid=1871878966108012366&_origin=1 HTTP 302
https://pixel.advertising.com/ups/55856/sync?uid=1871878966108012366&_origin=1&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/55856/sync?uid=1871878966108012366&_origin=1&apid=UPd8e95082-4fa1-11eb-b4db-02446988654a

Request Chain 6

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1871878966108012366&forward= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1871878966108012366&forward=&C=1

Request Chain 7

https://ads.yahoo.com/cms/v1?esig=1~84c296ca4cae9f73fbcc48363a3cd4cd34be98f5&nwid=10000648372&sigv=1 HTTP 302
https://p.rfihub.com/cm?xid=E0

Request Chain 10

https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1871878966108012366&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1871878966108012366&img=1&__user_check__=1&sync_id=d8f6ca03-4fa1-11eb-87a3-16a7f9824d06

Request Chain 14

https://x.bidswitch.net/sync?dsp_id=119&user_id=1871878966108012366&expires=30 HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=1871878966108012366&expires=30

Request Chain 15

https://p.rfihub.com/cm?pub=24472&in=1 HTTP 302
https://ps.eyeota.net/match?uid=1871878966108012366&bid=omt9pi0 HTTP 302
https://ps.eyeota.net/match/bounce/?uid=1871878966108012366&bid=omt9pi0

Request Chain 16

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=X-TiMwAAALWluyrK HTTP 302
https://p.rfihub.com/cm?in=1&pub=21653&userid=X-TiMwAAALWluyrK&_test=X-TiMwAAALWluyrK

Request Chain 18

https://bs.serving-sys.com/serving?cn=um&dpid=12&rtu=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D17945%26userid%3D%5B%25tp_UserID%25%5D HTTP 302
https://p.rfihub.com/cm?in=1&pub=17945&userid=96f40da7-843b-40cb-8232-8e3ba6987d28

Request Chain 19

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=1871878966108012366&referrer=https%3A%2F%2Fcapitaloneoffers.com%2F HTTP 302
https://p.rfihub.com/cm?pub=39342&in=0&userid=64f61255-1946-4c4f-9908-d131d76a4d81%3A1609884211.33&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D64f61255-1946-4c4f-9908-d131d76a4d81%253A1609884211.33 HTTP 302
https://idsync.rlcdn.com/501709.gif?partner_uid=64f61255-1946-4c4f-9908-d131d76a4d81%3A1609884211.33 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOPqHhP5mdM8MGZgnqTMZzU&google_cver=1

22 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set ca.html Show response
20814341p.rfihub.com/sr/
Redirect Chain

http://20814341p.rfihub.com/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjev...
https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&...

3 KB
2 KB

165ms
46ms

Document
text/html

193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: f34c13781a7292e67a8373b3bca490c12affd272e80882fde0d74129bcf05f62

Request headers

Host: 20814341p.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: eud=H4sIAAAAAAAAAJvFyGtoZmBpYWFiZGhoaGK8Co1_Co3_Co3_C43fxITKn4TGn4XGX4TGX4XG34TG34XG_4SunwWVfwuNv4kVzTxuNP-g8RcJo_IfofEBeTSZo0ABAAA; Path=/; Domain=.rfihub.com; Expires=Sun, 30 Jan 2022 22:03:31 GMT; Secure; SameSite=None ruds=H4sIAAAAAAAAAOMSNrQwByILSzMzQwMLA0MjYzMzIT5D3aJUn5y8dEfvMBfPYgB0dyuPJQAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None rud=H4sIAAAAAAAAAOMSNrQwByILSzMzQwMLA0MjYzMzIT5D3aJUn5y8dEfvMBfPYileQzMDSwsLEyNDQ0NjSwBAFxsXNAAAAA; Path=/; Domain=.rfihub.com; Expires=Sun, 30 Jan 2022 22:03:31 GMT; Secure; SameSite=None
Cache-Control: no-cache
Content-Type: text/html
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

Redirect headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
Content-Length: 0

GET
H/1.1

200
OK

cm
a.rfihub.com/
Redirect Chain

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MTg3MTg3ODk2NjEwODAxMjM2Ng==&forward=
https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MTg3MTg3ODk2NjEwODAxMjM2Ng==&forward=&google_tc=
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESELP9OQrUOec-I-IR3MO7YtM&google_cver=1

42 B
1 KB

161ms
44ms

Image
image/gif

193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESELP9OQrUOec-I-IR3MO7YtM&google_cver=1
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control: no-cache
Server: Jetty(9.0.6.v20130930)
Content-Type: image/gif
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 05 Jan 2021 22:03:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESELP9OQrUOec-I-IR3MO7YtM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 311
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/setuid?entity=18&code=1871878966108012366
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D1871878966108012366

43 B
1 KB

29ms
29ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D1871878966108012366

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jan 2021 22:03:31 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 693.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.151:80
AN-X-Request-Uuid: 8d30c7be-263a-4e13-a2b3-04292103baac
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 05 Jan 2021 22:03:31 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 693.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.103:80
AN-X-Request-Uuid: 17079c95-cac2-4756-8b2e-0600f7966fc6
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D1871878966108012366
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

cm
p.rfihub.com/
Redirect Chain

https://stags.bluekai.com/site/4722?id=1871878966108012366&redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fbk_uuid%3D%24_BK_UUID%26forward%3D
https://p.rfihub.com/cm?bk_uuid=iMSqn99999OOXwH4&forward=

42 B
957 B

71ms
47ms

Image
image/gif

193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.rfihub.com/cm?bk_uuid=iMSqn99999OOXwH4&forward=
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control: no-cache
Server: Jetty(9.0.6.v20130930)
Content-Type: image/gif
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://p.rfihub.com/cm?bk_uuid=iMSqn99999OOXwH4&forward=
date: Tue, 05 Jan 2021 22:03:31 GMT
content-length: 0
bk-server: edb2
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ 42 B
741 B 36ms
33ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=13490&nid=2596&put=1871878966108012366
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Content-Type: image/gif

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/
Redirect Chain

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=1871878966108012366&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1871878966108012366&redir=

42 B
915 B

50ms
50ms

Image
image/gif

52.209.86.30
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1871878966108012366&redir=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.209.86.30 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-209-86-30.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v086-030c1db33.edge-irl1.demdex.com 5.80.1.20201111130852 0ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: vXCM3D8DQEo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: nSR9gWleSos=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1871878966108012366&redir=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55856/
Redirect Chain

https://pixel.advertising.com/ups/55856/sync?uid=1871878966108012366&_origin=1
https://pixel.advertising.com/ups/55856/sync?uid=1871878966108012366&_origin=1&verify=true
https://ups.analytics.yahoo.com/ups/55856/sync?uid=1871878966108012366&_origin=1&apid=UPd8e95082-4fa1-11eb-b4db-02446988654a

0
964 B

86ms
31ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55856/sync?uid=1871878966108012366&_origin=1&apid=UPd8e95082-4fa1-11eb-b4db-02446988654a

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.128 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 05 Jan 2021 22:03:31 GMT
Server: ATS/7.1.2.128
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/55856/sync?uid=1871878966108012366&_origin=1&apid=UPd8e95082-4fa1-11eb-b4db-02446988654a
date: Tue, 05 Jan 2021 22:03:31 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1871878966108012366&forward=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1871878966108012366&forward=&C=1

43 B
1006 B

54ms
53ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1871878966108012366&forward=&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Jan 2021 22:03:31 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 05 Jan 2021 22:03:31 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 05 Jan 2021 22:03:31 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1871878966108012366&forward=&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 295
Expires: Tue, 05 Jan 2021 22:03:31 GMT

GET
H/1.1

200
OK

cm
p.rfihub.com/
Redirect Chain

https://ads.yahoo.com/cms/v1?esig=1~84c296ca4cae9f73fbcc48363a3cd4cd34be98f5&nwid=10000648372&sigv=1
https://p.rfihub.com/cm?xid=E0

42 B
922 B

114ms
45ms

Image
image/gif

193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.rfihub.com/cm?xid=E0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control: no-cache
Server: Jetty(9.0.6.v20130930)
Content-Type: image/gif
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Tue, 05 Jan 2021 22:03:31 GMT
referrer-policy: no-referrer-when-downgrade
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
location: https://p.rfihub.com/cm?xid=E0
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2 200 360947.gif
idsync.rlcdn.com/ 42 B
298 B 37ms
34ms Image
image/gif 34.120.207.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/360947.gif?partner_uid=1871878966108012366
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.207.148 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 148.207.120.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Jan 2021 22:03:31 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H2 200 rocketfuel_sync
x.dlx.addthis.com/e/ 43 B
177 B 121ms
118ms Image
image/gif 184.30.210.81
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.dlx.addthis.com/e/rocketfuel_sync?na_exid=1871878966108012366
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.210.81 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-30-210-81.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jan 2021 22:03:31 GMT
cache-control: max-age=0, no-cache, no-store
expires: Tue, 05 Jan 2021 22:03:31 GMT
content-length: 43
content-type: image/gif

GET
H/1.1

200

partner
sync.search.spotxchange.com/
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1871878966108012366&img=1
https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1871878966108012366&img=1&__user_check__=1&sync_id=d8f6ca03-4fa1-11eb-87a3-16a7f9824d06

43 B
548 B

45ms
44ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1871878966108012366&img=1&__user_check__=1&sync_id=d8f6ca03-4fa1-11eb-87a3-16a7f9824d06
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.180.125 , Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 05 Jan 2021 22:03:31 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 14
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Tue, 05 Jan 2021 22:03:31 GMT
Server: nginx
Location: /partner?adv_id=7180&uid=1871878966108012366&img=1&__user_check__=1&sync_id=d8f6ca03-4fa1-11eb-87a3-16a7f9824d06
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 106
Connection: keep-alive
Content-Length: 0

GET
H2 200 sync
partners.tremorhub.com/ 43 B
183 B 264ms
87ms Image
image/gif 2600:1f18:612b:4264:c45:5634:c077:8e66
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIRF=1871878966108012366&r=vw8bO2D06I_C
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4264:c45:5634:c077:8e66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 05 Jan 2021 22:03:31 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

GET
H2 200 g.pixel
aa.agkn.com/adscores/ 43 B
238 B 117ms
35ms Image
image/gif 35.177.239.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212192898&rf=1871878966108012366
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.177.239.109 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-177-239-109.eu-west-2.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Jan 2021 22:03:31 GMT
server: AAWebServer
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H2 204 usermatch.gif
beacon.krxd.net/ 0
337 B 150ms
48ms Image
text/plain 54.72.153.48
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner_id=rfuel&partner_user_id=1871878966108012366
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.72.153.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-72-153-48.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 05 Jan 2021 22:03:31 GMT
cache-control: private, no-cache, no-store
x-request-time: D=28 t=1609884211
x-served-by: beacon-n021-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sync
x.bidswitch.net/ul_cb/
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=119&user_id=1871878966108012366&expires=30
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=1871878966108012366&expires=30

43 B
344 B

27ms
27ms

Image
image/gif

35.158.9.168
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=1871878966108012366&expires=30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.9.168 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-9-168.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 05 Jan 2021 22:03:31 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=1871878966108012366&expires=30
date: Tue, 05 Jan 2021 22:03:31 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H/1.1

200
OK

/
ps.eyeota.net/match/bounce/
Redirect Chain

https://p.rfihub.com/cm?pub=24472&in=1
https://ps.eyeota.net/match?uid=1871878966108012366&bid=omt9pi0
https://ps.eyeota.net/match/bounce/?uid=1871878966108012366&bid=omt9pi0

70 B
440 B

26ms
26ms

Image
image/gif

3.125.70.222
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match/bounce/?uid=1871878966108012366&bid=omt9pi0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.125.70.222 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-70-222.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 05 Jan 2021 22:03:31 GMT
Content-Type: image/gif
Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /match/bounce/?uid=1871878966108012366&bid=omt9pi0
Date: Tue, 05 Jan 2021 22:03:31 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H/1.1

200
OK

cm
p.rfihub.com/
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=X-TiMwAAALWluyrK
https://p.rfihub.com/cm?in=1&pub=21653&userid=X-TiMwAAALWluyrK&_test=X-TiMwAAALWluyrK

42 B
1 KB

75ms
43ms

Image
image/gif

193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.rfihub.com/cm?in=1&pub=21653&userid=X-TiMwAAALWluyrK&_test=X-TiMwAAALWluyrK
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control: no-cache
Server: Jetty(9.0.6.v20130930)
Content-Type: image/gif
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 05 Jan 2021 22:03:31 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1609884211.377687,VS0,VE0
x-served-by: cache-hhn4071-HHN
x-cache: HIT
location: https://p.rfihub.com/cm?in=1&pub=21653&userid=X-TiMwAAALWluyrK&_test=X-TiMwAAALWluyrK
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 cksync.php
contextual.media.net/ 46 B
696 B 47ms
45ms Image
image/gif 104.76.200.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=rkt&ovsid=1871878966108012366

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.76.200.23 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-76-200-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

579a172ca2c700734ebcfa06d105a134f31ec2357660e58e0874cfdee8472fd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
server: Apache
date: Tue, 05 Jan 2021 22:03:31 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 46
x-mnet-hl2: E
expires: Tue, 05 Jan 2021 22:03:31 GMT

GET
H/1.1

200
OK

cm
p.rfihub.com/
Redirect Chain

https://bs.serving-sys.com/serving?cn=um&dpid=12&rtu=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D17945%26userid%3D%5B%25tp_UserID%25%5D
https://p.rfihub.com/cm?in=1&pub=17945&userid=96f40da7-843b-40cb-8232-8e3ba6987d28

42 B
1017 B

110ms
42ms

Image
image/gif

193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.rfihub.com/cm?in=1&pub=17945&userid=96f40da7-843b-40cb-8232-8e3ba6987d28
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control: no-cache
Server: Jetty(9.0.6.v20130930)
Content-Type: image/gif
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Pragma: no-cache
Date: Tue, 05 Jan 2021 22:03:59 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
P3P: CP="NOI DEVa OUR BUS UNI"
Location: https://p.rfihub.com/cm?in=1&pub=17945&userid=96f40da7-843b-40cb-8232-8e3ba6987d28
Cache-Control: no-cache, no-store
Content-Type: text/html; charset=UTF-8
Content-Length: 213
Expires: Sun, 05-Jun-2005 22:00:00 GMT

GET
H2

200

362358.gif
idsync.rlcdn.com/
Redirect Chain

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=1871878966108012366&referrer=https%3A%2F%2Fcapitaloneoffers.com%2F
https://p.rfihub.com/cm?pub=39342&in=0&userid=64f61255-1946-4c4f-9908-d131d76a4d81%3A1609884211.33&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D64f61255-1946-4c4f-9908-d131d76a4d81...
https://idsync.rlcdn.com/501709.gif?partner_uid=64f61255-1946-4c4f-9908-d131d76a4d81%3A1609884211.33
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOPqHhP5mdM8MGZgnqTMZzU&google_cver=1

42 B
299 B

34ms
34ms

Image
image/gif

34.120.207.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOPqHhP5mdM8MGZgnqTMZzU&google_cver=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.207.148 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 148.207.120.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Jan 2021 22:03:31 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

pragma: no-cache
date: Tue, 05 Jan 2021 22:03:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOPqHhP5mdM8MGZgnqTMZzU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
bpi.rtactivate.com/tag/ 43 B
109 B 439ms
181ms Image
image/gif 34.206.167.54
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpi.rtactivate.com/tag/?id=11017&user_id=1871878966108012366
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.206.167.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-167-54.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://20814341p.rfihub.com/sr/ca.html?ver=9&rb=38276&ca=20814341&_o=38276&_t=20814341&pe=https://www.customink.com/?pc=OTHER-189949&utm_campaign=cj_jan_20&utm_source=cj&utm_medium=affiliate_link&cjevent=7df0e0744f9811eb82fc00ed0a240613&pf=https://capitaloneoffers.com/&ra=6240902916305375
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 05 Jan 2021 22:03:31 GMT
server: awselb/2.0
content-length: 43
content-type: image/gif

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rfihub.com/	1970-01-20 00:33:00	Name: rud Value: H4sIAAAAAAAAAOMSNrQwByILSzMzQwMLA0MjYzMzIT5D3aJUn5y8dEfvMBfPYileQzMDSwsLEyNDQ0NjSwBAFxsXNAAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAAAOMSNrQwByILSzMzQwMLA0MjYzMzIT5D3aJUn5y8dEfvMBfPYgB0dyuPJQAAAA
.rfihub.com/	1970-01-20 00:33:00	Name: eud Value: H4sIAAAAAAAAAJvFyGtoZmBpYWFiZGhoaGK8Co1_Co3_Co3_C43fxITKn4TGn4XGX4TGX4XG34TG34XG_4SunwWVfwuNv4kVzTxuNP-g8RcJo_IfofEBeTSZo0ABAAA

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20814341p.rfihub.com
a.rfihub.com
aa.agkn.com
ads.yahoo.com
beacon.krxd.net
bpi.rtactivate.com
bs.serving-sys.com
cm.g.doubleclick.net
contextual.media.net
dpm.demdex.net
dsum-sec.casalemedia.com
ib.adnxs.com
idsync.rlcdn.com
live.rezync.com
p.rfihub.com
partners.tremorhub.com
pixel.advertising.com
pixel.rubiconproject.com
ps.eyeota.net
stags.bluekai.com
sync-tm.everesttech.net
sync.search.spotxchange.com
ups.analytics.yahoo.com
x.bidswitch.net
x.dlx.addthis.com
104.76.200.23
151.101.114.49
18.156.0.31
18.197.99.6
184.30.210.81
185.94.180.125
193.0.160.128
2.18.234.21
216.58.207.34
2600:1f18:612b:4264:c45:5634:c077:8e66
2a00:1288:f03d:1fa::2000
2a00:1450:4001:809::2002
3.125.70.222
34.120.207.148
34.206.167.54
35.158.9.168
35.177.239.109
37.252.172.45
52.209.86.30
54.72.153.48
65.9.7.3
69.173.144.138
80.252.91.53
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
579a172ca2c700734ebcfa06d105a134f31ec2357660e58e0874cfdee8472fd4
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f34c13781a7292e67a8373b3bca490c12affd272e80882fde0d74129bcf05f62

20814341p.rfihub.com Open in urlscan Pro 193.0.160.128 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

22 Requests

100 %HTTPS

13 %IPv6

22 Domains

25 Subdomains

16 IPs

6 Countries

15 kBTransfer

4 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

20814341p.rfihub.com Open in urlscan Pro
193.0.160.128 Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

100 %
HTTPS

13 %
IPv6

22
Domains

25
Subdomains

16
IPs

6
Countries

15 kB
Transfer

4 kB
Size

3
Cookies

22 HTTP transactions
0 data transactions