urlscan.io logo urlscan.io
SecurityTrails logo

www.bleepingcomputer.com Open in urlscan Pro
104.20.60.209  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Submission: On December 05 via api from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 141 IPs in 11 countries across 141 domains to perform 832 HTTP transactions. The main IP is 104.20.60.209, located in and belongs to CLOUDFLARENET, US. The main domain is www.bleepingcomputer.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 16th 2020. Valid for: 2 years.
This is the only time www.bleepingcomputer.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 104.20.60.209 13335 (CLOUDFLAR...)
4 2607:f8b0:400... 15169 (GOOGLE)
32 104.26.13.6 13335 (CLOUDFLAR...)
23 2606:2800:220... 15133 (EDGECAST)
6 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2607:f8b0:400... 15169 (GOOGLE)
5 12 2607:f8b0:400... 15169 (GOOGLE)
6 2607:f8b0:400... 15169 (GOOGLE)
34 2607:f8b0:400... 15169 (GOOGLE)
7 23.208.216.126 16625 (AKAMAI-AS)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 17 151.101.2.137 54113 (FASTLY)
1 13.225.63.15 16509 (AMAZON-02)
2 13.225.214.70 16509 (AMAZON-02)
7 2607:f8b0:400... 15169 (GOOGLE)
14 35.201.71.192 15169 (GOOGLE)
1 142.250.81.230 15169 (GOOGLE)
1 23.52.162.190 16625 (AKAMAI-AS)
7 23.52.163.40 16625 (AKAMAI-AS)
2 2607:f8b0:400... 15169 (GOOGLE)
25 2607:f8b0:400... 15169 (GOOGLE)
1 4 13.226.37.62 16509 (AMAZON-02)
1 35.241.45.217 15169 (GOOGLE)
8 2607:f8b0:400... 15169 (GOOGLE)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
4 32 23.52.162.21 16625 (AKAMAI-AS)
17 3.130.243.57 16509 (AMAZON-02)
28 64 142.250.65.194 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
2 2607:f8b0:400... 15169 (GOOGLE)
2 52.14.21.152 16509 (AMAZON-02)
5 104.244.42.136 13414 (TWITTER)
2 151.101.129.140 54113 (FASTLY)
1 151.101.66.137 54113 (FASTLY)
4 2607:f8b0:400... 15169 (GOOGLE)
18 19 35.71.131.137 16509 (AMAZON-02)
2 2 23.211.130.59 16625 (AKAMAI-AS)
8 23.73.244.44 16625 (AKAMAI-AS)
7 23.52.161.180 16625 (AKAMAI-AS)
1 1 129.159.70.95 31898 (ORACLE-BM...)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
2 35.227.238.208 15169 (GOOGLE)
4 3.142.30.148 16509 (AMAZON-02)
1 130.211.23.194 15169 (GOOGLE)
5 2607:f8b0:400... 15169 (GOOGLE)
3 2600:9000:21d... 16509 (AMAZON-02)
6 54.192.160.42 16509 (AMAZON-02)
17 54.230.162.9 16509 (AMAZON-02)
4 10 69.173.151.100 26667 (RUBICONPR...)
3 7 104.36.115.113 62713 (AS-PUBMATIC)
1 4 2620:100:a001::c 19750 (AS-CRITEO)
2 4 2620:116:800b... 14618 (AMAZON-AES)
1 13.225.205.105 16509 (AMAZON-02)
1 23.52.162.163 16625 (AKAMAI-AS)
2 74.119.119.139 19750 (AS-CRITEO)
7 22 68.67.160.132 29990 (ASN-APPNEX)
3 23.199.204.79 16625 (AKAMAI-AS)
3 3.224.175.57 14618 (AMAZON-AES)
6 104.36.115.111 62713 (AS-PUBMATIC)
3 35.211.165.199 19527 (GOOGLE-2)
2 34.149.20.76 15169 (GOOGLE)
6 22 34.98.64.218 15169 (GOOGLE)
15 34.236.83.94 14618 (AMAZON-AES)
3 34.107.148.139 15169 (GOOGLE)
21 104.16.190.66 13335 (CLOUDFLAR...)
15 18.159.151.182 16509 (AMAZON-02)
6 54.226.174.129 14618 (AMAZON-AES)
3 2602:803:c002... 26667 (RUBICONPR...)
4 4 8.43.72.97 26667 (RUBICONPR...)
3 12 3.81.191.231 14618 (AMAZON-AES)
7 7 35.168.56.65 14618 (AMAZON-AES)
6 11 3.218.90.66 14618 (AMAZON-AES)
8 9 151.101.2.49 54113 (FASTLY)
3 4 185.167.164.39 198622 (ADFORM)
2 21 104.36.115.109 62713 (AS-PUBMATIC)
4 6 54.166.81.178 14618 (AMAZON-AES)
2 3 74.119.119.150 19750 (AS-CRITEO)
2 3 169.197.150.8 398989 (DEEPINTENT)
2 2 173.231.178.116 29791 (VOXEL-DOT...)
3 3 54.175.198.118 14618 (AMAZON-AES)
2 3 2606:4700::68... 13335 (CLOUDFLAR...)
4 4 54.166.52.96 14618 (AMAZON-AES)
1 38.27.122.101 174 (COGENT-174)
6 6 199.127.204.142 26120 (RHYTHMONE)
1 1 69.90.254.78 13768 (COGECO-PEER1)
1 1 104.45.178.220 8075 (MICROSOFT...)
8 8.28.7.83 62713 (AS-PUBMATIC)
2 2 23.219.95.182 16625 (AKAMAI-AS)
4 12 35.190.60.146 15169 (GOOGLE)
2 2 107.178.254.65 15169 (GOOGLE)
1 1 34.98.67.3 15169 (GOOGLE)
7 7 74.121.140.14 30419 (MEDIAMATH...)
2 104.36.115.114 62713 (AS-PUBMATIC)
4 4 52.116.221.248 36351 (SOFTLAYER)
8 8 2620:112:f000... 6336 (TURN-US-ASN)
4 9 2600:1f18:4e9... 14618 (AMAZON-AES)
14 14 2001:438:65:1... 26762 (CNVR-US-EAST)
1 52.45.215.106 14618 (AMAZON-AES)
1 1 54.159.94.231 14618 (AMAZON-AES)
1 2 38.67.14.233 174 (COGENT-174)
4 4 207.198.113.169 13768 (COGECO-PEER1)
19 20 18.157.70.90 16509 (AMAZON-02)
1 1 52.23.124.50 14618 (AMAZON-AES)
1 1 45.35.192.162 40676 (AS40676)
54 2607:f8b0:400... 15169 (GOOGLE)
6 151.101.130.133 54113 (FASTLY)
2 52.20.92.17 14618 (AMAZON-AES)
1 54.146.124.230 14618 (AMAZON-AES)
1 23.5.238.78 16625 (AKAMAI-AS)
1 46.105.202.126 16276 (OVH)
1 34.205.221.238 14618 (AMAZON-AES)
1 19 209.54.176.128 16509 (AMAZON-02)
3 3.222.130.154 14618 (AMAZON-AES)
1 3 51.195.5.231 16276 (OVH)
3 2001:4998:14:... 14777 (YAHOO)
12 54.87.41.176 14618 (AMAZON-AES)
2 151.101.66.133 54113 (FASTLY)
8 2606:2800:220... 15133 (EDGECAST)
3 3.231.253.205 14618 (AMAZON-AES)
5 10 34.200.159.147 14618 (AMAZON-AES)
2 34.200.184.86 14618 (AMAZON-AES)
1 1 199.187.193.179 47043 (SMARTADSE...)
1 1 20.72.149.136 8075 (MICROSOFT...)
1 2 63.251.86.50 32475 (SINGLEHOP...)
4 18 52.223.22.214 16509 (AMAZON-02)
7 142.251.41.2 15169 (GOOGLE)
4 104.244.43.131 54113 (FASTLY)
3 3 68.67.179.173 29990 (ASN-APPNEX)
1 1 52.21.125.8 14618 (AMAZON-AES)
1 1 52.205.151.180 14618 (AMAZON-AES)
1 1 3.128.80.187 16509 (AMAZON-02)
1 1 198.148.27.139 19189 (PULSEPOINT)
2 2 185.184.8.65 204995 (RTB-HOUSE...)
5 63.251.114.182 29791 (VOXEL-DOT...)
2 2 35.210.53.219 19527 (GOOGLE-2)
1 1 52.7.51.190 14618 (AMAZON-AES)
4 4 35.207.24.140 15169 (GOOGLE)
2 2 50.16.197.56 14618 (AMAZON-AES)
2 2 107.178.246.49 15169 (GOOGLE)
2 8.28.7.84 62713 (AS-PUBMATIC)
20 2607:f8b0:400... 15169 (GOOGLE)
3 3.16.251.19 16509 (AMAZON-02)
1 1 54.90.48.240 14618 (AMAZON-AES)
8 18.213.185.73 14618 (AMAZON-AES)
6 6 184.50.205.90 16625 (AKAMAI-AS)
1 34.231.251.31 14618 (AMAZON-AES)
1 1 64.58.232.176 13649 (ASN-VINS)
1 64.58.232.177 13649 (ASN-VINS)
1 1 2600:1901:0:8... 15169 (GOOGLE)
3 3.19.190.206 16509 (AMAZON-02)
4 2607:f8b0:400... 15169 (GOOGLE)
1 2 146.20.128.205 27357 (RACKSPACE)
1 184.29.128.213 16625 (AKAMAI-AS)
1 2600:1400:d:5... 20940 (AKAMAI-ASN1)
1 2 184.29.129.73 16625 (AKAMAI-AS)
1 2600:1f18:612... 14618 (AMAZON-AES)
1 1 2a04:4e42:600... 54113 (FASTLY)
1 151.101.65.44 54113 (FASTLY)
1 1 172.105.232.22 63949 (LINODE-AP...)
1 1 23.88.75.186 24940 (HETZNER-AS)
2 3 52.205.58.132 14618 (AMAZON-AES)
1 195.5.165.20 44968 (IPROM-AS)
1 1 34.102.253.54 15169 (GOOGLE)
1 1 159.65.196.12 14061 (DIGITALOC...)
1 34.225.34.171 14618 (AMAZON-AES)
1 1 20.88.207.242 8075 (MICROSOFT...)
2 2 35.186.253.211 15169 (GOOGLE)
1 2600:1f18:445... 14618 (AMAZON-AES)
1 1 2620:116:800b... 14618 (AMAZON-AES)
1 1 2600:9000:21d... 16509 (AMAZON-02)
1 1 35.190.90.30 15169 (GOOGLE)
1 34.120.155.137 15169 (GOOGLE)
1 52.73.153.177 14618 (AMAZON-AES)
1 54.218.247.33 16509 (AMAZON-02)
1 104.17.120.107 13335 (CLOUDFLAR...)
28 23.52.167.93 16625 (AKAMAI-AS)
2 151.101.193.108 54113 (FASTLY)
7 7 67.202.105.22 32748 (STEADFAST)
1 2 67.202.105.33 32748 (STEADFAST)
4 4 2620:109:c002... 14413 (LINKEDIN)
2 4 104.18.99.194 13335 (CLOUDFLAR...)
2 2 52.5.237.191 14618 (AMAZON-AES)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
8 8 70.42.32.159 13789 (INTERNAP-...)
5 5 199.38.167.129 54312 (ROCKETFUEL)
1 2 54.149.241.156 16509 (AMAZON-02)
2 2 204.62.13.72 46636 (NATCOWEB)
2 2 35.174.6.234 14618 (AMAZON-AES)
1 1 54.86.74.19 14618 (AMAZON-AES)
6 34.117.239.71 15169 (GOOGLE)
1 1 185.184.10.30 203690 (RTB-HOUSE...)
2 34.73.194.24 396982 (GOOGLE-PR...)
4 4 51.222.80.231 16276 (OVH)
2 4 2606:4700:10:... 13335 (CLOUDFLAR...)
2 4 35.201.96.126 15169 (GOOGLE)
2 156.154.202.36 19907 (NEUSTAR-AS6)
2 4 3.215.189.212 14618 (AMAZON-AES)
1 2600:9000:21d... ()
832 141
3    104.20.60.209 (None, )

ASN13335 (CLOUDFLARENET, US)
www.bleepingcomputer.com
4    2607:f8b0:4006:822::200a (United States)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
32    104.26.13.6 (United States)

ASN13335 (CLOUDFLARENET, US)
www.bleepstatic.com
23    2606:2800:220:131d:1d30:1f1d:238b:1e56 (United States)

ASN15133 (EDGECAST, US)
platform.twitter.com
6    2606:4700:20::681a:8b (United States)

ASN13335 (CLOUDFLARENET, US)
a.pub.network
1    2607:f8b0:4006:822::2008 (United States)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
12    2607:f8b0:4006:824::2004 (United States)

ASN15169 (GOOGLE, US)
www.google.com
6    2607:f8b0:4006:80e::2003 (United States)

ASN15169 (GOOGLE, US)
www.gstatic.com
34    2607:f8b0:4006:816::2002 (United States)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
7    23.208.216.126 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-208-216-126.deploy.static.akamaitechnologies.com
s9.addthis.com
v1.addthisedge.com
m.addthis.com
s7.addthis.com
api-public.addthis.com
1    2606:4700::6810:5e41 (United States)

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
17    151.101.2.137 (United States)

ASN54113 (FASTLY, US)
cd.connatix.com
cds.connatix.com
img.connatix.com
cks.connatix.com
ck.connatix.com
1    13.225.63.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-63-15.ewr53.r.cloudfront.net
ecdn.analysis.fi
2    13.225.214.70 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-70.ewr50.r.cloudfront.net
ecdn.firstimpression.io
cdn.firstimpression.io
7    2607:f8b0:4006:823::2003 (United States)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
14    35.201.71.192 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 192.71.201.35.bc.googleusercontent.com
d.pub.network
c.pub.network
1    142.250.81.230 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s74-in-f6.1e100.net
ad.doubleclick.net
1    23.52.162.190 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-162-190.deploy.static.akamaitechnologies.com
widgets.outbrain.com
7    23.52.163.40 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-163-40.deploy.static.akamaitechnologies.com
z.moatads.com
px.moatads.com
2    2607:f8b0:4006:807::200e (United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
25    2607:f8b0:4006:80c::2002 (United States)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
adservice.google.ca
4    13.226.37.62 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-37-62.ewr53.r.cloudfront.net
sb.scorecardresearch.com
1    35.241.45.217 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 217.45.241.35.bc.googleusercontent.com
pghub.io
8    2607:f8b0:4006:81d::2002 (United States)

ASN15169 (GOOGLE, US)
www.googletagservices.com
1    2606:4700:3039::6815:c076 (United States)

ASN13335 (CLOUDFLARENET, US)
freestar-io.videoplayerhub.com
1    2606:4700:20::681a:78b (United States)

ASN13335 (CLOUDFLARENET, US)
btloader.com
32    23.52.162.21 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-162-21.deploy.static.akamaitechnologies.com
js-sec.indexww.com
ssum-sec.casalemedia.com
ssum.casalemedia.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
17    3.130.243.57 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-130-243-57.us-east-2.compute.amazonaws.com
capi.connatix.com
64    142.250.65.194 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s72-in-f2.1e100.net
partner.googleadservices.com
securepubads.g.doubleclick.net
cm.g.doubleclick.net
1    2607:f8b0:4006:81c::2002 (United States)

ASN15169 (GOOGLE, US)
adservice.google.ca
2    2607:f8b0:4006:808::2002 (United States)

ASN15169 (GOOGLE, US)
adservice.google.com
2    52.14.21.152 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-14-21-152.us-east-2.compute.amazonaws.com
tag.escalated.io
5    104.244.42.136 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
2    151.101.129.140 (United States)

ASN54113 (FASTLY, US)
www.reddit.com
1    151.101.66.137 (United States)

ASN54113 (FASTLY, US)
vid.connatix.com
4    2607:f8b0:4006:80b::200a (United States)

ASN15169 (GOOGLE, US)
imasdk.googleapis.com
19    35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
match.adsrvr.org
2    23.211.130.59 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-211-130-59.deploy.static.akamaitechnologies.com
secure-assets.rubiconproject.com
8    23.73.244.44 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-73-244-44.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
7    23.52.161.180 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-161-180.deploy.static.akamaitechnologies.com
ads.pubmatic.com
1    129.159.70.95 (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)
sync.technoratimedia.com
1    2606:4700:20::681a:246 (United States)

ASN13335 (CLOUDFLARENET, US)
ad-delivery.net
2    35.227.238.208 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 208.238.227.35.bc.googleusercontent.com
api.floors.dev
4    3.142.30.148 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-142-30-148.us-east-2.compute.amazonaws.com
vid.springserve.com
1    130.211.23.194 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 194.23.211.130.bc.googleusercontent.com
api.btloader.com
5    2607:f8b0:4006:823::2006 (United States)

ASN15169 (GOOGLE, US)
s0.2mdn.net
3    2600:9000:21dd:8400:15:6f6c:b180:93a1 (United States)

ASN16509 (AMAZON-02, US)
vpaid.springserve.com
6    54.192.160.42 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-160-42.ewr53.r.cloudfront.net
c.amazon-adsystem.com
17    54.230.162.9 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-162-9.ewr53.r.cloudfront.net
tagan.adlightning.com
10    69.173.151.100 (United States)

ASN26667 (RUBICONPROJECT, US)
token.rubiconproject.com
pixel.rubiconproject.com
7    104.36.115.113 (United States)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
4    2620:100:a001::c (United States)

ASN19750 (AS-CRITEO, US)
gum.criteo.com
4    2620:116:800b:21:61c0:eb61:c438:2f4e (United States)

ASN14618 (AMAZON-AES, US)
secure.quantserve.com
pixel.quantserve.com
1    13.225.205.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-205-105.ewr50.r.cloudfront.net
dggaenaawxe8z.cloudfront.net
1    23.52.162.163 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-162-163.deploy.static.akamaitechnologies.com
s.ntv.io
2    74.119.119.139 (United States)

ASN19750 (AS-CRITEO, US)
mug.criteo.com
22    68.67.160.132 (New York, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
ib.adnxs.com
3    23.199.204.79 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-199-204-79.deploy.static.akamaitechnologies.com
htlb.casalemedia.com
3    3.224.175.57 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-224-175-57.compute-1.amazonaws.com
tlx.3lift.com
6    104.36.115.111 (United States)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
3    35.211.165.199 (North Charleston, United States)

ASN19527 (GOOGLE-2, US)
PTR: 199.165.211.35.bc.googleusercontent.com
grid.bidswitch.net
2    34.149.20.76 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 76.20.149.34.bc.googleusercontent.com
ssc.33across.com
22    34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com
freestar-d.openx.net
us-u.openx.net
15    34.236.83.94 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-236-83-94.compute-1.amazonaws.com
c2shb.ssp.yahoo.com
3    34.107.148.139 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 139.148.107.34.bc.googleusercontent.com
prebid.media.net
21    104.16.190.66 (None, )

ASN13335 (CLOUDFLARENET, US)
dmx.districtm.io
cdn.districtm.io
15    18.159.151.182 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
btlr.sharethrough.com
6    54.226.174.129 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-226-174-129.compute-1.amazonaws.com
ads.yieldmo.com
3    2602:803:c002:200::41 (United States)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
4    8.43.72.97 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel-us-east.rubiconproject.com
12    3.81.191.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-81-191-231.compute-1.amazonaws.com
ads.adaptv.advertising.com
7    35.168.56.65 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-168-56-65.compute-1.amazonaws.com
pixel.advertising.com
11    3.218.90.66 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-218-90-66.compute-1.amazonaws.com
ups.analytics.yahoo.com
9    151.101.2.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
4    185.167.164.39 (Denmark)

ASN198622 (ADFORM, DK)
c1.adform.net
21    104.36.115.109 (United States)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
6    54.166.81.178 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-166-81-178.compute-1.amazonaws.com
match.prod.bidr.io
3    74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)
dis.criteo.com
3    169.197.150.8 (United States)

ASN398989 (DEEPINTENT, US)
PTR: g.deepintent.com
match.deepintent.com
2    173.231.178.116 (United States)

ASN29791 (VOXEL-DOT-NET, US)
PTR: lga-delivery-8.sys.adgear.com
cm.adgrx.com
3    54.175.198.118 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-175-198-118.compute-1.amazonaws.com
sync.srv.stackadapt.com
3    2606:4700::6812:c05 (United States)

ASN13335 (CLOUDFLARENET, US)
a.tribalfusion.com
s.tribalfusion.com
4    54.166.52.96 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-166-52-96.compute-1.amazonaws.com
pm.w55c.net
1    38.27.122.101 (United States)

ASN174 (COGENT-174, US)
match.bnmla.com
6    199.127.204.142 (United States)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
sync.targeting.unrulymedia.com
1    69.90.254.78 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
ums.acuityplatform.com
1    104.45.178.220 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
mweb.ck.inmobi.com
8    8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
2    23.219.95.182 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-219-95-182.deploy.static.akamaitechnologies.com
px.owneriq.net
12    35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
idsync.rlcdn.com
id.rlcdn.com
2    107.178.254.65 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com
pippio.com
1    34.98.67.3 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 3.67.98.34.bc.googleusercontent.com
tags.rd.linksynergy.com
7    74.121.140.14 (Reston, United States)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
2    104.36.115.114 (United States)

ASN62713 (AS-PUBMATIC, US)
image4.pubmatic.com
4    52.116.221.248 (United States)

ASN36351 (SOFTLAYER, US)
PTR: f8.dd.7434.ip4.static.sl-reverse.com
um.simpli.fi
8    2620:112:f000:bbbb::11 (United States)

ASN6336 (TURN-US-ASN, US)
ad.turn.com
9    2600:1f18:4e9:5a02:1f9d:78fd:b4f5:2185 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
pr-bh.ybp.yahoo.com
14    2001:438:65:11::1690 (United States)

ASN26762 (CNVR-US-EAST, US)
pubmatic-match.dotomi.com
amazon-tam-match.dotomi.com
medianet-match.dotomi.com
casale-match.dotomi.com
33across-match.dotomi.com
districtm-match.dotomi.com
1    52.45.215.106 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-215-106.compute-1.amazonaws.com
rtb.adentifi.com
1    54.159.94.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-159-94-231.compute-1.amazonaws.com
sync.ipredictive.com
2    38.67.14.233 (United States)

ASN174 (COGENT-174, US)
pmp.mxptint.net
4    207.198.113.169 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
20    18.157.70.90 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-157-70-90.eu-central-1.compute.amazonaws.com
x.bidswitch.net
1    52.23.124.50 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-23-124-50.compute-1.amazonaws.com
sonata-notifications.taptapnetworks.com
1    45.35.192.162 (United States)

ASN40676 (AS40676, US)
sync.resetdigital.co
54    2607:f8b0:4006:806::2001 (United States)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
6    151.101.130.133 (United States)

ASN54113 (FASTLY, US)
cdn.krxd.net
2    52.20.92.17 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-92-17.compute-1.amazonaws.com
uat5-a.investingchannel.com
1    54.146.124.230 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-146-124-230.compute-1.amazonaws.com
jadserve.postrelease.com
1    23.5.238.78 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-5-238-78.deploy.static.akamaitechnologies.com
secure.cdn.fastclick.net
1    46.105.202.126 (France)

ASN16276 (OVH, FR)
cdn.id5-sync.com
1    34.205.221.238 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-205-221-238.compute-1.amazonaws.com
hb.emxdgt.com
19    209.54.176.128 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
3    3.222.130.154 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-222-130-154.compute-1.amazonaws.com
acds.prod.vidible.tv
3    51.195.5.231 (France)

ASN16276 (OVH, FR)
PTR: p35.id5-sync.com
id5-sync.com
3    2001:4998:14:800::1001 (Ashburn, United States)

ASN14777 (YAHOO, US)
cdn-ssl.vidible.tv
12    54.87.41.176 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-87-41-176.compute-1.amazonaws.com
trk.vidible.tv
2    151.101.66.133 (United States)

ASN54113 (FASTLY, US)
consumer.krxd.net
8    2606:2800:220:1410:489:141e:20bb:12f6 (United States)

ASN15133 (EDGECAST, US)
cdn.syndication.twimg.com
pbs.twimg.com
3    3.231.253.205 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-231-253-205.compute-1.amazonaws.com
ads-ec.v.ssp.yahoo.com
10    34.200.159.147 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-159-147.compute-1.amazonaws.com
match.sharethrough.com
2    34.200.184.86 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-184-86.compute-1.amazonaws.com
sync-amz.ads.yieldmo.com
sync-pp.ads.yieldmo.com
1    199.187.193.179 (Canada)

ASN47043 (SMARTADSERVER, CA)
ssbsync-us.smartadserver.com
1    20.72.149.136 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
sync.inmobi.com
2    63.251.86.50 (United States)

ASN32475 (SINGLEHOP-LLC, US)
ap.lijit.com
18    52.223.22.214 (United States)

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com
eb2.3lift.com
7    142.251.41.2 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s40-in-f2.1e100.net
googleads4.g.doubleclick.net
4    104.244.43.131 (United States)

ASN54113 (FASTLY, US)
abs-0.twimg.com
3    68.67.179.173 (Secaucus, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 569.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
secure.adnxs.com
1    52.21.125.8 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-125-8.compute-1.amazonaws.com
d.adroll.com
1    52.205.151.180 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-151-180.compute-1.amazonaws.com
nep.advangelists.com
1    3.128.80.187 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-128-80-187.us-east-2.compute.amazonaws.com
sync.adotmob.com
1    198.148.27.139 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
2    185.184.8.65 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-65.rtbhouse.net
creativecdn.com
5    63.251.114.182 (United States)

ASN29791 (VOXEL-DOT-NET, US)
ce.lijit.com
2    35.210.53.219 (Brussels, Belgium)

ASN19527 (GOOGLE-2, US)
PTR: 219.53.210.35.bc.googleusercontent.com
pool.admedo.com
1    52.7.51.190 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-7-51-190.compute-1.amazonaws.com
aorta.clickagy.com
4    35.207.24.140 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 140.24.207.35.bc.googleusercontent.com
rtb.mfadsrvr.com
2    50.16.197.56 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-197-56.compute-1.amazonaws.com
loadm.exelator.com
2    107.178.246.49 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 49.246.178.107.bc.googleusercontent.com
pixel.tapad.com
2    8.28.7.84 (United States)

ASN62713 (AS-PUBMATIC, US)
simage4.pubmatic.com
20    2607:f8b0:4006:81c::2001 (United States)

ASN15169 (GOOGLE, US)
cdn.ampproject.org
3    3.16.251.19 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-16-251-19.us-east-2.compute.amazonaws.com
bc-ssb-cle.springserve.com
1    54.90.48.240 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-90-48-240.compute-1.amazonaws.com
usermatch.krxd.net
8    18.213.185.73 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-213-185-73.compute-1.amazonaws.com
beacon.krxd.net
6    184.50.205.90 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-50-205-90.deploy.static.akamaitechnologies.com
stags.bluekai.com
e.dlx.addthis.com
1    34.231.251.31 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-231-251-31.compute-1.amazonaws.com
ps.eyeota.net
1    64.58.232.176 (United States)

ASN13649 (ASN-VINS, US)
global.ib-ibi.com
1    64.58.232.177 (United States)

ASN13649 (ASN-VINS, US)
PTR: be31-199.crrt01.las04.flexential.net
ib.mookie1.com
1    2600:1901:0:8eee:: (Kansas City, United States)

ASN15169 (GOOGLE, US)
fei.pro-market.net
3    3.19.190.206 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-19-190-206.us-east-2.compute.amazonaws.com
vid-io-cle.springserve.com
4    2607:f8b0:4006:806::2010 (United States)

ASN15169 (GOOGLE, US)
storage.googleapis.com
2    146.20.128.205 (United States)

ASN27357 (RACKSPACE, US)
cs.lkqd.net
1    184.29.128.213 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-29-128-213.deploy.static.akamaitechnologies.com
aktrack.pubmatic.com
1    2600:1400:d:593::1ec4 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)
secure.insightexpressai.com
2    184.29.129.73 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-29-129-73.deploy.static.akamaitechnologies.com
sync.teads.tv
1    2600:1f18:612b:4200:787a:99c3:22c2:11ca (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
partners.tremorhub.com
1    2a04:4e42:600::300 (United States)

ASN54113 (FASTLY, US)
trc.taboola.com
1    151.101.65.44 (United States)

ASN54113 (FASTLY, US)
match.taboola.com
1    172.105.232.22 (Tokyo, Japan)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1886-22.members.linode.com
gocm.c.appier.net
1    23.88.75.186 (Gunzenhausen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.186.75.88.23.clients.your-server.de
csync.loopme.me
3    52.205.58.132 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-58-132.compute-1.amazonaws.com
beacon.lynx.cognitivlabs.com
1    195.5.165.20 (Slovenia)

ASN44968 (IPROM-AS, SI)
core.iprom.net
1    34.102.253.54 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 54.253.102.34.bc.googleusercontent.com
ads.playground.xyz
1    159.65.196.12 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)
match.adsby.bidtheatre.com
1    34.225.34.171 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-225-34-171.compute-1.amazonaws.com
rtb.gumgum.com
1    20.88.207.242 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
beacon.walmart.com
2    35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com
rtb.openx.net
1    2600:1f18:445b:901:5dde:90cc:842c:e1f (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
ag.innovid.com
1    2620:116:800b:21:ea23:7677:128a:8c9c (United States)

ASN14618 (AMAZON-AES, US)
cms.quantserve.com
1    2600:9000:21da:5400:19:fc2c:a140:93a1 (United States)

ASN16509 (AMAZON-02, US)
d.agkn.com
1    35.190.90.30 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 30.90.190.35.bc.googleusercontent.com
odr.mookie1.com
1    34.120.155.137 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 137.155.120.34.bc.googleusercontent.com
api.rlcdn.com
1    52.73.153.177 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-73-153-177.compute-1.amazonaws.com
id.crwdcntrl.net
1    54.218.247.33 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-218-247-33.us-west-2.compute.amazonaws.com
id.sharedid.org
1    104.17.120.107 (None, )

ASN13335 (CLOUDFLARENET, US)
biddr.brealtime.com
28    23.52.167.93 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-167-93.deploy.static.akamaitechnologies.com
contextual.media.net
hbx.media.net
cs.media.net
c21lg-d.media.net
2    151.101.193.108 (United States)

ASN54113 (FASTLY, US)
acdn.adnxs.com
7    67.202.105.22 (United States)

ASN32748 (STEADFAST, US)
PTR: ip22.67-202-105.static.steadfastdns.net
ssc-cms.33across.com
2    67.202.105.33 (United States)

ASN32748 (STEADFAST, US)
PTR: ip33.67-202-105.static.steadfastdns.net
de.tynt.com
4    2620:109:c002::6cae:a0e (United States)

ASN14413 (LINKEDIN, US)
px.ads.linkedin.com
4    104.18.99.194 (None, )

ASN13335 (CLOUDFLARENET, US)
p.adsymptotic.com
2    52.5.237.191 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-5-237-191.compute-1.amazonaws.com
ads.creative-serving.com
2    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
8    70.42.32.159 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com
b1sync.zemanta.com
5    199.38.167.129 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
2    54.149.241.156 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-149-241-156.us-west-2.compute.amazonaws.com
dpm.demdex.net
2    204.62.13.72 (Clifton, United States)

ASN46636 (NATCOWEB, US)
inv-nets.admixer.net
2    35.174.6.234 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-174-6-234.compute-1.amazonaws.com
ads.avct.cloud
1    54.86.74.19 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-86-74-19.compute-1.amazonaws.com
cms-xch.33across.com
6    34.117.239.71 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 71.239.117.34.bc.googleusercontent.com
cms-xch-chicago.33across.com
1    185.184.10.30 (Poland)

ASN203690 (RTB-HOUSE-ASH, PL)
PTR: ip-185-184-10-30.rtbhouse.net
us.creativecdn.com
2    34.73.194.24 (North Charleston, United States)

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: 24.194.73.34.bc.googleusercontent.com
dmx.us-east-34.districtm.io
4    51.222.80.231 (Canada)

ASN16276 (OVH, FR)
PTR: pikafka-4.cloudy.ovh
pixel.onaudience.com
4    2606:4700:10::6816:1957 (United States)

ASN13335 (CLOUDFLARENET, US)
spl.zeotap.com
mwzeom.zeotap.com
4    35.201.96.126 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 126.96.201.35.bc.googleusercontent.com
visitor.fiftyt.com
2    156.154.202.36 (United States)

ASN19907 (NEUSTAR-AS6, US)
aa.agkn.com
4    3.215.189.212 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-215-189-212.compute-1.amazonaws.com
io.narrative.io
1    2600:9000:21dd:4200:6:44e3:f8c0:93a1 (None, )

ASN- ()
rules.quantcount.com
Apex Domain
Subdomains		 Transfer
95 doubleclick.net
ad.doubleclick.net
googleads.g.doubleclick.net
securepubads.g.doubleclick.net
cm.g.doubleclick.net
googleads4.g.doubleclick.net
391 KB
88 googlesyndication.com
pagead2.googlesyndication.com
tpc.googlesyndication.com
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
1 MB
54 pubmatic.com
ads.pubmatic.com
image6.pubmatic.com
hbopenbid.pubmatic.com
simage2.pubmatic.com
image2.pubmatic.com
image4.pubmatic.com
simage4.pubmatic.com
aktrack.pubmatic.com
139 KB
38 yahoo.com
c2shb.ssp.yahoo.com
ups.analytics.yahoo.com
pr-bh.ybp.yahoo.com
ads-ec.v.ssp.yahoo.com
14 KB
35 connatix.com
cd.connatix.com
cds.connatix.com
capi.connatix.com
vid.connatix.com
img.connatix.com
cks.connatix.com
ck.connatix.com
623 KB
32 bleepstatic.com
www.bleepstatic.com
621 KB
31 media.net
prebid.media.net
contextual.media.net
hbx.media.net
cs.media.net
c21lg-d.media.net
94 KB
30 casalemedia.com
htlb.casalemedia.com
ssum-sec.casalemedia.com
ssum.casalemedia.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
54 KB
28 twitter.com
platform.twitter.com
syndication.twitter.com
744 KB
27 adnxs.com
ib.adnxs.com
secure.adnxs.com
acdn.adnxs.com
56 KB
27 rubiconproject.com
secure-assets.rubiconproject.com
eus.rubiconproject.com
token.rubiconproject.com
fastlane.rubiconproject.com
pixel-us-east.rubiconproject.com
pixel.rubiconproject.com
55 KB
25 sharethrough.com
btlr.sharethrough.com
match.sharethrough.com
4 KB
25 amazon-adsystem.com
c.amazon-adsystem.com
s.amazon-adsystem.com
55 KB
24 openx.net
freestar-d.openx.net
us-u.openx.net
rtb.openx.net
4 KB
23 districtm.io
dmx.districtm.io
cdn.districtm.io
dmx.us-east-34.districtm.io
9 KB
23 bidswitch.net
grid.bidswitch.net
x.bidswitch.net
10 KB
21 3lift.com
tlx.3lift.com
eb2.3lift.com
15 KB
20 ampproject.org
cdn.ampproject.org
407 KB
20 pub.network
a.pub.network
d.pub.network
c.pub.network
354 KB
19 advertising.com
ads.adaptv.advertising.com
pixel.advertising.com
11 KB
19 adsrvr.org
match.adsrvr.org
10 KB
18 vidible.tv
acds.prod.vidible.tv
cdn-ssl.vidible.tv
trk.vidible.tv
331 KB
17 krxd.net
cdn.krxd.net
consumer.krxd.net
usermatch.krxd.net
beacon.krxd.net
178 KB
17 adlightning.com
tagan.adlightning.com
421 KB
16 33across.com
ssc.33across.com
ssc-cms.33across.com
cms-xch.33across.com
cms-xch-chicago.33across.com
5 KB
14 dotomi.com
pubmatic-match.dotomi.com
amazon-tam-match.dotomi.com
medianet-match.dotomi.com
casale-match.dotomi.com
33across-match.dotomi.com
districtm-match.dotomi.com
5 KB
14 google.com
www.google.com
adservice.google.com
2 KB
13 rlcdn.com
idsync.rlcdn.com
id.rlcdn.com
api.rlcdn.com
1 KB
13 springserve.com
vid.springserve.com
vpaid.springserve.com
bc-ssb-cle.springserve.com
vid-io-cle.springserve.com
267 KB
13 gstatic.com
www.gstatic.com
fonts.gstatic.com
138 KB
12 twimg.com
cdn.syndication.twimg.com
abs-0.twimg.com
pbs.twimg.com
151 KB
12 googleapis.com
fonts.googleapis.com
imasdk.googleapis.com
storage.googleapis.com
718 KB
9 everesttech.net
sync-tm.everesttech.net
2 KB
9 criteo.com
gum.criteo.com
mug.criteo.com
dis.criteo.com
3 KB
8 zemanta.com
b1sync.zemanta.com
5 KB
8 turn.com
ad.turn.com
4 KB
8 yieldmo.com
ads.yieldmo.com
sync-amz.ads.yieldmo.com
sync-pp.ads.yieldmo.com
7 KB
8 googletagservices.com
www.googletagservices.com
282 KB
7 lijit.com
ap.lijit.com
ce.lijit.com
8 KB
7 mathtag.com
sync.mathtag.com
4 KB
7 moatads.com
z.moatads.com
px.moatads.com
133 KB
7 addthis.com
s9.addthis.com
m.addthis.com
s7.addthis.com Failed
api-public.addthis.com
e.dlx.addthis.com
219 KB
6 bidr.io
match.prod.bidr.io
2 KB
5 rfihub.com
p.rfihub.com
4 KB
5 bluekai.com
stags.bluekai.com
4 KB
5 quantserve.com
secure.quantserve.com
pixel.quantserve.com
cms.quantserve.com
11 KB
5 2mdn.net
s0.2mdn.net
206 KB
5 indexww.com
js-sec.indexww.com
4 KB
4 narrative.io
io.narrative.io
1 KB
4 fiftyt.com
visitor.fiftyt.com
2 KB
4 zeotap.com
spl.zeotap.com
mwzeom.zeotap.com
2 KB
4 onaudience.com
pixel.onaudience.com
2 KB
4 adsymptotic.com
p.adsymptotic.com
923 B
4 linkedin.com
px.ads.linkedin.com
1 KB
4 mfadsrvr.com
rtb.mfadsrvr.com
1 KB
4 id5-sync.com
cdn.id5-sync.com
id5-sync.com
13 KB
4 sitescout.com
pixel-sync.sitescout.com
3 KB
4 simpli.fi
um.simpli.fi
2 KB
4 1rx.io
sync.1rx.io
3 KB
4 w55c.net
pm.w55c.net
3 KB
4 adform.net
c1.adform.net
2 KB
4 scorecardresearch.com
sb.scorecardresearch.com
2 KB
3 agkn.com
d.agkn.com
aa.agkn.com
2 KB
3 cognitivlabs.com
beacon.lynx.cognitivlabs.com
948 B
3 creativecdn.com
creativecdn.com
us.creativecdn.com
986 B
3 tribalfusion.com
a.tribalfusion.com
s.tribalfusion.com
2 KB
3 stackadapt.com
sync.srv.stackadapt.com
1 KB
3 deepintent.com
match.deepintent.com
889 B
3 bleepingcomputer.com
www.bleepingcomputer.com
17 KB
2 avct.cloud
ads.avct.cloud
894 B
2 admixer.net
inv-nets.admixer.net
1 KB
2 demdex.net
dpm.demdex.net
2 KB
2 bing.com
c.bing.com
926 B
2 creative-serving.com
ads.creative-serving.com
1 KB
2 tynt.com
de.tynt.com
3 KB
2 taboola.com
trc.taboola.com
match.taboola.com
653 B
2 teads.tv
sync.teads.tv
637 B
2 lkqd.net
cs.lkqd.net
913 B
2 mookie1.com
ib.mookie1.com
odr.mookie1.com
2 KB
2 tapad.com
pixel.tapad.com
961 B
2 exelator.com
loadm.exelator.com
2 KB
2 admedo.com
pool.admedo.com
721 B
2 investingchannel.com
uat5-a.investingchannel.com
454 B
2 mxptint.net
pmp.mxptint.net
967 B
2 pippio.com
pippio.com
845 B
2 owneriq.net
px.owneriq.net
1 KB
2 inmobi.com
mweb.ck.inmobi.com
sync.inmobi.com
1 KB
2 unrulymedia.com
sync.targeting.unrulymedia.com
1 KB
2 adgrx.com
cm.adgrx.com
1 KB
2 floors.dev
api.floors.dev
4 KB
2 reddit.com
www.reddit.com
3 KB
2 escalated.io
tag.escalated.io
49 KB
2 google.ca
adservice.google.ca
914 B
2 btloader.com
btloader.com
api.btloader.com
24 KB
2 google-analytics.com
www.google-analytics.com
20 KB
2 firstimpression.io
ecdn.firstimpression.io
cdn.firstimpression.io
100 KB
1 quantcount.com
rules.quantcount.com
1 KB
1 brealtime.com
biddr.brealtime.com
1 KB
1 sharedid.org
id.sharedid.org
379 B
1 crwdcntrl.net
id.crwdcntrl.net
831 B
1 innovid.com
ag.innovid.com
296 B
1 walmart.com
beacon.walmart.com
578 B
1 gumgum.com
rtb.gumgum.com
238 B
1 bidtheatre.com
match.adsby.bidtheatre.com
534 B
1 playground.xyz
ads.playground.xyz
463 B
1 iprom.net
core.iprom.net
282 B
1 loopme.me
csync.loopme.me
217 B
1 appier.net
gocm.c.appier.net
393 B
1 tremorhub.com
partners.tremorhub.com
183 B
1 insightexpressai.com
secure.insightexpressai.com
2 KB
1 pro-market.net
fei.pro-market.net
324 B
1 ib-ibi.com
global.ib-ibi.com
489 B
1 eyeota.net
ps.eyeota.net
344 B
1 clickagy.com
aorta.clickagy.com
657 B
1 contextweb.com
bh.contextweb.com
672 B
1 adotmob.com
sync.adotmob.com
706 B
1 advangelists.com
nep.advangelists.com
231 B
1 adroll.com
d.adroll.com
112 B
1 smartadserver.com
ssbsync-us.smartadserver.com
329 B
1 emxdgt.com
hb.emxdgt.com
165 B
1 fastclick.net
secure.cdn.fastclick.net
17 KB
1 postrelease.com
jadserve.postrelease.com
759 B
1 resetdigital.co
sync.resetdigital.co
485 B
1 taptapnetworks.com
sonata-notifications.taptapnetworks.com
323 B
1 ipredictive.com
sync.ipredictive.com
522 B
1 adentifi.com
rtb.adentifi.com
88 B
1 linksynergy.com
tags.rd.linksynergy.com
358 B
1 acuityplatform.com
ums.acuityplatform.com
674 B
1 bnmla.com
match.bnmla.com
114 B
1 ntv.io
s.ntv.io
114 KB
1 cloudfront.net
dggaenaawxe8z.cloudfront.net
3 KB
1 ad-delivery.net
ad-delivery.net
939 B
1 technoratimedia.com
sync.technoratimedia.com
742 B
1 googleadservices.com
partner.googleadservices.com
653 B
1 videoplayerhub.com
freestar-io.videoplayerhub.com
536 B
1 pghub.io
pghub.io
4 KB
1 addthisedge.com
v1.addthisedge.com
855 B
1 outbrain.com
widgets.outbrain.com
3 KB
1 analysis.fi
ecdn.analysis.fi
2 KB
1 cloudflareinsights.com
static.cloudflareinsights.com
5 KB
1 googletagmanager.com
www.googletagmanager.com
36 KB
832 141
Domain Requested by
51 tpc.googlesyndication.com googleads.g.doubleclick.net
www.bleepingcomputer.com
tpc.googlesyndication.com
cdn.ampproject.org
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
tagan.adlightning.com
50 cm.g.doubleclick.net 28 redirects eus.rubiconproject.com
googleads.g.doubleclick.net
www.bleepingcomputer.com
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
us-u.openx.net
eb2.3lift.com
34 pagead2.googlesyndication.com www.bleepingcomputer.com
pagead2.googlesyndication.com
srcdoc
tpc.googlesyndication.com
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
tagan.adlightning.com
www.googletagservices.com
googleads.g.doubleclick.net
32 www.bleepstatic.com www.bleepingcomputer.com
www.bleepstatic.com
24 googleads.g.doubleclick.net pagead2.googlesyndication.com
googleads.g.doubleclick.net
tagan.adlightning.com
www.bleepingcomputer.com
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
23 platform.twitter.com www.bleepingcomputer.com
platform.twitter.com
22 ib.adnxs.com 7 redirects a.pub.network
vpaid.springserve.com
sync-amz.ads.yieldmo.com
googleads.g.doubleclick.net
acdn.adnxs.com
21 simage2.pubmatic.com 2 redirects ads.pubmatic.com
20 contextual.media.net a.pub.network
contextual.media.net
20 cdn.ampproject.org www.bleepingcomputer.com
20 x.bidswitch.net 19 redirects www.bleepingcomputer.com
19 us-u.openx.net 6 redirects googleads.g.doubleclick.net
a.pub.network
us-u.openx.net
19 s.amazon-adsystem.com 1 redirects tagan.adlightning.com
s.amazon-adsystem.com
match.sharethrough.com
ssum-sec.casalemedia.com
sync-amz.ads.yieldmo.com
ap.lijit.com
eus.rubiconproject.com
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
us-u.openx.net
eb2.3lift.com
19 match.adsrvr.org 18 redirects a.pub.network
18 dsum-sec.casalemedia.com 2 redirects ssum-sec.casalemedia.com
googleads.g.doubleclick.net
18 eb2.3lift.com 4 redirects a.pub.network
eb2.3lift.com
17 dmx.districtm.io a.pub.network
cdn.districtm.io
www.bleepingcomputer.com
17 tagan.adlightning.com a.pub.network
tagan.adlightning.com
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
17 capi.connatix.com cd.connatix.com
www.bleepingcomputer.com
eus.rubiconproject.com
ads.pubmatic.com
15 btlr.sharethrough.com a.pub.network
15 c2shb.ssp.yahoo.com a.pub.network
13 securepubads.g.doubleclick.net www.googletagservices.com
cd.connatix.com
securepubads.g.doubleclick.net
www.bleepingcomputer.com
12 trk.vidible.tv www.bleepingcomputer.com
12 ads.adaptv.advertising.com 3 redirects vpaid.springserve.com
12 www.google.com 5 redirects www.bleepingcomputer.com
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
tagan.adlightning.com
11 c.pub.network a.pub.network
11 ups.analytics.yahoo.com 6 redirects www.bleepingcomputer.com
us-u.openx.net
ssum-sec.casalemedia.com
11 img.connatix.com www.bleepingcomputer.com
10 match.sharethrough.com 5 redirects s.amazon-adsystem.com
match.sharethrough.com
9 pr-bh.ybp.yahoo.com 4 redirects ads.pubmatic.com
ssum-sec.casalemedia.com
us-u.openx.net
9 sync-tm.everesttech.net 8 redirects www.bleepingcomputer.com
8 b1sync.zemanta.com 8 redirects
8 beacon.krxd.net www.bleepingcomputer.com
cdn.krxd.net
8 ad.turn.com 8 redirects
8 image2.pubmatic.com ads.pubmatic.com
8 eus.rubiconproject.com cd.connatix.com
eus.rubiconproject.com
s.amazon-adsystem.com
a.pub.network
de.tynt.com
8 www.googletagservices.com a.pub.network
googleads.g.doubleclick.net
tagan.adlightning.com
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
www.bleepingcomputer.com
7 ssc-cms.33across.com 7 redirects
7 googleads4.g.doubleclick.net www.bleepingcomputer.com
googleads.g.doubleclick.net
7 sync.mathtag.com 7 redirects
7 idsync.rlcdn.com 2 redirects ads.pubmatic.com
www.bleepingcomputer.com
us-u.openx.net
7 pixel.advertising.com 7 redirects
7 image6.pubmatic.com 3 redirects ads.pubmatic.com
7 ads.pubmatic.com cd.connatix.com
ads.pubmatic.com
s.amazon-adsystem.com
www.bleepingcomputer.com
a.pub.network
7 fonts.gstatic.com fonts.googleapis.com
6 cms-xch-chicago.33across.com de.tynt.com
eus.rubiconproject.com
6 pbs.twimg.com www.bleepingcomputer.com
platform.twitter.com
6 ssum-sec.casalemedia.com 1 redirects s.amazon-adsystem.com
ssum-sec.casalemedia.com
js-sec.indexww.com
6 cdn.krxd.net www.bleepingcomputer.com
cdn.krxd.net
tagan.adlightning.com
6 match.prod.bidr.io 4 redirects ads.pubmatic.com
ssum-sec.casalemedia.com
6 ads.yieldmo.com a.pub.network
sync-amz.ads.yieldmo.com
6 hbopenbid.pubmatic.com a.pub.network
vpaid.springserve.com
6 c.amazon-adsystem.com a.pub.network
c.amazon-adsystem.com
6 www.gstatic.com www.bleepingcomputer.com
googleads.g.doubleclick.net
6 a.pub.network www.bleepingcomputer.com
a.pub.network
tagan.adlightning.com
5 p.rfihub.com 5 redirects
5 stags.bluekai.com 5 redirects
5 ce.lijit.com ap.lijit.com
5 id.rlcdn.com 2 redirects eus.rubiconproject.com
contextual.media.net
5 pixel.rubiconproject.com eus.rubiconproject.com
5 token.rubiconproject.com 4 redirects eus.rubiconproject.com
5 s0.2mdn.net imasdk.googleapis.com
googleads.g.doubleclick.net
www.bleepingcomputer.com
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
5 syndication.twitter.com platform.twitter.com
www.bleepingcomputer.com
5 js-sec.indexww.com a.pub.network
ssum-sec.casalemedia.com
4 io.narrative.io 2 redirects www.bleepingcomputer.com
4 visitor.fiftyt.com 2 redirects www.bleepingcomputer.com
4 pixel.onaudience.com 4 redirects
4 cs.media.net contextual.media.net
4 medianet-match.dotomi.com 4 redirects
4 p.adsymptotic.com 2 redirects eb2.3lift.com
4 px.ads.linkedin.com 4 redirects
4 cdn.districtm.io a.pub.network
cdn.districtm.io
4 storage.googleapis.com tagan.adlightning.com
4 rtb.mfadsrvr.com 4 redirects
4 abs-0.twimg.com www.bleepingcomputer.com
4 pixel-sync.sitescout.com 4 redirects
4 um.simpli.fi 4 redirects
4 sync.1rx.io 4 redirects
4 pm.w55c.net 4 redirects
4 c1.adform.net 3 redirects ads.pubmatic.com
4 pixel-us-east.rubiconproject.com 4 redirects
4 gum.criteo.com 1 redirects contextual.media.net
4 vid.springserve.com cd.connatix.com
vpaid.springserve.com
4 imasdk.googleapis.com cd.connatix.com
imasdk.googleapis.com
4 sb.scorecardresearch.com 1 redirects a.pub.network
www.bleepingcomputer.com
4 z.moatads.com s9.addthis.com
cdn-ssl.vidible.tv
4 fonts.googleapis.com www.bleepingcomputer.com
googleads.g.doubleclick.net
3 beacon.lynx.cognitivlabs.com 2 redirects ads.pubmatic.com
3 vid-io-cle.springserve.com vpaid.springserve.com
3 bc-ssb-cle.springserve.com vpaid.springserve.com
3 secure.adnxs.com 3 redirects
3 px.moatads.com www.bleepingcomputer.com
3 ads-ec.v.ssp.yahoo.com www.bleepingcomputer.com
3 cdn-ssl.vidible.tv acds.prod.vidible.tv
3 id5-sync.com 1 redirects cdn.id5-sync.com
www.bleepingcomputer.com
3 acds.prod.vidible.tv www.bleepingcomputer.com
3 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com securepubads.g.doubleclick.net
tagan.adlightning.com
3 pixel.quantserve.com 2 redirects www.bleepingcomputer.com
3 sync.srv.stackadapt.com 3 redirects
3 match.deepintent.com 2 redirects ads.pubmatic.com
3 dis.criteo.com 2 redirects ads.pubmatic.com
3 fastlane.rubiconproject.com a.pub.network
3 prebid.media.net a.pub.network
3 freestar-d.openx.net a.pub.network
3 grid.bidswitch.net a.pub.network
3 tlx.3lift.com a.pub.network
3 htlb.casalemedia.com a.pub.network
3 vpaid.springserve.com cd.connatix.com
3 s7.addthis.com s9.addthis.com
3 d.pub.network a.pub.network
3 www.bleepingcomputer.com static.cloudflareinsights.com
2 aa.agkn.com www.bleepingcomputer.com
ads.pubmatic.com
2 mwzeom.zeotap.com www.bleepingcomputer.com
2 spl.zeotap.com 2 redirects
2 districtm-match.dotomi.com 2 redirects
2 dmx.us-east-34.districtm.io www.bleepingcomputer.com
2 c21lg-d.media.net contextual.media.net
2 33across-match.dotomi.com 2 redirects
2 casale-match.dotomi.com 2 redirects
2 ads.avct.cloud 2 redirects
2 inv-nets.admixer.net 2 redirects
2 hbx.media.net contextual.media.net
2 dpm.demdex.net 1 redirects ssum-sec.casalemedia.com
2 dsum.casalemedia.com ssum-sec.casalemedia.com
2 c.bing.com eb2.3lift.com
2 ads.creative-serving.com 2 redirects
2 de.tynt.com 1 redirects a.pub.network
2 acdn.adnxs.com a.pub.network
2 rtb.openx.net 2 redirects
2 sync.teads.tv 1 redirects googleads.g.doubleclick.net
2 cs.lkqd.net 1 redirects googleads.g.doubleclick.net
2 simage4.pubmatic.com ads.pubmatic.com
2 pixel.tapad.com 2 redirects
2 loadm.exelator.com 2 redirects
2 pool.admedo.com 2 redirects
2 creativecdn.com 2 redirects
2 ap.lijit.com 1 redirects s.amazon-adsystem.com
2 amazon-tam-match.dotomi.com 2 redirects
2 cdn.syndication.twimg.com platform.twitter.com
2 consumer.krxd.net cdn.krxd.net
2 uat5-a.investingchannel.com dggaenaawxe8z.cloudfront.net
2 pmp.mxptint.net 1 redirects ads.pubmatic.com
2 pubmatic-match.dotomi.com 2 redirects
2 image4.pubmatic.com ads.pubmatic.com
2 pippio.com 2 redirects
2 px.owneriq.net 2 redirects
2 sync.targeting.unrulymedia.com 2 redirects
2 a.tribalfusion.com 2 redirects
2 cm.adgrx.com 2 redirects
2 ssc.33across.com a.pub.network
2 mug.criteo.com www.bleepingcomputer.com
2 api.floors.dev a.pub.network
2 secure-assets.rubiconproject.com 2 redirects
2 cks.connatix.com 1 redirects www.bleepingcomputer.com
2 www.reddit.com s9.addthis.com
2 tag.escalated.io ecdn.firstimpression.io
tag.escalated.io
2 adservice.google.com pagead2.googlesyndication.com
tagan.adlightning.com
2 adservice.google.ca pagead2.googlesyndication.com
tagan.adlightning.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 cds.connatix.com www.bleepingcomputer.com
cd.connatix.com
1 rules.quantcount.com secure.quantserve.com
1 us.creativecdn.com 1 redirects
1 cms-xch.33across.com 1 redirects
1 biddr.brealtime.com a.pub.network
1 id.sharedid.org a.pub.network
1 id.crwdcntrl.net a.pub.network
1 api.rlcdn.com a.pub.network
1 odr.mookie1.com 1 redirects
1 d.agkn.com 1 redirects
1 cms.quantserve.com 1 redirects
1 ag.innovid.com 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
1 e.dlx.addthis.com 1 redirects
1 beacon.walmart.com 1 redirects
1 rtb.gumgum.com ads.pubmatic.com
1 match.adsby.bidtheatre.com 1 redirects
1 ads.playground.xyz 1 redirects
1 core.iprom.net ads.pubmatic.com
1 csync.loopme.me 1 redirects
1 gocm.c.appier.net 1 redirects
1 match.taboola.com ads.pubmatic.com
1 trc.taboola.com 1 redirects
1 partners.tremorhub.com googleads.g.doubleclick.net
1 secure.insightexpressai.com 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
1 aktrack.pubmatic.com www.bleepingcomputer.com
1 fei.pro-market.net 1 redirects
1 ib.mookie1.com www.bleepingcomputer.com
1 global.ib-ibi.com 1 redirects
1 ps.eyeota.net www.bleepingcomputer.com
1 usermatch.krxd.net 1 redirects
1 aorta.clickagy.com 1 redirects
1 sync-pp.ads.yieldmo.com sync-amz.ads.yieldmo.com
1 bh.contextweb.com 1 redirects
1 sync.adotmob.com 1 redirects
1 nep.advangelists.com 1 redirects
1 d.adroll.com 1 redirects
1 ssum.casalemedia.com 1 redirects
1 sync.inmobi.com 1 redirects
1 ssbsync-us.smartadserver.com 1 redirects
1 sync-amz.ads.yieldmo.com s.amazon-adsystem.com
1 hb.emxdgt.com a.pub.network
1 cdn.id5-sync.com tagan.adlightning.com
1 secure.cdn.fastclick.net tagan.adlightning.com
1 jadserve.postrelease.com tagan.adlightning.com
1 sync.resetdigital.co 1 redirects
1 sonata-notifications.taptapnetworks.com 1 redirects
1 sync.ipredictive.com 1 redirects
1 rtb.adentifi.com ads.pubmatic.com
1 tags.rd.linksynergy.com 1 redirects
1 mweb.ck.inmobi.com 1 redirects
1 ums.acuityplatform.com 1 redirects
1 match.bnmla.com ads.pubmatic.com
1 s.tribalfusion.com ads.pubmatic.com
1 ck.connatix.com 1 redirects
1 s.ntv.io a.pub.network
1 dggaenaawxe8z.cloudfront.net a.pub.network
1 secure.quantserve.com a.pub.network
1 api.btloader.com freestar-io.videoplayerhub.com
1 ad-delivery.net www.bleepingcomputer.com
1 sync.technoratimedia.com 1 redirects
1 vid.connatix.com cd.connatix.com
1 api-public.addthis.com s9.addthis.com
1 partner.googleadservices.com pagead2.googlesyndication.com
1 btloader.com www.bleepingcomputer.com
1 freestar-io.videoplayerhub.com 1 redirects
1 pghub.io a.pub.network
1 cdn.firstimpression.io ecdn.firstimpression.io
1 m.addthis.com s9.addthis.com
1 v1.addthisedge.com s9.addthis.com
1 widgets.outbrain.com www.bleepingcomputer.com
1 ad.doubleclick.net www.bleepingcomputer.com
1 ecdn.firstimpression.io www.bleepingcomputer.com
1 ecdn.analysis.fi www.bleepingcomputer.com
1 cd.connatix.com 1 redirects
1 static.cloudflareinsights.com www.bleepingcomputer.com
1 s9.addthis.com www.bleepingcomputer.com
1 www.googletagmanager.com www.bleepingcomputer.com
832 236
Subject Issuer Validity Valid
bleepingcomputer.com
Sectigo RSA Domain Validation Secure Server CA		 2020-05-16 -
2022-05-15		 2 years crt.sh
upload.video.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-06-16 -
2022-06-15		 a year crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-20 -
2022-10-19		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
odc-addthis-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2021-04-25 -
2022-04-27		 a year crt.sh
analysis.fi
Amazon		 2021-12-04 -
2023-01-01		 a year crt.sh
*.firstimpression.io
Sectigo RSA Domain Validation Secure Server CA		 2021-11-21 -
2022-12-05		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.pub.network
Go Daddy Secure Certificate Authority - G2		 2021-03-17 -
2022-04-18		 a year crt.sh
*.doubleclick.net
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.outbrain.com
DigiCert SHA2 Secure Server CA		 2021-05-25 -
2022-06-01		 a year crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2021-01-21 -
2022-01-25		 a year crt.sh
*.scorecardresearch.com
Amazon		 2021-02-28 -
2022-03-29		 a year crt.sh
*.connatix.com
Go Daddy Secure Certificate Authority - G2		 2021-08-20 -
2022-09-21		 a year crt.sh
*.pghub.io
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-09 -
2022-02-16		 a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2021-02-05 -
2022-02-09		 a year crt.sh
*.googleadservices.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.google.ca
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.escalated.io
Go Daddy Secure Certificate Authority - G2		 2021-01-03 -
2022-02-04		 a year crt.sh
syndication.twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-24 -
2022-03-23		 a year crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-05 -
2022-04-02		 6 months crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-04-01 -
2022-04-04		 a year crt.sh
*.pubmatic.com
DigiCert SHA2 Secure Server CA		 2021-03-30 -
2022-04-04		 a year crt.sh
api.floors.dev
GTS CA 1D4		 2021-10-21 -
2022-01-19		 3 months crt.sh
*.springserve.com
Amazon		 2021-09-27 -
2022-10-26		 a year crt.sh
api.btloader.com
GTS CA 1D4		 2021-10-26 -
2022-01-24		 3 months crt.sh
c.amazon-adsystem.com
Amazon		 2021-07-06 -
2022-06-27		 a year crt.sh
*.adlightning.com
Amazon		 2021-06-24 -
2022-07-23		 a year crt.sh
*.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-12-01 -
2022-02-26		 3 months crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-22 -
2022-09-21		 a year crt.sh
*.cloudfront.net
Amazon		 2021-03-19 -
2022-03-17		 a year crt.sh
*.ntv.io
DigiCert SHA2 Secure Server CA		 2021-01-25 -
2022-02-01		 a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2021-03-05 -
2022-02-19		 a year crt.sh
*.3lift.com
Amazon		 2021-06-12 -
2022-07-11		 a year crt.sh
*.bidswitch.net
Sectigo RSA Domain Validation Secure Server CA		 2020-04-23 -
2022-05-04		 2 years crt.sh
ssc.33across.com
GTS CA 1D4		 2021-11-26 -
2022-02-24		 3 months crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2021-07-08 -
2022-08-08		 a year crt.sh
web.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-10-14 -
2022-04-06		 6 months crt.sh
*.media.net
Sectigo RSA Domain Validation Secure Server CA		 2021-04-12 -
2022-05-05		 a year crt.sh
districtm.io
Cloudflare Inc ECC CA-3		 2021-06-02 -
2022-06-01		 a year crt.sh
*.sharethrough.com
Amazon		 2021-08-13 -
2022-09-11		 a year crt.sh
*.yieldmo.com
Amazon		 2021-10-12 -
2022-11-10		 a year crt.sh
*.v.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-10-19 -
2022-04-13		 6 months crt.sh
track.adform.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-06 -
2022-10-07		 a year crt.sh
*.match.prod.bidr.io
Amazon		 2021-02-26 -
2022-03-27		 a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2020-04-09 -
2022-06-08		 2 years crt.sh
*.bnmla.com
Go Daddy Secure Certificate Authority - G2		 2021-01-06 -
2022-02-07		 a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-08-24 -
2022-02-16		 6 months crt.sh
adentifi.com
Amazon		 2021-09-04 -
2022-10-03		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2021-02-25 -
2022-03-28		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
cdn.krxd.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2021-02-08 -
2022-02-07		 a year crt.sh
*.investingchannel.com
Go Daddy Secure Certificate Authority - G2		 2020-05-26 -
2022-06-01		 2 years crt.sh
*.postrelease.com
Amazon		 2021-01-28 -
2022-02-25		 a year crt.sh
secure.cdn.fastclick.net
DigiCert SHA2 Secure Server CA		 2021-03-11 -
2022-03-15		 a year crt.sh
cdn.id5-sync.com
R3		 2021-11-24 -
2022-02-22		 3 months crt.sh
*.emxdgt.com
Amazon		 2021-07-03 -
2022-08-01		 a year crt.sh
s.amazon-adsystem.com
Amazon		 2021-07-14 -
2022-06-27		 a year crt.sh
acds.prod.vidible.tv
DigiCert SHA2 High Assurance Server CA		 2021-11-16 -
2022-05-11		 6 months crt.sh
*.id5-sync.com
R3		 2021-10-05 -
2022-01-03		 3 months crt.sh
cdn-ycs.vidible.tv
DigiCert SHA2 High Assurance Server CA		 2021-10-19 -
2022-04-06		 6 months crt.sh
trk.vidible.tv
DigiCert SHA2 High Assurance Server CA		 2021-07-11 -
2022-01-05		 6 months crt.sh
consumer.krxd.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-13 -
2022-07-12		 a year crt.sh
*.ads.yieldmo.com
Amazon		 2021-05-25 -
2022-06-23		 a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2021-03-11 -
2022-04-12		 a year crt.sh
misc-sni.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.eyeota.net
R3		 2021-10-26 -
2022-01-24		 3 months crt.sh
*.storage.googleapis.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
beacon.krxd.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-11-03 -
2022-11-02		 a year crt.sh
*.insightexpressai.com
DigiCert SHA2 Secure Server CA		 2021-05-07 -
2022-05-12		 a year crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-11-28 -
2022-12-29		 a year crt.sh
beacon.lynx.cognitivlabs.com
Amazon		 2021-04-28 -
2022-05-27		 a year crt.sh
*.iprom.net
R3		 2021-10-04 -
2022-01-02		 3 months crt.sh
*.gumgum.com
Amazon		 2021-10-15 -
2022-11-12		 a year crt.sh
*.innovid.com
RapidSSL RSA CA 2018		 2020-02-07 -
2022-04-07		 2 years crt.sh
*.crwdcntrl.net
Go Daddy Secure Certificate Authority - G2		 2021-04-29 -
2022-05-31		 a year crt.sh
id.sharedid.org
Amazon		 2021-01-08 -
2022-02-06		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2021-03-18 -
2022-04-19		 a year crt.sh
*.brealtime.com
Go Daddy Secure Certificate Authority - G2		 2020-01-22 -
2022-03-22		 2 years crt.sh
cdn.adnxs.com
GlobalSign Organization Validated CA - SHA256 - G4		 2021-05-10 -
2022-06-11		 a year crt.sh
*.tynt.com
Sectigo RSA Domain Validation Secure Server CA		 2021-09-23 -
2022-09-30		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 02		 2021-09-30 -
2022-03-30		 6 months crt.sh
*.agkn.com
RapidSSL RSA CA 2018		 2020-07-25 -
2022-09-18		 2 years crt.sh

This page contains 109 frames:

Primary Page: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Frame ID: F610EA5F05BA7955510F69C85CC69A00
Requests: 226 HTTP requests in this frame

Frame: https://cds.connatix.com/p/140482/connatix.playspace.js
Frame ID: 3CCD6AC6BC28972B3EF9942E558E607B
Requests: 23 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 0126EC3C3A534D352EFFE3EB4DEEB437
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 8DCFEA4EB6ABD6A95382D5FE27CDE753
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.21f942bb866c2823339b839747a0c50c.html?origin=https%3A%2F%2Fwww.bleepingcomputer.com
Frame ID: 1D6B780FD1901EBF37F3932DD52B70F5
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20190131/zrt_lookup.html
Frame ID: C67D67C8818132BAA30C498A1DCBA7A0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Frame ID: 67890E5180882EFE625A3C85521B5EDC
Requests: 29 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1637072838&plat=2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023230&bpp=2&bdt=488&idt=322&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&prev_fmts=834x500&nras=1&correlator=7337172799486&frm=20&pv=1&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=330
Frame ID: 8BD9DA3299823A1EA75F1A6CDD28F1CF
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Frame ID: CDE35B1658DBAB0D8CD04543CB88B976
Requests: 12 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Frame ID: 9BAFD8EC7716CB463FF8ABFEA1340927
Requests: 23 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.490.0_en.html
Frame ID: 8A25BC9F7555C277B8EC79B1DC7445BD
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.490.0_en.html
Frame ID: 09E6489C4B94EFBB35A69E80C05AFB0B
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.490.0_en.html
Frame ID: 860FDD7CB5195D4452B5593E80798899
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 6D2CB3FB48307FFA2B47791040009309
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 8E87089AE67A9B23A0F634039B05E4A4
Requests: 1 HTTP requests in this frame

Frame: https://vpaid.springserve.com/production/vpaid_25214542.js
Frame ID: 520785DF6223B58BE1490FAEC2D18ED9
Requests: 12 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 7B56C90953EE1FD06DCE833B4DB58B51
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Frame ID: 4BD734AF6AD7652A7E91881091BD66FD
Requests: 15 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Frame ID: EF1B1249333330FFAA5F3D7E631200A9
Requests: 21 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
Frame ID: 90E1F31F4C8F6983C41B2CB5E5A70DD9
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Yawa4AAJpMVYSwBG&gdpr=0&gdpr_consent=&_test=Yawa4AAJpMVYSwBG
Frame ID: 512CA2E6D25F25C315163C25DE83A68D
Requests: 1 HTTP requests in this frame

Frame: https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
Frame ID: 327F8EFE3D53BFDBE44DABA5068E8782
Requests: 1 HTTP requests in this frame

Frame: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Frame ID: 444BA3AAF5BCE396D790862F5F98887F
Requests: 1 HTTP requests in this frame

Frame: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Frame ID: 3FE905E58E2CECC05423D04FBB43F38A
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=b6b28f1a-556d-11ec-a2e0-2e68efb6964a
Frame ID: 2A712CA171DC36620535C7B6047D57A9
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=xswp1o64ToFOAZv37ofaZSV4zbQ
Frame ID: 2E74F387F345D8CD0B024511F06B4002
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: FF17D271F20E69227D89CEF468A6C4DA
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:DyLVqr8t1MTGFy5&gdpr=0&gdpr_consent=
Frame ID: 24AE604302FA89E89B7183C459C77940
Requests: 1 HTTP requests in this frame

Frame: https://match.bnmla.com/usersync?sspid=10738&redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw%26piggybackCookie%3D%5BUUID%5D
Frame ID: 755F3944CDECC68B780E6A2C20D3DA1D
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005
Frame ID: 6B5D7B3669478D75E602E032B6E7D36A
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=627776628284
Frame ID: 858F9397FC2BE34B714F3757C377E00A
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=3e303838-ca53-42df-8019-95c7b3b85253
Frame ID: 8B98A396F565DC63F9ED2294747AF2CE
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6919554241026313953
Frame ID: FA0248C85A67E207907A141B5A12003C
Requests: 1 HTTP requests in this frame

Frame: https://capi.connatix.com/core/us?DemandPartner=2&UserId=38868d4c88eb47018e4265d2b8cd3a09&DemandPartnerName=Pubmatic&DemandPartnerUserId=6B5103A8-1986-4A80-BC68-1BDBA8628E47
Frame ID: 7212CCD8ECE949AC84ED86E3532EE706
Requests: 1 HTTP requests in this frame

Frame: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: E6CA544343C90ACB1A865D639F9E0691
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t
Frame ID: ABF685D544EF858F4D37088044A8F6D5
Requests: 1 HTTP requests in this frame

Frame: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=0ae1c91a-6d9d-433e-b513-fd08330d91a4&pblob=
Frame ID: 38B21EBC40A76327EBE7E5EF393D86ED
Requests: 8 HTTP requests in this frame

Frame: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Frame ID: 96B856B8050A96C9CE16AD4D5006CD03
Requests: 15 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Frame ID: E47ACE8A4736977EF21049F159C99251
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Frame ID: E8365CDC4420AA399C70F5BA9CEDAA43
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Frame ID: 1CBDD468DDCD187CCEBF1757AC975BF6
Requests: 11 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Frame ID: 29F30B66223E0CCCC14347226E0EB866
Requests: 10 HTTP requests in this frame

Frame: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Frame ID: 21C35EBF1032E0C8B950B72D64C76E2A
Requests: 6 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Frame ID: 4FC80D6325650D41308113FF5516596C
Requests: 1 HTTP requests in this frame

Frame: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Frame ID: A395BBA7800CEDD4D985901B6CEE8EBB
Requests: 7 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Frame ID: E08165F1F1BF9912EA6859C58047A756
Requests: 3 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=3167836846926884602&gdpr=0&gdpr_consent=
Frame ID: 6DAF73B9C3D6EC343B48A3F74A8A04A8
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOeR3usMl58fx9rdUH-t26syo_nrB7dPYFI7TPsw
Frame ID: B757AACC36DD9CA4450CF950DDA1D6D0
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAGdRmaSRjYVwN4bHoHAAAAAAA&expiration=1638755426&is_secure=true
Frame ID: EF29F464148F7E8D2DE40FCDBE7198E1
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Frame ID: A0FFF1EE8DCAA7CFA6EF5F3121D79FE9
Requests: 7 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=13493460417766279847
Frame ID: 8796F4F97BA69A81161553283D8C45C9
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Frame ID: 555FA1936EFF424BC8BF270A2232FF48
Requests: 19 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: DD104283208F1CDC913326B7BCA213C1
Requests: 3 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 3D96E38671C1A10B6053D6C13E23C108
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 6DDBD71F66BA55F2F8621F4E23693DA5
Requests: 2 HTTP requests in this frame

Frame: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: CAA3BF7B4EA7D7F5B3D1F2000D574CFC
Requests: 3 HTTP requests in this frame

Frame: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 3FAD33C7903DF4DC3EDAE55D224D7DCB
Requests: 17 HTTP requests in this frame

Frame: https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Frame ID: D170088F43A722F5247F7A8273076069
Requests: 14 HTTP requests in this frame

Frame: https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Frame ID: D37A0E227D38412A1FC8C657AD2056B8
Requests: 14 HTTP requests in this frame

Frame: https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Frame ID: F0763910B74242882EAE2AFAD0F545D9
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNVn6b8kjre-WFWj1Q8gmuqvv9JDEEwLMYhLL6I0Uinnq_41P6MglyxdCtTJRakeTxEM4TUbviutxSNoIfDgwM1GSE1PkQ
Frame ID: 5BA337A28DCA6C8330C6505299F27822
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Frame ID: 374EF71D4D7053645A0611F591452657
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEPTNpIoCGNjdmrkBMAE&v=APEucNWwCfkgOM84e9OBgV0bldca4T7Ws1rWeB23zdrLIk7es8Jb8WQ-OuAN4sT1UpzHeh9sMciyRY2B3p19rzLoy56CI-z51Q
Frame ID: D3CA486086F3F0BD055FEF2B80CA4365
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2PvkdA-LN-2aabo-3PaukGxF5xmn6yt5JQlDNoxMbgP5JmAi5KGcbReLsSR9niP6AJ5gT4bXrubGGgkYIzuVE2IBjvZ_JcHBvIvj0kGMrc5FNbPuBHj3s6XilmkqemntL-VgN5bQywFTaueS8QsdBVaGyEA&dbm_d=AKAmf-BiQrEPJsMuQVcyWsiQ5yEHPY_d4DuOAG7YMwql2jE-RnVBKZC3TEhkf6TZ5pOUlxDzW3zyUQZZyc6qADw4ja30EYSX4VF6CQ6ylOEAS3LAoYusBsiu3tz2tBJil817tRLmjkILcpdYDDHxijKjZGhPbNSi_dXTLhkL4MNwYpG0wPchbgW0xudUd4hQkzIY4D-jLVh1vmI8fuFi5CxbqslEewk3Hm9K7YEpd01JY4N-jVc5fasC48WcwIZzrYXNDx1c49pwnttOn8MrOuz2jQXZ7T9ZokLGtqXK_0KVNgHy2HohWVXHTN5mnFGoS8UEzMRGgxt1V3CuetbVhgYJJuwCWCvCoVIMo98t4KMaWDl57ZLtf-kYOJxQwAMQkZHq9SIYY49UR9jIw8-LhKWXJUW749A6AvYqrE6ZR0aCxGA4ygZDHcRr5cCs2SF7_1IDTpPgOVJIf0rFhghUQcCBhkgXlME70me3uG4wm5TVbhZ1g1adyBTXo-Qxc1rkv88PvNm1NnBi9rJW1P3nVlS4TWk1Bo7nKYv0a0GHj4drZjkY18cks9NWGh_qyu9HY66kW6YW3P1QQyah_pQPfMTGuHy4zQHxe-tIbDz0yoD0PhMBB22TJTBv3dRK3GAs1UdqTisvamhbKF7tLgmfrquLXHDbsJJMPwV8ZqJGMeaGXJpPAlH7Pzj2JozRlD078wHiyHHGzzstFsjBBUTD-xYilkYZyxuVgaYgsbU96YZQ0503DmnO7S95O45yER82QcKapymESC3EUWN6erpWCfjDZSFjnONn59nXzZqJ4wQKAlmNy-UjRHqPPT1y3uBQ3lF8HDiiEWDpg4ceuTfsV55s2bNGHNjy-ibxNuL0tWeDfohtruZz9EmlqZhz0fbPcFhYtPSLiX7Y-A_S48X_jRFwYqYezSj_uKXdk9TanP3efukSfqibQpABEqfUwnX0T7F8TQ3IDpxcafkHhbyDWeBIjZRfFNz0b28_-Mq4w-k75W6HFPS3JWJ0ARUV0Uq1M-ukzYLW810lm0dtfTrgy7bPo-gBxIENe2Jz1rGv8ggvxuMgtmZRJ1SPmYSZq7LDoC42S5m3vGQJpz3hkY6kIYoHWekg90QONh6HEPiaG63fYL3MGWQ8RnG5tZoo8dyyovNOL0qhqINk4qtbvG7ydXW8jwN7B8x6fsWXerqQntN24WAHsOD7R9GKIvrhinbF2zQ9_Xfpo45XIvJlaMgElG5Ls3Ckq3G27qDoG3FXlXbrjF8Skd2aO3dMI7lOmjldFI7lBLx44DK1RT8A2Iq8yW9x6qqAeArWG-krmX2dy7kwvLBlQocRSGTVk_KUSAaYGHrAoR46_hdvXQRwBJL3Z_QBJOed80JCYfW29RANjY87buYWzd68dkLYwUV_HW8LVemTTD9RIhcZnPCMz6MSqwjhmOO8Gd9pMnKfk9RCqwGt2qvQN9z3YMqkcVBPJFDVqDYrxMtu3ni_nLh34NRlemQE2OcZRB1X-_xbUyt2SNZqxYERQnCeepzEJnehLdB9pNwxiLhBVGpfF5TSlfrNL80ClvvmcL-wrq3RM1ht_DXbDLrwvxSoiKVekeGPPLHGs0jrCAARkJBUbOYoZ10ev_TvPoKaQhsdBNPRBJFm1TqUidX51iOCoEEMTxs-KST8pRKfgqnQp7fgMvFordyDGNaReXsOG_LA5YlTj9iapI_5fLUcYUygQyJXA-Qnvz3KIE-WPDf2dxovn23TXUGvT1RbdgRmckau1xRNZH3zCBayns-mzffJOZ23-dfY-Y3VgM9AYZUxeqb9U2OCu5dIHmUugtRh1O5cJrftkokknXSIZn3pUu_PWaOH6g3FLHDxpW-K6400Mxq4xXikVEIq8bF9UC4Bjc5y0eWfzyEyuhR5o_u1dnzo1kRAZSD5eJiylSMAdxKe9DhSbTAA9faRcKQpA17qL5mpgt7ZfC662d6nc6mcIm67w3X7HDc6Uv7hc4vUog-fkcDvoWDTiuMSB0KFGdk900Dyi-RN4XyKq2ZKBd-QNKfoWTKGYejnDRyKWrGKjg7bP88dLvFm8SctSJZKFja22AjCCj-4ys5yWIPOV8jlXWNvfW9u5BPWF2ccN0ibkqJxY1GwIebABR-F_yySmNJx8axwCVpmG3Pi28JHLhIm-bHFta28VSQkkkCucFX0b1F2Tn-WQ4qz3WWz63Gvxbv0nG7LjwE73qmXhosBTCP92BXfjmNy0NVE_G_q6Ri1q3APbs-2Wh6tClSgKp1CKJRo03ZKhAKvkAYBdppj0eJqW0JHiPbcPMOBvUFjz_tecWPlVqEn9TRh_TGeVncwGZyMWvbF03c4r4CcN6bqcufzjBD_8vnMg9mstoaZ24NEsjKBZ3d6iUA6s4r-lHjqNJfPdMcYFGc1MwoTc66hR3Lc5-0JH3b_3PweyZCbaHHUnva5-gPGIRcRww6fDHngs_RECEcezkNeCWd5ddoM0dU58McpZxga2aCavIaiffCJo5U68m4xFkneDZjK2aEvPENFsbQjzcFRCd1C6dx1J_Qu_n1cGvZ2duT90a1LqmL6Ym0Stm_T0IvcCsge3lfq_U5YPuiHYjQyhu69sWHgBKE49j1cJNzXVF4pN2-tKd2tf31rPhONj3aIO4OtGRSC2pky5eRNituIhPLrvFiLHktLK5oAMK7b5VutvQ6INTgLAhclUn1syaX7bVY8-0ilF1HJHS36brBH3IV-GGCf9hE2UtbfadiMw1smQGPbQdCDm_Ehlc1YqUnaoZV8p8r73k2qnORbZVVO_TBUqL7Tuq2zGleJbsS2ufXTyGUdsJ6JIjGlwZTmxJfdbSAQnHklxJOUePhYQ0U0-9MS5iggXzfiCgPKYl_GfLCIl4OpE8XCsYlkutndvz34bULPNh2RpFuf0WWp-QJWIbbiQU5HiEeaJeHtUu8MHs6a33asAOmF4hff8qpUcDi_ia--7qLyStc3BXUreQBJFKN_c0mbtg7-WLobE09KBsVOvBxb3ctOhRdo6Aqm2l93Jtv7ttVncPdo699OwA&cid=CAASEuRobyLsy9JZbvD-Sbvy21XX7A&rfl=2%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Frame ID: 627A2267344208B0D19B3101949BCAA7
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNVnEnM3ezPVnMxk4r4PfOJTKt5P5Um3ij7HzebVuE2-43ex2knsc8y7p2TicDAIQcw1kTbK97ghlwbqtV1pq2hhHotiUg
Frame ID: 6BED17D79E62559AB1A0AD53FECF3130
Requests: 4 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 9D8D8965A5F3A808672A17D487E2E639
Requests: 7 HTTP requests in this frame

Frame: https://aktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?operId=1&pubId=156696&siteId=269885&adId=1325181&adType=10&adServerId=243&kefact=0.779589&kaxefact=0.779589&kadNetFrequecy=0&kadwidth=970&kadheight=250&kadsizeid=32&kltstamp=1638669025&indirectAdId=0&adServerOptimizerId=2&ranreq=0.1&kpbmtpfact=0.820620&dcId=2&tldId=59673386&passback=0&svr=BID88828U&adsver=_2318678144&adsabzcid=0&cls=BID&ekefact=4RqsYVeZAwBucBssu1Y-V7n0QbAeOb8EbRh_b02g11y878Ig&ekaxefact=4RqsYWWZAwC18AeWWlKUm02N9kV5g9x3d0Ycq03m3QU_geRB&ekpbmtpfact=4RqsYXOZAwCZrO4nyKvF0qtuMwlu6PJGjkmZ_p9j_NOVf08s&enpp=4RqsYYCZAwDBU2TAMDsrx1UKRb4qJRA9FC8GRGnZbM-642AW&pfi=1&domId=7543222089094626466&dc=NYC3&pubBuyId=11104&crID=314665729&lpu=videotron.com&ucrid=8906793548161120565&campaignId=22987&creativeId=0&pctr=0.000000&wDSPByrId=429238&wDspId=80&wbId=2&wrId=0&wAdvID=73116&wDspCampId=43998566&isRTB=1&rtbId=8BFFE37A-2423-4776-8E97-C856E29D3321&imprId=14AE30BC-2409-496F-924C-062A3091A22E&oid=14AE30BC-2409-496F-924C-062A3091A22E&cntryId=40&domain=bleepingcomputer.com&sec=1&pAuSt=3&wops=0&sURL=bleepingcomputer.com&BrID=5
Frame ID: 571FB7EDA134626934A4013A2977471C
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 434FD794EF4CFA3095E980C8CC0BC759
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 36462B49BE1F0CEEF0C00105D3026C3C
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 544458242C2A009596135AD093D66F08
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C3488E5ED25EE27DEC01AC879E6281D2
Requests: 9 HTTP requests in this frame

Frame: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=1fda3fd9-8494-4066-aca3-a092cc97baf1-tuct8a5a066&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Frame ID: 75ED4C558410CD244755CE966175E81A
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=2DE6u0asAquivNV75hqsYQ
Frame ID: 64770FD840568D5C6D3B33A33800BE0D
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
Frame ID: F793B059F531C08990F39AF4AE06009E
Requests: 1 HTTP requests in this frame

Frame: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
Frame ID: 0ED6DF463F39DE59D5BE665AFCB95723
Requests: 1 HTTP requests in this frame

Frame: https://core.iprom.net/cookiesync
Frame ID: 6A7D6D8848ECB89CD00C83BC8F84C973
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:C65D11E4B81E46FF927733811942FFDC
Frame ID: F4CB08C54C055B7EA1FDE742E5B89E13
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: A80A19630DEEAB0A67D92469735CB270
Requests: 3 HTTP requests in this frame

Frame: https://vpaid.springserve.com/production/vpaid_25214542.js
Frame ID: 182D0B703B52627FAC8F1EC0D93F4419
Requests: 10 HTTP requests in this frame

Frame: https://storage.googleapis.com/session-hub/index.html
Frame ID: 2AB63B08712075E72817D92F223D49C0
Requests: 1 HTTP requests in this frame

Frame: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=48441f6f-76fe-46b3-81a0-fd0004006197&pblob=
Frame ID: 29A9FF67186365EA9170255B9DAE83BE
Requests: 8 HTTP requests in this frame

Frame: https://biddr.brealtime.com/check.html
Frame ID: 5A38B32C9ECF3398DFFF146750FBB5F0
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Frame ID: 67FE705D9B6F26F814CF07C0037C6280
Requests: 15 HTTP requests in this frame

Frame: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Frame ID: C05BCB351F6476EB9A50F63B48E3AB70
Requests: 11 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 4F746C23AADD0DF55F32F5D6A3380D94
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 3D542696E054B585A85B54C8CCA53B16
Requests: 9 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: A83D5DFF7A4FE847F53D539E42C12272
Requests: 3 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: C436CEC0AF22E9DF5AF5B74AA567EEC9
Requests: 9 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 47F1D4B155152715EB4F688EF87BA4B6
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Frame ID: 8DA1AACA7294C11FCD2C18CA2A554782
Requests: 15 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: 6FA732C93D4945A74AB5ACCCC08AFB1B
Requests: 11 HTTP requests in this frame

Frame: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Frame ID: F444CE0102748023C2D32D6086B8CBDD
Requests: 11 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: FD4420178B69D18CC0624DB9806E9E61
Requests: 6 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 40DCC5DA6A79561267D5E4CBD3E4532D
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 1A3BBA2A61E6C73AF07D2696ED4429C8
Requests: 6 HTTP requests in this frame

Frame: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Frame ID: A0A16843E5C81FFF20206E445A931394
Requests: 6 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 64BBED1706FC661527A50D8D82B82054
Requests: 3 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: B7AA9FBBADE6DFA2E8981427A00158B1
Requests: 11 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: CAB92971F76AB647BCFC6965AC01E645
Requests: 10 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: CFC4D7001EE8B00A9E30261CD1C56153
Requests: 10 HTTP requests in this frame

Frame: https://contextual.media.net/cksync.html?cs=8&vsid=2816706317397284000V10&type=rkt&refUrl=&vid=86690314142816706317397284000V10&ovsid=970314627676561193
Frame ID: 6A6B146057EEB2D550FCD357BF871C97
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/cksync.html?cs=8&vsid=2816706317397284000V10&type=rkt&refUrl=&vid=86690314412816706317397284000V10&ovsid=2810316550256815995
Frame ID: 8DD5009BD8F655955128A4DDAB2876B9
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Frame ID: 7428076E8BF620342106763C582BC95A
Requests: 3 HTTP requests in this frame

Frame: https://storage.googleapis.com/session-hub/index.html
Frame ID: 830A261000EAEB619D3B311C5474A3E4
Requests: 1 HTTP requests in this frame

Frame: https://vpaid.springserve.com/production/vpaid_25214542.js
Frame ID: 240E7576DC691467F27D4CE83E7BA252
Requests: 9 HTTP requests in this frame

Frame: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=57a801cf-34c5-4869-b541-b12797cf106b&pblob=
Frame ID: D7D38255689A0907C3A481190BD8C5D2
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 6F421BFD5DE59C7EE5F3CC56DFFD07AD
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D8CA6855A0329DED21E55A51C5D4D9B1
Requests: 2 HTTP requests in this frame

Frame: https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Frame ID: 8B281D86B62FA7BED300FC1B6ACAEDFF
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Emotet malware is back and rebuilding its botnet via TrickBotFacebookTwitterLinkedInRedditHacker NewsEmailFacebookTwitterLinkedInEmail

Page Statistics

832
Requests

77 %
HTTPS

22 %
IPv6

141
Domains

236
Subdomains

141
IPs

11
Countries

8164 kB
Transfer

22178 kB
Size

278
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13
  • https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en HTTP 301
  • https://www.gstatic.com/prose/brandjs.js
Request Chain 25
  • https://cd.connatix.com/connatix.playspace.js HTTP 302
  • https://cds.connatix.com/p/140482/connatix.playspace.js
Request Chain 68
  • https://freestar-io.videoplayerhub.com/gallery.js HTTP 301
  • https://btloader.com/tag?h=freestar-io&upapi=true
Request Chain 71
  • https://sb.scorecardresearch.com/b?c1=2&c2=23384447&cs_ucfr=1&ns__t=1638669023476&ns_c=UTF-8&cv=3.5&c8=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=23384447&cs_ucfr=1&ns__t=1638669023476&ns_c=UTF-8&cv=3.5&c8=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&c9=
Request Chain 93
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gapzaid&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=gapzaid&ttd_tpi=1 HTTP 302
  • https://cks.connatix.com/cks?pid=19&uid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&ttl=1641261023
Request Chain 94
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=19564_2&endpoint=us-east HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Request Chain 96
  • https://sync.technoratimedia.com/services?srv=cs&pid=70&uid=38868d4c88eb47018e4265d2b8cd3a09&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d26%26ev%3d38868d4c88eb47018e4265d2b8cd3a09%26pname%3dSynacor%26uid%3D%5BUSER_ID%5D%26direct%3D1 HTTP 307
  • https://cks.connatix.com/cks?pid=26&ev=38868d4c88eb47018e4265d2b8cd3a09&pname=Synacor&uid=11CC0AD6C88B446C9139DC1BA85CB120&direct=1 HTTP 302
  • https://capi.connatix.com/core/us?DemandPartner=26&DemandPartnerUserId=11CC0AD6C88B446C9139DC1BA85CB120&UserId=
Request Chain 137
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&lsw=1 HTTP 302
  • https://mug.criteo.com/sid?cpp=PeplHHxBWG9KZFZUQ21yYnFyZDQ4a2xheDdya2pIVVF6SXZQN0liL3EvWk5CWDBKa0JiWHBZenBuTmxzUzFEM3VDODBFeGlic1RocC9mWlBRUkNlOWxxa2VTL1E1K1piR21QVjZsQzZMb3pEV09Wc2kwMzlGWmlaTkFYdm5uU0hMSllKdDQ3NlhVZ3I5V0xGYmp5V3lPeTZ1YnVrYnBKMml0c1BjVHJwTWhCZmYvK3YrMFU3SUlYb1czNFB1RTBLTUs5NThaMzQ2a2s4Wkw1Qi9hWWNyS3drb1ZEa3pyNVN5cGtuZTJxQ3RQZHNpRGZESi81V3VreDFrMExEcW45b0F0ZXEvfA&cppv=2
Request Chain 158
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=19564_2 HTTP 302
  • https://ck.connatix.com/cks?pid=11&uid=KWSL87CK-1M-EIIR HTTP 302
  • https://capi.connatix.com/core/us?DemandPartner=11&DemandPartnerUserId=KWSL87CK-1M-EIIR&UserId=
Request Chain 170
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VVBiNmI0Yzg5OS01NTZkLTExZWMtOWYwOS0wZTk4Y2U1MzBlMzc%3D HTTP 302
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEO01pAcaofDSUIFp0YjhlV8&google_cver=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEO01pAcaofDSUIFp0YjhlV8&google_cver=1&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
Request Chain 171
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=Yawa4AAJjkWJWwBR
Request Chain 172
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&_origin=1&gdpr=0&gdpr_consent=
Request Chain 176
  • https://c1.adform.net/serving/cookie/match?party=14&cid=6B5103A8-1986-4A80-BC68-1BDBA8628E47 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
Request Chain 177
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&_test=Yawa4AAJpMVYSwBG HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Yawa4AAJpMVYSwBG&gdpr=0&gdpr_consent=&_test=Yawa4AAJpMVYSwBG
Request Chain 178
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEUlBVN0RXRFlBQUMxdFJTczFzQQ&bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
Request Chain 181
  • https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=b6b28f1a-556d-11ec-a2e0-2e68efb6964a
Request Chain 182
  • https://sync.srv.stackadapt.com/sync?nid=11 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=xswp1o64ToFOAZv37ofaZSV4zbQ
Request Chain 183
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Request Chain 184
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:DyLVqr8t1MTGFy5&gdpr=0&gdpr_consent=
Request Chain 186
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=368769996 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/0a060ae1-17dc-465b-b9b3-37e0e67725c6 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005
Request Chain 187
  • https://ums.acuityplatform.com/tum?umid=6 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=627776628284
Request Chain 188
  • https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=3e303838-ca53-42df-8019-95c7b3b85253
Request Chain 189
  • https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ6919554241026313953&uid=Q6919554241026313953&ref=%2Fepm HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6919554241026313953
Request Chain 191
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=a1EDqBmGSoC8aBvbqGKORw%3D%3D HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Request Chain 192
  • https://idsync.rlcdn.com/420486.gif?partner_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJDZCNTEwM0E4LTE5ODYtNEE4MC1CQzY4LTFCREJBODYyOEU0NxAAGg0I4LWwjQYSBQjoBxAAQgBKAA HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=d77e6eafd0ef7466a040c54e7bef15b485c1c6b2b5a5735392e63cbea5b1ac5e791426b5417dce21&_=2 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBkNzdlNmVhZmQwZWY3NDY2YTA0MGM1NGU3YmVmMTViNDg1YzFjNmIyYjVhNTczNTM5MmU2M2NiZWE1YjFhYzVlNzkxNDI2YjU0MTdkY2UyMRAAGgwI4bWwjQYSBAgCEABCAEoA HTTP 302
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBkNzdlNmVhZmQwZWY3NDY2YTA0MGM1NGU3YmVmMTViNDg1YzFjNmIyYjVhNTczNTM5MmU2M2NiZWE1YjFhYzVlNzkxNDI2YjU0MTdkY2UyMRAAGgwI4bWwjQYSBAgCEABCAEoA&google_gid=CAESEFNCWrNbJS15QphUXQHTI1U&google_cver=1 HTTP 307
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
  • https://idsync.rlcdn.com/458249.gif?partner_uid=44c7da8c-5e50-4546-92e6-57ef95acf025
Request Chain 193
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=7aed61ac-1ae0-4800-b82d-f5c0a29185e4
Request Chain 194
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NkI1MTAzQTgtMTk4Ni00QTgwLUJDNjgtMUJEQkE4NjI4RTQ3&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 195
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDEgAIYuA8A0YTTZ8reLelQ&google_cver=1
Request Chain 196
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:C65D11E4B81E46FF927733811942FFDC
Request Chain 197
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2848199581176410271&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 198
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=0a060ae1-17dc-465b-b9b3-37e0e67725c6
Request Chain 199
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:473961ac-1ae0-4c00-8c08-33debe008775&gdpr=0&gdpr_consent=
Request Chain 200
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-6UNyri9E2uVLoBNwqFyP_nXB11yT4jM-~A&gdpr=0&gdpr_consent=
Request Chain 202
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA%3D%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7205020425431634120&gdpr=0&gdpr_consent=
Request Chain 203
  • https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=0&gdpr_consent= HTTP 302
  • https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=630fc92bcdff122d&is_secure=true&networkId=17100&version=1&nuid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGdRmaSRjYIgNw_dHNAAAAAAA&expiration=1638755425&nuid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&is_secure=true&gdpr_consent=&gdpr=0
Request Chain 205
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=b6d19fed-556d-11ec-9a2f-0ff9f1b4f0e7&gdpr=0&gdpr_consent=
Request Chain 206
  • https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R1D531_E7995223_281F66E4D&r=https://pmp.mxptint.net/sn.ashx?ak=1 HTTP 302
  • https://pmp.mxptint.net/sn.ashx?ak=1
Request Chain 207
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&gdpr=0&gdpr_consent=
Request Chain 208
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=D4eL2AjXj4oUhN2DDYfHgg3T34wU14-PANUUCyfc
Request Chain 209
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=0&gdpr_consent=&gdpr_pd= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=413&ssp=pubmatic&user_id=csonata_7cbb47e2-9baa-4929-abd4-16d57c47f86d&bsw_param=91fae357-6d96-49d0-85ee-50af585ffd28&expires=10 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 210
  • https://sync.resetdigital.co:10001/csync/pubmatic HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=0000008DA3C2A7C6
Request Chain 216
  • https://token.rubiconproject.com/token?pid=25470 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dTTDg3Q0stMU0tRUlJUg==
Request Chain 217
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/aNhLELx_CQCDPbWMrlc408n5EUdSAgOZEtemQ7w0kco?csrc= HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6939458453206114118
Request Chain 218
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=17d961ac-1ae0-4000-b6db-9706d9b036cb
Request Chain 220
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=Yawa4AAJpMVYSwBG
Request Chain 221
  • https://match.adsrvr.org/track/cmf/rubicon HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=0a060ae1-17dc-465b-b9b3-37e0e67725c6&gdpr=0&gdpr_consent=&expires=30
Request Chain 222
  • https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTNhMmQ4YzVhZGNlM2Y4MDc2MWQxOTFkYzczMDQ4MzFlNWZjMDQ0Mw
Request Chain 223
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEI31rRsvbfY4PRISMi0T5J4&google_cver=1
Request Chain 294
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift HTTP 302
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t
Request Chain 321
  • https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=C65D11E4B81E46FF927733811942FFDC&ex=simpli.fi&status=ok
Request Chain 324
  • https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669023986&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834 HTTP 302
  • https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669023986&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=036e5c75-60d1-4e56-a0cc-560aaee09b40&a.is_yahoo=3&redirect_y=dHM9MTYzODY2OTAyNjA1NC42MDA4MzA6YXBpZD1VUGI2YjRjODk5LTU1NmQtMTFlYy05ZjA5LTBlOThjZTUzMGUzNzpyZXF1ZXN0X2lkPTAzNmU1Yzc1LTYwZDEtNGU1Ni1hMGNjLTU2MGFhZWUwOWI0MA==
Request Chain 328
  • https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Request Chain 333
  • https://ssbsync-us.smartadserver.com/api/sync?callerId=2 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=3167836846926884602&gdpr=0&gdpr_consent=
Request Chain 334
  • https://sync.inmobi.com/TAM?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D HTTP 302
  • https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOeR3usMl58fx9rdUH-t26syo_nrB7dPYFI7TPsw
Request Chain 335
  • https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D HTTP 302
  • https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=96a88f567c2122e&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAGdRmaSRjYVwN4bHoHAAAAAAA&expiration=1638755426&is_secure=true
Request Chain 336
  • https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com HTTP 302
  • https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Request Chain 337
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=13493460417766279847
Request Chain 365
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1 HTTP 302
  • https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=$UID HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=7205020425431634120
Request Chain 366
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2 HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=97 HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=gBgkxrVErPj9wqivTDd2AmVY&source_user_id=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&gdpr=0&gdpr_consent=
Request Chain 367
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3 HTTP 302
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=18694 HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=KWSL87CK-1M-EIIR
Request Chain 368
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4 HTTP 302
  • https://ssum.casalemedia.com/usermatchredir?s=186046&cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DGM7HYz3VFjuymbiqnJLyjuPy%26source_user_id%3D__UID__ HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=Yawa4gBzq4Mi9uUbPgLGCwAA%26020
Request Chain 370
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEv7vNCflkDDFkQXzGixrMs&google_cver=1
Request Chain 372
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1
Request Chain 373
  • https://match.adsrvr.org/track/cmf/casale HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=0a060ae1-17dc-465b-b9b3-37e0e67725c6&expiration=1641261026&gdpr=0&gdpr_consent=
Request Chain 374
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/casale/Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB
Request Chain 375
  • https://d.adroll.com/cm/index/ssp HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
Request Chain 376
  • https://nep.advangelists.com/xp/user-sync?acctid=405&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D195%26external_user_id%3D%7BPARTNER_VISITOR_ID%7D%0A HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-a24e3de0-2028-4cfb-a8c7-c735d7200895
Request Chain 377
  • https://sync.adotmob.com/cookie/indexexchange?r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D13%26external_user_id%3D%7bamob_user_id%7d%26expiration%3D%5bEXPIRATION%5d HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=0707220438307035bba052c2&expiration=[EXPIRATION]
Request Chain 380
  • https://ib.adnxs.com/getuid?&https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an HTTP 302
  • https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=7205020425431634120&pn_id=an
Request Chain 381
  • https://x.bidswitch.net/sync?&ssp=yieldmo HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=yieldmo&ssp_user_id=91fae357-6d96-49d0-85ee-50af585ffd28 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=74&&user_id=171119537&expires=5&ssp=yieldmo HTTP 302
  • https://ads.yieldmo.com/sync?userid=91fae357-6d96-49d0-85ee-50af585ffd28&pn_id=bsw&extinit=0&gdpr=&gdpr_consent=
Request Chain 382
  • https://match.adsrvr.org/track/cmf/generic?&ttd_pid=yieldmo HTTP 302
  • https://ads.yieldmo.com/v000/sync?tdid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
Request Chain 383
  • https://sync.srv.stackadapt.com/sync?&nid=21 HTTP 302
  • https://ads.yieldmo.com/sync?pn_id=stk&userid=xswp1o64ToFOAZv37ofaZSV4zbQ
Request Chain 384
  • https://bh.contextweb.com/bh/rtset?&pid=561118&ev=1&rurl=https://sync-pp.ads.yieldmo.com/sync?userid=%%VGUID%%&pn_id=pp HTTP 302
  • https://sync-pp.ads.yieldmo.com/sync?userid=BtO9pQA2TEDw&ev=1&pn_id=pp&pid=561118
Request Chain 386
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1 HTTP 302
  • https://ce.lijit.com/merge?pid=86&3pid=ie65HF3Q4cl5eT0MwBbs&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
Request Chain 387
  • https://sync.1rx.io/usersync2/sovrn?gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005&rndcb=8433274981 HTTP 302
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=adconductor&bsw_custom_parameter=91fae357-6d96-49d0-85ee-50af585ffd28 HTTP 302
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=adconductor&bsw_custom_parameter=91fae357-6d96-49d0-85ee-50af585ffd28 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=d884b705-ec2e-4c88-bcb6-5002f47980a1&user_group=1&ssp=adconductor&bsw_param=91fae357-6d96-49d0-85ee-50af585ffd28 HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/91fae357-6d96-49d0-85ee-50af585ffd28?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D56%263pid%3DRX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005 HTTP 302
  • https://ce.lijit.com/merge?pid=56&3pid=RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005
Request Chain 388
  • https://aorta.clickagy.com/pixel.gif?ch=185&cm=1877215a80f219747d186ee2&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=84&3pid=c:260803f49fc670d26b7a8c97ae1c7d30
Request Chain 389
  • https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=87&3pid=2c55b0ff-e26e-43d5-94da-2bb3ffc74b65
Request Chain 390
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=0&gdpr_consent= HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Da48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341%26partner_url%3Dhttps%253A%252F%252Fce.lijit.com%252Fmerge%253Fpid%253D16%25263pid%253Da48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341%2526gdpr%253D0%2526gdpr_consent%253D HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Da48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341%26partner_url%3Dhttps%253A%252F%252Fce.lijit.com%252Fmerge%253Fpid%253D16%25263pid%253Da48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341%2526gdpr%253D0%2526gdpr_consent%253D&xl8blockcheck=1 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&partner_url=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D16%263pid%3Da48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&partner_url=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D16%263pid%3Da48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://ce.lijit.com/merge?pid=16&3pid=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&gdpr=0&gdpr_consent=
Request Chain 415
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=KWSL87CK-1M-EIIR&ex=d-rubiconproject.com&status=ok
Request Chain 421
  • https://usermatch.krxd.net/um/v2?partner=google HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_cm&google_nid=krux_digital&google_hm=T2hZc0MtM0k HTTP 302
  • https://beacon.krxd.net/usermatch.gif?google_gid=CAESENlb1Fb-8SqRc2a3MPiWNd4&google_cver=1
Request Chain 422
  • https://cm.g.doubleclick.net/pixel?google_nid=krux_digital&google_cm&google_hm=T2hZc0MtM0k HTTP 302
  • https://beacon.krxd.net/usermatch.gif?google_gid=CAESENlb1Fb-8SqRc2a3MPiWNd4&google_cver=1
Request Chain 423
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=krux&ttd_tpi=1&ttd_puid=OhYsC-3I&gdpr=0 HTTP 302
  • https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
Request Chain 426
  • https://stags.bluekai.com/site/26357?id=OhYsC-3I&redir=https://beacon.krxd.net/usermatch.gif?_kuid%3DOhYsC-3I%26partner%3Dbluekai%26bk_uuid%3D%24_BK_UUID HTTP 302
  • https://beacon.krxd.net/usermatch.gif?_kuid=OhYsC-3I&partner=bluekai&bk_uuid=$_BK_UUID
Request Chain 429
  • https://ib.adnxs.com/getuid?https://beacon.krxd.net/usermatch.gif?adnxs_uid=$UID HTTP 302
  • https://beacon.krxd.net/usermatch.gif?adnxs_uid=7205020425431634120
Request Chain 430
  • https://global.ib-ibi.com/image.sbxx?go=247532&pid=314&xid=OhYsC-3I HTTP 302
  • https://ib.mookie1.com/image.sbxx?go=247532&pid=314&xid=OhYsC-3I
Request Chain 431
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dpubmatic%26partner_uid%3D%23PM_USER_ID HTTP 302
  • https://beacon.krxd.net/usermatch.gif?partner=pubmatic&partner_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
Request Chain 432
  • https://fei.pro-market.net/engine?mimetype=img&du=88&csync=OhYsC-3I HTTP 302
  • https://idsync.rlcdn.com/398696.gif?partner_uid=8886311284053265284
Request Chain 436
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 486
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 503
  • https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_cm HTTP 302
  • https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEDkk0VHuxKqsJbB1tPVEyMg&google_cver=1
Request Chain 504
  • https://cs.lkqd.net/cs?partnerId=59&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dlkqd_dbm%26google_hm%3D%24%24rawlkqduserid%7Cbase64%24%24 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_hm=ZWJiVEdqa1RiYXc
Request Chain 505
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEv7vNCflkDDFkQXzGixrMs&google_cver=1
Request Chain 506
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEv7vNCflkDDFkQXzGixrMs&google_cver=1
Request Chain 512
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 514
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 531
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEOVuQ49DnayG3uN7Bt9fa7g&google_cver=1
Request Chain 532
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIwNTAyMDQyNTQzMTYzNDEyMA%3D%3D
Request Chain 533
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHeILPWdmbEHivdcTPUW7as&google_cver=1
Request Chain 534
  • https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZGM2OGQ3OTMtZWRkNC0yMTFiLWYwMDEtMmFkMzU1NmNmNzEy
Request Chain 535
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
  • https://sync.teads.tv/um?eid=3&uid=CAESENrrdhM8Ke8FKQYeXB2RuHY&google_cver=1
Request Chain 536
  • https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MTkzYzE2NTMtYTJiOS00Mjg2LWExYTktM2E1ZDNmYTdiMmUz
Request Chain 537
  • https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm HTTP 302
  • https://partners.tremorhub.com/sync?UIGL=CAESEEntuj9c_4CQ5cWuUz1Ij9o&google_cver=1
Request Chain 557
  • https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID HTTP 302
  • https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=1fda3fd9-8494-4066-aca3-a092cc97baf1-tuct8a5a066&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Request Chain 558
  • https://gocm.c.appier.net/pubmatic HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=2DE6u0asAquivNV75hqsYQ
Request Chain 559
  • https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={device_id}&gdpr=0&gdpr_consent= HTTP 307
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
Request Chain 560
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=86761b6e-766b-4453-ab67-bab011547e12&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP 302
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
Request Chain 562
  • https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:C65D11E4B81E46FF927733811942FFDC
Request Chain 563
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=1452678799778604270
Request Chain 564
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7205020425431634120
Request Chain 565
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:9219cd41-64a7-41a6-9776-2ff0599ff330&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Request Chain 569
  • https://beacon.walmart.com/etap.gif?tap=gAds&google_gid=CAESEIW9x6bt6Xa-T_isYnRzur0&google_cver=1&google_push=AYg5qPKPBfbWEKkksVtQ5nP7vJJUVX1rd7i4WQ4caY10xzMsAZFC5-5zKS11MfWcWfUNeNSgRNPACXuxXEy8tS6fTuHEDdaQi-Ln HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=QMdU_pC-nF63E9J77j4Pr0&tap=gAds&google_gid=CAESEIW9x6bt6Xa-T_isYnRzur0&google_cver=1&google_push=AYg5qPKPBfbWEKkksVtQ5nP7vJJUVX1rd7i4WQ4caY10xzMsAZFC5-5zKS11MfWcWfUNeNSgRNPACXuxXEy8tS6fTuHEDdaQi-Ln
Request Chain 570
  • https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJzRmqm3TOHfwy-JIZabCzRGWAnjzHftmQtyLBMwaYmoz7d7Bb7_NNfAh8r8k7rk269JK_wlhPj-L_w67A5ntTzMVdsMi_m&google_gid=CAESEAnFGaJgwQMo0CuMBiGoGnI&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDUwMTUwMjMyNDAwMDAyMDYwNDgxMQ%3D%3D&google_push=AYg5qPJzRmqm3TOHfwy-JIZabCzRGWAnjzHftmQtyLBMwaYmoz7d7Bb7_NNfAh8r8k7rk269JK_wlhPj-L_w67A5ntTzMVdsMi_m
Request Chain 571
  • https://rtb.openx.net/sync/dds?google_gid=CAESENH8HCX0wHi5UH0WGbAjQnU&google_cver=1&google_push=AYg5qPLNQxqTjB6aTsB-BsOKB7VBthlyClNvWKEe8MFuEtOTASev2Nkx2eQ3IbIyDf5q1nu19cTTafE7BOQ6KSgYjsCBaabFgnM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLNQxqTjB6aTsB-BsOKB7VBthlyClNvWKEe8MFuEtOTASev2Nkx2eQ3IbIyDf5q1nu19cTTafE7BOQ6KSgYjsCBaabFgnM&google_hm=L1GOZY0lxpEDlTzdTJcDyA==
Request Chain 572
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEICkBJYcvJAKFDsPQnKe2mQ&google_cver=1&google_push=AYg5qPK9JGOG5KEdnA847SVmraP29OgXdbrjd6OiUFg8yu7EIRbzo5WWWJr1EK8bZdd0e5hCEzKJAX2rOmRd-gjNw1BVzJns6No5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=a1EDqBmGSoC8aBvbqGKORw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK9JGOG5KEdnA847SVmraP29OgXdbrjd6OiUFg8yu7EIRbzo5WWWJr1EK8bZdd0e5hCEzKJAX2rOmRd-gjNw1BVzJns6No5
Request Chain 573
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK-
Request Chain 575
  • https://cc.adingo.jp/adx/push/?google_gid=CAESEBk9zoQlfVUJo57fis4DpU4&google_cver=1&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee
Request Chain 580
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMtyV38g_dQPONeLol_kk2o&google_cver=1&google_push=AYg5qPK_GazHLI3C7_Cbpo82-DtI-8O6cOpYAIQp4vVmWzREQSq1LjGbAPBia_RPLLCgswyDXhXafk8_Orc9GEINNloBSqMcpAOf HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AYg5qPK_GazHLI3C7_Cbpo82-DtI-8O6cOpYAIQp4vVmWzREQSq1LjGbAPBia_RPLLCgswyDXhXafk8_Orc9GEINNloBSqMcpAOf&google_hm=2YfLJ43lSx165-4VdnV6Aw
Request Chain 581
  • https://d.agkn.com/pixel/2175/?google_gid=CAESEEj0y1-I3H_JUMoDktMhIq8&google_cver=1&google_push=AYg5qPJtU13ZKVlZvxPxeP4FfP0Kdq7IPWkZX_8f_beZE4LgVJWTflaqOq-P-sqavcBJT6wEV-NtkZkLaTtRfgK8xKlbJbxhELq_ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJtU13ZKVlZvxPxeP4FfP0Kdq7IPWkZX_8f_beZE4LgVJWTflaqOq-P-sqavcBJT6wEV-NtkZkLaTtRfgK8xKlbJbxhELq_&google_hm=Q0FFU0VFajB5MS1JM0hfSlVNb0RrdE1oSXE4
Request Chain 582
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_4530&src.visitorid=CAESEN2ax7ulewDrrxgprRBHmLw&google_cver=1&google_push=AYg5qPLVT75ipNRezwkgLFIBdpIbw4pDTfoOeFHTO0FLbXtb3yP8eUehvct_Vp38QneNne3citdLzsGu4ZWxe7Nq0jOcnYFH8dT7 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AYg5qPLVT75ipNRezwkgLFIBdpIbw4pDTfoOeFHTO0FLbXtb3yP8eUehvct_Vp38QneNne3citdLzsGu4ZWxe7Nq0jOcnYFH8dT7&google_hm=MTA1OTU4NDQwMjU4OTU5MTU3MDk
Request Chain 583
  • https://rtb.openx.net/sync/dds?google_gid=CAESENH8HCX0wHi5UH0WGbAjQnU&google_cver=1&google_push=AYg5qPKXkKoNeUdgwvi6Ydb_nAE1awiv1LPYYv3c5njH5wi8Z4hqBQwLAcp7OKLSKG7-NvR2HphorQMVylljzP7NjnOWC6QpKMPO HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKXkKoNeUdgwvi6Ydb_nAE1awiv1LPYYv3c5njH5wi8Z4hqBQwLAcp7OKLSKG7-NvR2HphorQMVylljzP7NjnOWC6QpKMPO&google_hm=L1GOZY0lxpEDlTzdTJcDyA==
Request Chain 584
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEICkBJYcvJAKFDsPQnKe2mQ&google_cver=1&google_push=AYg5qPJygpDEgr3xdeDKf1Ny76acj_SfTserFocPaOT9c-_bAjyHD84qOjJ4WvWWLmZwWK_O1NLjKh8X3kHArrYFJmwBQ9ERsPcW HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=a1EDqBmGSoC8aBvbqGKORw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJygpDEgr3xdeDKf1Ny76acj_SfTserFocPaOT9c-_bAjyHD84qOjJ4WvWWLmZwWK_O1NLjKh8X3kHArrYFJmwBQ9ERsPcW
Request Chain 585
  • https://token.rubiconproject.com/token?pid=2249&pt=n&google_gid=CAESED61yng7GXz8XgVHNAd97-I&google_cver=1&google_push=AYg5qPKtEdgzQ4TUTveyfzJoHv3KkwjCSz1dTFJvzIzzpX9KwwkNn4zp9nnCvToz7zIax4YZ-18ozpZHC-mSkYC4r9AigIs5kl6a HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTNhMmQ4YzVhZGNlM2Y4MDc2MWQxOTFkYzczMDQ4MzFlNWZjMDQ0Mw
Request Chain 586
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs
Request Chain 606
  • https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669030063&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834 HTTP 302
  • https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669030063&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=fe3bd228-9b1e-4d2f-b608-6781007b4b39&a.is_yahoo=3&redirect_y=dHM9MTYzODY2OTAzMDc0NC4zMTQyMDk6YXBpZD1VUGI2YjRjODk5LTU1NmQtMTFlYy05ZjA5LTBlOThjZTUzMGUzNzptaWdyYXRlZDJ5PSIxIjpyZXF1ZXN0X2lkPWZlM2JkMjI4LTliMWUtNGQyZi1iNjA4LTY3ODEwMDdiNGIzOQ==
Request Chain 630
  • https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined HTTP 302
  • https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined HTTP 307
  • https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Request Chain 633
  • https://x.bidswitch.net/sync?ssp=themediagrid HTTP 302
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=themediagrid HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=1452678799778604270&ssp=themediagrid
Request Chain 637
  • https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID} HTTP 302
  • https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=dec387d0-fcc9-45f6-b6c6-b160082dcd1b HTTP 302
  • https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=dec387d0-fcc9-45f6-b6c6-b160082dcd1b&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
Request Chain 638
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D HTTP 302
  • https://id.rlcdn.com/464246.gif?partner_uid=a5c17b3f-e9e4-49df-ba98-f099a61558aa HTTP 307
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
  • https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=a5c17b3f-e9e4-49df-ba98-f099a61558aa
Request Chain 639
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=7205020425431634120
Request Chain 641
  • https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=2848199581176410271&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 642
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=Yawa4AAJpMVYSwBG
Request Chain 644
  • https://match.adsrvr.org/track/cmf/openx?oxid=f0070459-24a3-7fbf-e5e1-706a9f8e3972&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=0a060ae1-17dc-465b-b9b3-37e0e67725c6&ttd_puid=f0070459-24a3-7fbf-e5e1-706a9f8e3972
Request Chain 646
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHeILPWdmbEHivdcTPUW7as&google_cver=1
Request Chain 647
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=3658&xuid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&dongle=0cfd
Request Chain 648
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESENgfXL-mZhUIOp7yN7sb5Lo&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 649
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTM0OTM0NjA0MTc3NjYyNzk4NDc%3D
Request Chain 650
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=13493460417766279847&dbredirect=true&gdpr=0&consent= HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=13493460417766279847&dbredirect=true&gdpr=0&consent=&cookiesTest=true HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=8528f9ba-61f2-49a6-8781-6631118dab13&_noobservation=1 HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=8528f9ba-61f2-49a6-8781-6631118dab13&_noobservation=1&_expected_cookie=d074e30a4ca1c37d1d2cc2837eff8fd0
Request Chain 651
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/13493460417766279847?gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-tjQ2Tn5E2oRk7KoQD1A14wtKzo1pqOie5W69k18Lag--~A&dongle=0883
Request Chain 652
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=13493460417766279847&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=91fae357-6d96-49d0-85ee-50af585ffd28 HTTP 302
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=91fae357-6d96-49d0-85ee-50af585ffd28 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=70a2554c-2118-4ebb-9f52-225af99a73ea&ssp=triplelift&expires=30&user_group=5&bsw_param=91fae357-6d96-49d0-85ee-50af585ffd28 HTTP 302
  • https://eb2.3lift.com/xuid?mid=2409&xuid=91fae357-6d96-49d0-85ee-50af585ffd28&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 655
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent= HTTP 302
  • https://stags.bluekai.com/site/23178?id=Fie7GdxwzfeqB4UoLqtl&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5IZUWKN2HMR4HO6TGMVYUENCVN5GHC5DM&gdpr=0 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5IZUWKN2HMR4HO6TGMVYUENCVN5GHC5DM HTTP 302
  • https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=Fie7GdxwzfeqB4UoLqtl
Request Chain 656
  • https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=4771&xuid=2848199581176410271&dongle=d407
Request Chain 657
  • https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID} HTTP 302
  • https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=dec387d0-fcc9-45f6-b6c6-b160082dcd1b HTTP 302
  • https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=dec387d0-fcc9-45f6-b6c6-b160082dcd1b&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
Request Chain 658
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D HTTP 302
  • https://id.rlcdn.com/464246.gif?partner_uid=a5c17b3f-e9e4-49df-ba98-f099a61558aa HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBJdLCeWp6pQsclVti242-s&google_cver=1
Request Chain 659
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=7205020425431634120
Request Chain 661
  • https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=2848199581176410271&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 662
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=Yawa4AAJpMVYSwBG
Request Chain 664
  • https://match.adsrvr.org/track/cmf/openx?oxid=f0070459-24a3-7fbf-e5e1-706a9f8e3972&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=0a060ae1-17dc-465b-b9b3-37e0e67725c6&ttd_puid=f0070459-24a3-7fbf-e5e1-706a9f8e3972
Request Chain 666
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHeILPWdmbEHivdcTPUW7as&google_cver=1
Request Chain 667
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=3658&xuid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&dongle=0cfd
Request Chain 668
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESENgfXL-mZhUIOp7yN7sb5Lo&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 669
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTM0OTM0NjA0MTc3NjYyNzk4NDc%3D
Request Chain 670
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=13493460417766279847&dbredirect=true&gdpr=0&consent= HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=13493460417766279847&dbredirect=true&gdpr=0&consent=&cookiesTest=true HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=8528f9ba-61f2-49a6-8781-6631118dab13&_noobservation=1 HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=8528f9ba-61f2-49a6-8781-6631118dab13&_noobservation=1&_expected_cookie=2405364280928fa2c2ec9703a3a38c05
Request Chain 671
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/13493460417766279847?gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-tjQ2Tn5E2oRk7KoQD1A14wtKzo1pqOie5W69k18Lag--~A&dongle=0883
Request Chain 672
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=13493460417766279847&gdpr=0&gdpr_consent= HTTP 302
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=triplelift HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=2810316550256815995&expires=30&ssp=triplelift HTTP 302
  • https://eb2.3lift.com/xuid?mid=2409&xuid=91fae357-6d96-49d0-85ee-50af585ffd28&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 675
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent= HTTP 302
  • https://stags.bluekai.com/site/23178?id=MOcTeHahRHcu11lsoSet&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5JVHWGVDFJBQWQUSIMN2TCMLMONXVGZLU&gdpr=0 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5JVHWGVDFJBQWQUSIMN2TCMLMONXVGZLU HTTP 302
  • https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=MOcTeHahRHcu11lsoSet
Request Chain 676
  • https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=4771&xuid=2848199581176410271&dongle=d407
Request Chain 682
  • https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=7205020425431634120
Request Chain 683
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Yawa4AAJpMVYSwBG
Request Chain 685
  • https://p.rfihub.com/cm?in=1&pub=2079 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=1783777309855063265
Request Chain 686
  • https://match.deepintent.com/usersync/113 HTTP 303
  • https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_fe5a87ec034349adb9d1d
Request Chain 687
  • https://beacon.lynx.cognitivlabs.com/ix.gif HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=51be4f23-aef6-49ff-aea7-33d2bf749ef8&expiration=1670205031
Request Chain 688
  • https://dpm.demdex.net/ibs:dpid=23728&dpuuid=Yawa4gBzq4Mi9uUbPgLGCwAA%26020?gdpr_consent=&us_privacy=&gdpr= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Yawa4gBzq4Mi9uUbPgLGCwAA%26020
Request Chain 694
  • https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Drkt%26refUrl%3D%26vid%3D86690314142816706317397284000V10%26ovsid%3D%7Buserid%7D HTTP 302
  • https://contextual.media.net/cksync.html?cs=8&vsid=2816706317397284000V10&type=rkt&refUrl=&vid=86690314142816706317397284000V10&ovsid=970314627676561193
Request Chain 695
  • https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dcon%26refUrl%3D%26vid%3D86690314142816706317397284000V10%26ovsid%3D%24UID HTTP 302
  • https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=60d94f392c98122e&is_secure=true&version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dcon%26refUrl%3D%26vid%3D86690314142816706317397284000V10%26ovsid%3D%24UID HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=con&refUrl=&vid=86690314142816706317397284000V10&ovsid=AAAGdipzeeBVhAMrebIgAAAAAAA&expiration=1638755431&is_secure=true
Request Chain 696
  • https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dmma%26refUrl%3D%26vid%3D86690314142816706317397284000V10%26ovsid%3D%5BMM_UUID%5D HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=mma&refUrl=&vid=86690314142816706317397284000V10&ovsid=17d961ac-1ae0-4000-b6db-9706d9b036cb
Request Chain 697
  • https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MjgxNjcwNjMxNzM5NzI4NDAwMFYxMA%3D%3D&google_sc=1 HTTP 302
  • https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEClov87a3B7yE4YtjXppqj8&google_cver=1
Request Chain 698
  • https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Ddxu%26refUrl%3D%26vid%3D86690314142816706317397284000V10%26ovsid%3D_wfivefivec_ HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=dxu&refUrl=&vid=86690314142816706317397284000V10&ovsid=DyLVqr8t1MTGFy5
Request Chain 699
  • https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40 HTTP 302
  • https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=74618072-e52e-4fe0-a124-a6ec1943183f
Request Chain 700
  • https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1 HTTP 302
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dmedianet%26bsw_param%3D91fae357-6d96-49d0-85ee-50af585ffd28%26gdpr%3D0%26consent%3D%26gdpr_pd%3D1%26expires%3D7 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=1de77307d007487fbf82d47b61a3cc6d&ssp=medianet&bsw_param=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=0&consent=&gdpr_pd=1&expires=7 HTTP 302
  • https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=0&gdpr_consent=&gdpr_pd=1
Request Chain 701
  • https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dzem%26refUrl%3D%26vid%3D86690314142816706317397284000V10%26ovsid%3D__ZUID__ HTTP 302
  • https://stags.bluekai.com/site/23178?id=p3can97Ty9ZsKgjlEt5c&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPLQGNRWC3RZG5KHSOK2ONFWO2TMIV2DKYZGOJSWMVLSNQ6SM5DZOBST26TFNUTHM2LEHU4DMNRZGAZTCNBRGQZDQMJWG4YDMMZRG4ZTSNZSHA2DAMBQKYYTAJTWONUWIPJSHAYTMNZQGYZTCNZTHE3TEOBUGAYDAVRRGA HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPLQGNRWC3RZG5KHSOK2ONFWO2TMIV2DKYZGOJSWMVLSNQ6SM5DZOBST26TFNUTHM2LEHU4DMNRZGAZTCNBRGQZDQMJWG4YDMMZRG4ZTSNZSHA2DAMBQKYYTAJTWONUWIPJSHAYTMNZQGYZTCNZTHE3TEOBUGAYDAVRRGA HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&ovsid=p3can97Ty9ZsKgjlEt5c&refUrl=&type=zem&vid=86690314142816706317397284000V10&vsid=2816706317397284000V10
Request Chain 702
  • https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=2816706317397284000V10 HTTP 302
  • https://contextual.media.net/cksync.php?type=mf&ovsid=2c55b0ff-e26e-43d5-94da-2bb3ffc74b65&cs=1
Request Chain 704
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1 HTTP 302
  • https://cs.media.net/cksync?cs=1&type=ttd&ovsid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
Request Chain 705
  • https://ad.turn.com/r/cs?pid=59&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Damb%26refUrl%3D%26vid%3D86690314142816706317397284000V10%26ovsid%3D%23USER_ID%23 HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=amb&refUrl=&vid=86690314142816706317397284000V10&ovsid=2848199581176410271
Request Chain 708
  • https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MjgxNjcwNjMxNzM5NzI4NDAwMFYxMA%3D%3D&google_sc=1 HTTP 302
  • https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEClov87a3B7yE4YtjXppqj8&google_cver=1
Request Chain 709
  • https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Drkt%26refUrl%3D%26vid%3D86690314412816706317397284000V10%26ovsid%3D%7Buserid%7D HTTP 302
  • https://contextual.media.net/cksync.html?cs=8&vsid=2816706317397284000V10&type=rkt&refUrl=&vid=86690314412816706317397284000V10&ovsid=2810316550256815995
Request Chain 710
  • https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40 HTTP 302
  • https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=36f7a3cb-90f4-4a98-9dde-87e0b14996bf
Request Chain 711
  • https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1 HTTP 302
  • https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dmedianet HTTP 307
  • https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dmedianet HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=59&user_id=4a315f5b-792e-42e5-94f2-3f23d680431b&ssp=medianet HTTP 302
  • https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 712
  • https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=2816706317397284000V10 HTTP 302
  • https://contextual.media.net/cksync.php?type=mf&ovsid=2c55b0ff-e26e-43d5-94da-2bb3ffc74b65&cs=1
Request Chain 714
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1 HTTP 302
  • https://cs.media.net/cksync?cs=1&type=ttd&ovsid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
Request Chain 715
  • https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dcon%26refUrl%3D%26vid%3D86690314412816706317397284000V10%26ovsid%3D%24UID HTTP 302
  • https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=5b6ed1ad7c56122e&is_secure=true&version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dcon%26refUrl%3D%26vid%3D86690314412816706317397284000V10%26ovsid%3D%24UID HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=con&refUrl=&vid=86690314412816706317397284000V10&ovsid=AAAGdXSNZEPasQMAgdc2AAAAAAA&expiration=1638755431&is_secure=true
Request Chain 716
  • https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dmma%26refUrl%3D%26vid%3D86690314412816706317397284000V10%26ovsid%3D%5BMM_UUID%5D HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=mma&refUrl=&vid=86690314412816706317397284000V10&ovsid=17d961ac-1ae0-4000-b6db-9706d9b036cb
Request Chain 717
  • https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Ddxu%26refUrl%3D%26vid%3D86690314412816706317397284000V10%26ovsid%3D_wfivefivec_ HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=dxu&refUrl=&vid=86690314412816706317397284000V10&ovsid=DyLVqr8t1MTGFy5
Request Chain 718
  • https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dzem%26refUrl%3D%26vid%3D86690314412816706317397284000V10%26ovsid%3D__ZUID__ HTTP 302
  • https://stags.bluekai.com/site/23178?id=MOcTeHahRHcu11lsoSet&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPKNJ5RVIZKIMFUFESDDOUYTC3DTN5JWK5BGOJSWMVLSNQ6SM5DZOBST26TFNUTHM2LEHU4DMNRZGAZTCNBUGEZDQMJWG4YDMMZRG4ZTSNZSHA2DAMBQKYYTAJTWONUWIPJSHAYTMNZQGYZTCNZTHE3TEOBUGAYDAVRRGA HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPKNJ5RVIZKIMFUFESDDOUYTC3DTN5JWK5BGOJSWMVLSNQ6SM5DZOBST26TFNUTHM2LEHU4DMNRZGAZTCNBUGEZDQMJWG4YDMMZRG4ZTSNZSHA2DAMBQKYYTAJTWONUWIPJSHAYTMNZQGYZTCNZTHE3TEOBUGAYDAVRRGA HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&ovsid=MOcTeHahRHcu11lsoSet&refUrl=&type=zem&vid=86690314412816706317397284000V10&vsid=2816706317397284000V10
Request Chain 719
  • https://ad.turn.com/r/cs?pid=59&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Damb%26refUrl%3D%26vid%3D86690314412816706317397284000V10%26ovsid%3D%23USER_ID%23 HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=amb&refUrl=&vid=86690314412816706317397284000V10&ovsid=2848199581176410271
Request Chain 722
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=17d961ac-1ae0-4000-b6db-9706d9b036cb
Request Chain 723
  • https://ad.turn.com/r/cs?pid=21 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=2848199581176410271
Request Chain 724
  • https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1 HTTP 302
  • https://casale-match.dotomi.com/match/bounce/current?DotomiTest=5ca215a44390122e&is_secure=true&networkId=19998&version=1 HTTP 302
  • https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGdc-Aay49lQMcVRAGAAAAAAA&expiration=1638755431&is_secure=true
Request Chain 725
  • https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=C65D11E4B81E46FF927733811942FFDC
Request Chain 726
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1
Request Chain 727
  • https://pixel.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=1_cKONCnDmrM9Fxj1fdGYtWjXmzMpw5v2KUf2M71
Request Chain 728
  • https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_dsp_id=131&cm_user_id=Yawa4gBzq4Mi9uUbPgLGCwAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662301221777215
Request Chain 729
  • https://match.deepintent.com/usersync/113 HTTP 303
  • https://x.bidswitch.net/sync?expires=720&dsp_id=422&user_id=di_fe5a87ec034349adb9d1d HTTP 302
  • https://pixel.advertising.com/ups/55859/sync?uid=91fae357-6d96-49d0-85ee-50af585ffd28&_origin=1&gdpr=&gdpr_consent= HTTP 302
  • https://ups.analytics.yahoo.com/ups/55859/sync?uid=91fae357-6d96-49d0-85ee-50af585ffd28&_origin=1&gdpr=&gdpr_consent=&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
Request Chain 731
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy= HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Request Chain 732
  • https://x.bidswitch.net/sync?ssp=the33across&us_privacy= HTTP 302
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dthe33across%26bsw_param%3D91fae357-6d96-49d0-85ee-50af585ffd28%26gdpr%3D%26consent%3D%26gdpr_pd%3D%26expires%3D7 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=1de77307d007487fbf82d47b61a3cc6d&ssp=the33across&bsw_param=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=&consent=&gdpr_pd=&expires=7 HTTP 302
  • https://ssc-cms.33across.com/ps/?gdpr_consent=&ri=10&ru=https%3A%2F%2Fcms-xch.33across.com%2Fmatch%3Fgdpr_58%3D%24gdpr_58%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26bidder_id%3D10%26external_user_id%3D91fae357-6d96-49d0-85ee-50af585ffd28 HTTP 302
  • https://cms-xch.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=91fae357-6d96-49d0-85ee-50af585ffd28 HTTP 301
  • https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=91fae357-6d96-49d0-85ee-50af585ffd28
Request Chain 733
  • https://ssc-cms.33across.com/ps/?us_privacy=&ts=1638669031325.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fcms-xch-chicago.33across.com%252Fmatch%253Fliv%253Dg%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D1%2526external_user_id%253D%255BMM_UUID%255D HTTP 302
  • https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D HTTP 302
  • https://cms-xch-chicago.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=17d961ac-1ae0-4000-b6db-9706d9b036cb
Request Chain 734
  • https://ups.analytics.yahoo.com/ups/58350/sync?redir=true HTTP 302
  • https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-7h9tRulE2uFxsB6QY0gDLbcPV3aP5mnm~A HTTP 302
  • https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-7h9tRulE2uFxsB6QY0gDLbcPV3aP5mnm%7EA&ts=1638669031&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 735
  • https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy= HTTP 302
  • https://33across-match.dotomi.com/match/bounce/current?DotomiTest=28a291b4097e122f&is_secure=true&networkId=78390&version=1&us_privacy= HTTP 302
  • https://ssc-cms.33across.com/ps?xi=64&xu=AAAGdRmaSRjZhgMS-K6GAAAAAAA&expiration=1638755431&is_secure=true&us_privacy= HTTP 302
  • https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGdRmaSRjZhgMS-K6GAAAAAAA&ts=1638669031&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 736
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy= HTTP 302
  • https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1641261031%26external_user_id%3D0a060ae1-17dc-465b-b9b3-37e0e67725c6 HTTP 302
  • https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1641261031&external_user_id=0a060ae1-17dc-465b-b9b3-37e0e67725c6
Request Chain 739
  • https://p.rfihub.com/cm?pub=36496&in=1 HTTP 302
  • https://dmx.districtm.io/s/10056/2810316550256815995
Request Chain 740
  • https://match.prod.bidr.io/cookie-sync/districtm HTTP 303
  • https://dmx.districtm.io/s/10025/AADRPU7DWDYAAC1tRSs1sA
Request Chain 741
  • https://pixel.advertising.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37 HTTP 302
  • https://dmx.districtm.io/s/10051/y-v6iA94FE2uGgLH5Mv50OdzL4RqBs33ts~A~UPb6b4c899-556d-11ec-9f09-0e98ce530e37
Request Chain 742
  • https://us.creativecdn.com/cm-notify?pi=districtm HTTP 302
  • https://dmx.districtm.io/s/10027/ie65HF3Q4cl5eT0MwBbs?pi=districtm
Request Chain 743
  • https://sync.srv.stackadapt.com/sync?nid=132 HTTP 302
  • https://dmx.districtm.io/s/10026/xswp1o64ToFOAZv37ofaZSV4zbQ
Request Chain 744
  • https://ups.analytics.yahoo.com/ups/58377/occ?gdpr=&gdpr_consent= HTTP 302
  • https://dmx.districtm.io/s/10057/y-c_DrfvRE2uGiNxzrb1OfqwI_L4QZUNNM4Z58Uzk-~A
Request Chain 745
  • https://sync-tm.everesttech.net/upi/pid/1477?redir=https%3A//dmx.us-east-34.districtm.io/s/10016/$%7BTM_USER_ID%7D HTTP 302
  • https://dmx.us-east-34.districtm.io/s/10016/Yawa4AAJpMVYSwBG
Request Chain 746
  • https://match.sharethrough.com/1PQ8qgv7/v1/ HTTP 302
  • https://dmx.districtm.io/s/10059/8169d5dd-0a59-4fc8-aa31-a786caffc331
Request Chain 747
  • https://districtm-match.dotomi.com/match/bounce/current?version=1&networkId=33921&nuid=21qWKCsXGVpnyh5n8TvtcHVALUl&rurl=//dmx.us-east-34.districtm.io/s/10007/ HTTP 302
  • https://districtm-match.dotomi.com/match/bounce/current?DotomiTest=230a0eb50584122d&is_secure=true&version=1&networkId=33921&nuid=21qWKCsXGVpnyh5n8TvtcHVALUl&rurl=%2F%2Fdmx.us-east-34.districtm.io%2Fs%2F10007%2F HTTP 302
  • https://dmx.us-east-34.districtm.io/s/10007/AAAGdipzeeBVkgN8v6psAAAAAAA&expiration=1638755431&nuid=21qWKCsXGVpnyh5n8TvtcHVALUl&is_secure=true
Request Chain 748
  • https://match.prod.bidr.io/cookie-sync/districtm HTTP 303
  • https://dmx.districtm.io/s/10025/AADRPU7DWDYAAC1tRSs1sA
Request Chain 753
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy= HTTP 302
  • https://ssc-cms.33across.com/ps/?xi=1&xu=KWSL87CK-1M-EIIR HTTP 302
  • https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KWSL87CK-1M-EIIR&ts=1638669031&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 765
  • https://pixel.onaudience.com/?partner=214&mapped=6B5103A8-1986-4A80-BC68-1BDBA8628E47 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1 HTTP 302
  • https://pixel.onaudience.com/?partner=147&mapped=0a060ae1-17dc-465b-b9b3-37e0e67725c6&icm HTTP 302
  • https://spl.zeotap.com/?zdid=1332&zcluid=8cad49ac1da69e7c HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=e7286cc6-fc38-4f65-7e5b-9bc3e8d39797&reqId=0ccdd910-7f45-43dc-741a-3e1da1e93124&zcluid=8cad49ac1da69e7c&zdid=1332 HTTP 302
  • https://mwzeom.zeotap.com/mw?google_gid=CAESECecXKRLtMkbt60dDB3SYRA&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=e7286cc6-fc38-4f65-7e5b-9bc3e8d39797&reqId=0ccdd910-7f45-43dc-741a-3e1da1e93124&zcluid=8cad49ac1da69e7c&zdid=1332
Request Chain 766
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr= HTTP 302
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=&fbounce=1
Request Chain 768
  • https://io.narrative.io/?companyId=673&id=pubmatic_id:6B5103A8-1986-4A80-BC68-1BDBA8628E47 HTTP 302
  • https://io.narrative.io/?io.narrative.guid.v2=bc8d8430-556d-11ec-9141-120bff9cc4e7&companyId=673&id=pubmatic_id:6B5103A8-1986-4A80-BC68-1BDBA8628E47
Request Chain 769
  • https://pixel.onaudience.com/?partner=214&mapped=6B5103A8-1986-4A80-BC68-1BDBA8628E47 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1 HTTP 302
  • https://pixel.onaudience.com/?partner=147&mapped=0a060ae1-17dc-465b-b9b3-37e0e67725c6&icm HTTP 302
  • https://spl.zeotap.com/?zdid=1332&zcluid=8cad49ac1da69e7c HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=737d0c9c-3993-490c-40e2-583e4e214dbf&reqId=8f812b1e-6374-446a-52fd-ccc2503400f1&zcluid=8cad49ac1da69e7c&zdid=1332 HTTP 302
  • https://mwzeom.zeotap.com/mw?google_gid=CAESECecXKRLtMkbt60dDB3SYRA&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=737d0c9c-3993-490c-40e2-583e4e214dbf&reqId=8f812b1e-6374-446a-52fd-ccc2503400f1&zcluid=8cad49ac1da69e7c&zdid=1332
Request Chain 770
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr= HTTP 302
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=&fbounce=1
Request Chain 772
  • https://io.narrative.io/?companyId=673&id=pubmatic_id:6B5103A8-1986-4A80-BC68-1BDBA8628E47 HTTP 302
  • https://io.narrative.io/?io.narrative.guid.v2=bc8d5d20-556d-11ec-96af-0e9f37bd45a9&companyId=673&id=pubmatic_id:6B5103A8-1986-4A80-BC68-1BDBA8628E47
Request Chain 786
  • https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669036488&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834 HTTP 302
  • https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669036488&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=cf9bcd12-7007-4d07-b405-26d0ac67417a&a.is_yahoo=3&redirect_y=dHM9MTYzODY2OTAzNzA4Ni4xMzIwODA6YXBpZD1VUGI2YjRjODk5LTU1NmQtMTFlYy05ZjA5LTBlOThjZTUzMGUzNzptaWdyYXRlZDJ5PSIxIjpyZXF1ZXN0X2lkPWNmOWJjZDEyLTcwMDctNGQwNy1iNDA1LTI2ZDBhYzY3NDE3YQ==

832 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/ 		71 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5b72db51b7bf9f92e37d4f4ff0607c8d582dfa180eb82057d81e75f4d012303
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-type
text/html; charset=UTF-8
content-security-policy
upgrade-insecure-requests;
x-frame-options
SAMEORIGIN
cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
expires
0
last-modified
Tue, 16 Nov 2021 14:27:18 GMT
vary
Accept-Encoding,User-Agent
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6b899f8e69457133-YUL
content-encoding
br
css
fonts.googleapis.com/ 		13 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ff420b26b8a33e1bcae39c4d165c2cc259681bbb7b32565dbd7644c1d84cbfa8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sun, 05 Dec 2021 01:50:22 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sun, 05 Dec 2021 01:50:22 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 05 Dec 2021 01:50:22 GMT
bootstrap.min.css
www.bleepstatic.com/js/redesign/bootstrap/css/ 		119 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/bootstrap/css/bootstrap.min.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4837
last-modified
Wed, 13 Feb 2019 14:22:49 GMT
server
cloudflare
etag
W/"624975547"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f1KK7i0LY%2BdDL2W2ZQKYxUG1%2Fvm3F1tas4lzgZhFk68sVBaRZyhyfEGEsT4SWcsFjvrXCQIhs2oS%2F6bXYH7SNI%2FksN6dhUHUX4oCvDHwYK6L4l%2Bd6q%2B9dsAEsYMvhMXpt3%2FN2Lk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
6b899f908bf97133-YUL
expires
Fri, 23 Jul 2021 03:04:43 GMT
main.css
www.bleepstatic.com/css/redesign/ 		52 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b37f3d8aa5e1f298bf71477c945f576745020ce44f048ec67e19a93cd285372

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4836
cf-polished
origSize=62676
last-modified
Tue, 27 Apr 2021 20:09:53 GMT
server
cloudflare
etag
W/"2761713618"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MxQEthHm9gNdFvB1jCbcLsNKzDsVXAlWxz%2B1frjEfub%2FF01dlv9BEobtZjyxTR1nTRdhBGNPLw0kLGbjZhWPZIeWqYmcwqNoBo71gr5xW6Vx7LkjQEsKC3mqVD0guscloYoRTG4%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Fri, 23 Jul 2021 03:04:42 GMT
cache-control
max-age=3024000
cf-ray
6b899f908bfa7133-YUL
cf-bgj
minify
home.css
www.bleepstatic.com/css/redesign/ 		12 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/css/redesign/home.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca22345f969dd8077c21281572a34d4a51bc6a5ad9d764bd1338b2c12a68c3e3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1843
cf-polished
origSize=15024
last-modified
Sat, 21 Nov 2020 17:53:40 GMT
server
cloudflare
etag
W/"2807382579"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xw2f%2F1qLnQsOH%2FvEaitN3ubyRLeQjG5oZv1rLRriqp52MtnPDYjSB8KKb47n%2FA67oRll%2B%2BTLIdx9%2F5RinkuLU9vXBY8txFQoy7%2FYAaeD6lZCkyDJb1oqGB048bJN1t%2BntaruR5I%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Fri, 28 May 2021 10:23:55 GMT
cache-control
max-age=3024000
cf-ray
6b899f908bfb7133-YUL
cf-bgj
minify
news.css
www.bleepstatic.com/css/redesign/ 		27 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/css/redesign/news.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4901b094a91ea6d5aba73774bb9803fdca22599cfca597ef81249225b5ed01b4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
566
cf-polished
origSize=33102
last-modified
Tue, 24 Aug 2021 22:50:05 GMT
server
cloudflare
etag
W/"57477024"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ox%2BNPl0%2BprNKglcW26F5J7FEEv7ctVmXk%2FeHNYn0smNyVDcVg6xw2%2BJDm1dqHRvvL%2BQfEEiIGrv9KpsHpKszrZzMrv94Czo5wcssj%2BiNzXjj5bs%2FqvDvLdRUOw5tgM6PLF%2Fnnq0%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Tue, 28 Sep 2021 22:50:37 GMT
cache-control
max-age=3024000
cf-ray
6b899f908bfc7133-YUL
cf-bgj
minify
jquery-3.5.1.min.js
www.bleepstatic.com/js/redesign/ 		87 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/jquery-3.5.1.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4388
last-modified
Mon, 04 May 2020 23:02:39 GMT
server
cloudflare
etag
W/"1177690299"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aM9ZAPo%2FxFQoTz2Ezg2479f8KCYAFFYBA3KEw%2Bz7pL%2BFx3Bkl4k4splU4Nvs52UzMzGH4%2FNva4v0G6YKTsULWdVt0s0roIdJqXanTJBlkC74h8N2yYZdo7kBKFzrYhobonfwn6k%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
6b899f908bfd7133-YUL
expires
Fri, 19 Nov 2021 13:03:27 GMT
jquery-migrate-1.4.1.min.js
www.bleepstatic.com/js/redesign/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/jquery-migrate-1.4.1.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4388
last-modified
Fri, 20 May 2016 01:26:30 GMT
server
cloudflare
etag
W/"2177127834"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DY03A6TugpIFcSZe7HRqlL%2FsM0YzHALntNMDhdHpAOdk4%2BrAu3RldSHbDLJC%2BQF1uMwYPfiUa6VxM%2F1GBXEOsBaZuOctobu7zIROnRskUer3skw%2FfhOZCuqEA6g%2Bzxu94SXms5Q%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
6b899f908bfe7133-YUL
expires
Fri, 28 May 2021 10:23:56 GMT
news.js
www.bleepstatic.com/js/redesign/ 		183 B
512 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/news.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
566
cf-polished
origSize=247
last-modified
Wed, 16 Dec 2015 15:41:46 GMT
server
cloudflare
etag
W/"4218930423"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=55BAOupTvuCKamHpOfe0gcD%2B%2B1Nz3w3dD4iPicGOyvuMHmH%2Bqd95EehjTirYY3rw85nGnz%2B%2F9RiAIqZJb2gBPEsiP5GJCeJfxFg46wYhIeF5w%2FB80RyjPeNsl2Rk6G2zkm%2BCkJc%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
expires
Fri, 28 May 2021 10:23:56 GMT
cache-control
max-age=3024000
cf-ray
6b899f912ce37133-YUL
cf-bgj
minify
widgets.js
platform.twitter.com/ 		96 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8096) /
Resource Hash
97719c71e44494e537beba8d51c6bb268a34dcd867fdefc431229225ca734b46

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:23 GMT
Content-Encoding
gzip
Last-Modified
Thu, 02 Dec 2021 21:35:27 GMT
Server
ECS (cha/8096)
Age
333
Etag
"50ec7e701ed018305368886c39cac301+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
29126
cls.css
a.pub.network/core/pubfig/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/pubfig/cls.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d510e16e6e569e573980fd67a55221795d539fd56688ecaca8d284255e86ee6

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=kjwd8A==, md5=KtQsmezne0blpCqFIHo3UA==
date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3366
x-guploader-uploadid
ADPycdsGG-kwLk8pflxktB4g2ZiGP3PyE7F7zSFdjNQ8s7wtkp6PteyiJLUZI4QyxU7CCRKmELhzODpx-j_fSrDIgc-USHJyLw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
text/css
last-modified
Tue, 11 May 2021 20:31:48 GMT
server
cloudflare
etag
W/"2ad42c99ece77b46e5a42a85207a3750"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FQ5%2BNVX4B3qpO7%2BiuyWAl4lpkTdPWiRhd8HZ1oSd%2BAc7UjCgpOz6bHbfNK0UtjedFkAcNW5IRptZ4JEOhYW5KRAb8DKsusfE%2FqrIYvy1aAdFfK0aEeUpTAq4j0M0ATl9FlVZHTN3Vx21Rvs%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1620765108454625
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=3600
x-goog-stored-content-length
1752
cf-ray
6b899f908ced7138-YUL
expires
Sun, 05 Dec 2021 01:54:16 GMT
pubfig.min.js
a.pub.network/bleepingcomputer-com/ 		118 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1da31085512b343f2de6f64bcdbeeb3bc50a54859a5fb7878c434fde47510405

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=jWjThw==, md5=/1OP2Hd7VLh8XOS8svIYHg==
date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
363370
x-guploader-uploadid
ADPycdssHcjj7qPZ9IeKXkXMpo_SxqZ3toJyQ8bpW6zirkN6SJ-pDiR5iMakGtCsuqn7yVjssp16CESBmyhwWRE3pic6tXUVgg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Wed, 24 Nov 2021 16:27:10 GMT
server
cloudflare
etag
W/"ff538fd8777b54b87c5ce4bcb2f2181e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SWeBhaq%2BcDHOpo1I8n3zY9wYnnTz8QEOcinuO8DHhW0zfFgmEuSlyVVcoIt3DRRVZyH8Pvx1yQY8mqazHaJ%2FTYMe7OzTMwo53czgq0g16u1OXvnV7dpPtiYzCkMy0rRbbu1lkXzwApgpBCA%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1637771230054431
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=1800
x-goog-stored-content-length
120881
cf-ray
6b899f912dc87138-YUL
expires
Tue, 30 Nov 2021 20:55:12 GMT
js
www.googletagmanager.com/gtag/ 		90 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-91740-1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::2008 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e50c2a67d8078f234e1e442f2de7c36ec934fb16cafe6426b871a39c6e4e8e25
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36143
x-xss-protection
0
last-modified
Sun, 05 Dec 2021 00:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 05 Dec 2021 01:50:22 GMT
logo.png
www.bleepstatic.com/images/site/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/logo.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1062995
cf-polished
origFmt=png, origSize=1882
content-disposition
inline; filename="logo.webp"
content-length
1152
last-modified
Sat, 04 Mar 2017 04:12:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5DxnvtMNzsnnNnf6FpUYdrRmWb9ZYb1OdFvDgoggTFpg6usU4fMnKXsjB19NmUAY95%2Fi%2Bbm%2Bd5g2rUNCEjb1QZXTpPmbtCZCzFvoWfKHpxo%2FT3pDPdC682GH4UyOicAJoZOsZKU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Wed, 22 Dec 2021 18:33:47 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f912cea7133-YUL
cf-bgj
imgq:85,h2pri
brandjs.js
www.gstatic.com/prose/
Redirect Chain
  • https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
  • https://www.gstatic.com/prose/brandjs.js
14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/prose/brandjs.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6395e6f9f6fbcd953f0ffa40615094c565d86c265fb5028e64dd2dc872b5ce69
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 02:21:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
84558
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5807
x-xss-protection
0
last-modified
Tue, 06 Apr 2021 15:14:29 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/javascript
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Sun, 05 Dec 2021 02:21:05 GMT

Redirect headers

date
Sun, 05 Dec 2021 01:48:42 GMT
x-content-type-options
nosniff
server
sffe
age
100
content-type
text/html; charset=UTF-8
location
https://www.gstatic.com/prose/brandjs.js
cache-control
public, max-age=1800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
237
x-xss-protection
0
expires
Sun, 05 Dec 2021 02:18:42 GMT
Emotet.jpg
www.bleepstatic.com/content/hl-images/2020/07/28/ 		46 KB
46 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/content/hl-images/2020/07/28/Emotet.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8784352d3d9a95ec8bff3ede98a66f89f629d7fc68c9723897d6e27dbd47d06b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
362546
cf-polished
qual=85, origFmt=jpeg, origSize=85982
content-disposition
inline; filename="Emotet.webp"
content-length
46640
last-modified
Tue, 28 Jul 2020 18:39:40 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VEg%2Fx9uNC0preCv88zSFSf3a87MPnPn%2FhvfrEjLiccleOBZp9fDhMaopmIuakyms1A%2BtdovTWq9RxwypAUT0auanyqaAtjbSQXkBMNtC5Is%2FCLmAhSpUtrfHofx06by7t3V2dQU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Thu, 30 Dec 2021 21:07:56 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f912cec7133-YUL
cf-bgj
imgq:85,h2pri
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		143 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
dc7009c97e4029c77cdb58ff5508dd8f504099c9d6c41375ceb5ba89f75d437f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
51293
x-xss-protection
0
server
cafe
etag
15116251599198354285
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Sun, 05 Dec 2021 01:50:23 GMT
Bleeping_Computer_CIR_Nov_2021-opt.gif
www.bleepstatic.com/images/comp/flashpoint/ 		367 KB
368 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/comp/flashpoint/Bleeping_Computer_CIR_Nov_2021-opt.gif
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0cdce68d55ff0acea805c6354fafdddf6cafc1b111a9ece1f891acf3e5a5dc6d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4837
cf-polished
status=not_needed
content-length
375851
last-modified
Tue, 02 Nov 2021 18:47:09 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dRFRVPhDW2Shv60UgylNyqBdLpu8rJJ8KNOumM51qscaIRuzFkBaKBFXZ7JRJR7DHH2%2FETxheq7JxZq5lfauorAWOjd3cj%2FJnGa1doj4n9DBpSRpTcy%2FXNizSVW0XjEKv%2FxOrVw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
access-control-allow-origin
*
expires
Thu, 02 Dec 2021 18:48:58 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f912cee7133-YUL
cf-bgj
imgq:85,h2pri
twitter.png
www.bleepstatic.com/images/site/login/ 		282 B
809 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/login/twitter.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
197444
cf-polished
origFmt=png, origSize=475
content-disposition
inline; filename="twitter.webp"
content-length
282
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tTASsbW4JRL4a5DkEtXWwMv1%2B9Yzko46VnMaFKeW8tAsno1hVaqXl2sb6TmvANUYKLJ9o%2FLKl4Jp7tgW1tZSryi433RFSqZDDQvGFOlwdPlVWXKSUwExE8TjnpCGfvfPXdPEbxQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 18:59:38 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f912cef7133-YUL
cf-bgj
imgq:85,h2pri
bootstrap.js
www.bleepstatic.com/js/redesign/bootstrap/js/ 		50 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/bootstrap/js/bootstrap.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c13d034eaf2fa73680d0abdbe02ac23b73e3128b5c7f0ee7018eb7b3fbe84a72

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4832
cf-polished
origSize=75484
last-modified
Wed, 13 Feb 2019 14:22:49 GMT
server
cloudflare
etag
W/"984724076"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Eegqdz6auRkGXPrKpJJwp8eRc1bi9d1Nz0w3vSEX8Yy%2BqFdLl%2FZiZq1TNQ6u0z8BdlRGXpaf7QettjBQDKlx5rmPDUnQgybFSU8dk%2BhsNvGhWeceX8toLve4K6xepKXzxpojfuw%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
expires
Fri, 28 May 2021 10:23:56 GMT
cache-control
max-age=3024000
cf-ray
6b899f912cf07133-YUL
cf-bgj
minify
blazy.min.js
www.bleepstatic.com/js/blazy/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/blazy/blazy.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4833
last-modified
Thu, 16 Aug 2018 21:06:19 GMT
server
cloudflare
etag
W/"753357888"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4TjMh8KKBbg4A6WckwZWU%2BiBhjjxo7TQvxW6p1MZ5qzCtQ3IGDBex0c2kSNcagqfBcva416oV3Wis0RwTU0RWsTBhrZdAdxN3a2vXrPIUe9SwF4ibTJC56jSDpJ82wxYM2vrap0%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
6b899f90ec807133-YUL
expires
Fri, 28 May 2021 10:23:56 GMT
bleep.js
www.bleepstatic.com/js/redesign/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/bleep.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4832
cf-polished
origSize=3600
last-modified
Mon, 01 Oct 2018 12:47:57 GMT
server
cloudflare
etag
W/"2696894447"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m0gLWxye01x5ZJYpBMjfPNTlbmCT9r%2FT5Q6ch5s9sDASBg%2BDbOU%2BAKDs%2Fv98b1%2Bffgr15KKWr0xfoxQqJKwd4U47quRd%2B%2BXKE3oDwHm2LhXwVXoIg%2BPnZVPPzwpXI34U3XL1pw4%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
expires
Fri, 23 Jul 2021 03:04:43 GMT
cache-control
max-age=3024000
cf-ray
6b899f912cf17133-YUL
cf-bgj
minify
jquery.fancybox.js
www.bleepstatic.com/js/redesign/fancybox/ 		31 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
566
cf-polished
origSize=48706
last-modified
Wed, 14 Oct 2015 20:25:51 GMT
server
cloudflare
etag
W/"327140449"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6ExRb4%2Bb4F2iPZWBSem6pMegG8UanoW9dY8ECo1c4oG2f%2F%2FxXbnaZgNQRdSrdy%2FLjbjt8GA1nNGFZ9lzZi1E2EeEF%2FawffSwsS5v0%2B4nnkKjBTzfGpUwEtWxMs1XR5JO8VLJQ50%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
expires
Fri, 28 May 2021 10:23:56 GMT
cache-control
max-age=3024000
cf-ray
6b899f912cf27133-YUL
cf-bgj
minify
fixto.min.js
www.bleepstatic.com/js/fixto/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/fixto/fixto.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4388
last-modified
Sat, 13 Jun 2015 21:34:42 GMT
server
cloudflare
etag
W/"1740214911"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JZ9XuHbvjqxLe3qLdsWgj1UA8SDkkiueFZotedp6cEvov%2BxjBZKGPeISB3Eo%2F04FG7U0GJBSO7M2Qj0ppvfOtkXr3Wigs9Otf3urXWtSQ12RA8iBuEE6nrw8g8TK4tRjChdQl0M%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
6b899f90ec917133-YUL
expires
Fri, 23 Jul 2021 17:44:06 GMT
addthis_widget.js
s9.addthis.com/js/300/ 		353 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s9.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
x-check-cacheable
YES
cache-control
public, max-age=600
date
Sun, 05 Dec 2021 01:50:23 GMT
x-host
s9.addthis.com
content-length
116325
v64f9daad31f64f81be21cbef6184a5e31634941392597
static.cloudflareinsights.com/beacon.min.js/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js/v64f9daad31f64f81be21cbef6184a5e31634941392597
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5e41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5bf0a170ae91f1bb8d0c94381a74ab8b85f938bf31bf18a9c8e3b835250d3be6

Request headers

Referer
https://www.bleepingcomputer.com/
Origin
https://www.bleepingcomputer.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-encoding
gzip
last-modified
Fri, 22 Oct 2021 22:23:12 GMT
server
cloudflare
etag
W/2021.10.0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
6b899f916e49ca63-YUL
connatix.playspace.js
cds.connatix.com/p/140482/ Frame 3CCD
Redirect Chain
  • https://cd.connatix.com/connatix.playspace.js
  • https://cds.connatix.com/p/140482/connatix.playspace.js
1 MB
242 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/140482/connatix.playspace.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
59d6a1ad252c9993eeb7899bbf9fe12b0942588987aaf144d0a11f20463f8d98

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
last-modified
Fri, 26 Nov 2021 12:04:32 GMT
age
739548
etag
"6a5c65576d6197257cddfa44d3776ec8"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
246955

Redirect headers

location
https://cds.connatix.com/p/140482/connatix.playspace.js
date
Sun, 05 Dec 2021 01:50:22 GMT
cache-control
no-cache, no-store, must-revalidate, max-age=0
server
Kestrel
accept-ranges
bytes
content-length
0
fab.js
ecdn.analysis.fi/static/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ecdn.analysis.fi/static/js/fab.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.63.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-63-15.ewr53.r.cloudfront.net
Software
nginx/1.18.0 /
Resource Hash
d8a34aeacc4054bd4e119e538c7eb4956421014f48a9b603d3f9314a7435b5a6

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:26:19 GMT
content-encoding
gzip
last-modified
Sat, 04 Dec 2021 21:35:45 GMT
server
nginx/1.18.0
age
1443
etag
W/"61abdf31-1090"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
x-amz-cf-pop
EWR53-C1
x-amz-cf-id
F3yyXVVrR3OiCKN5bJwfHTk5D-Muc_FZhhRrUAg3g9SbO10x6skRow==
via
1.1 1089f52bc4f4516fdbd56d5c71d181e9.cloudfront.net (CloudFront)
expires
Sun, 05 Dec 2021 02:26:19 GMT
fi_client.js
ecdn.firstimpression.io/ 		347 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ecdn.firstimpression.io/fi_client.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-70.ewr50.r.cloudfront.net
Software
nginx/1.18.0 / PHP/7.3.23
Resource Hash
2af10b9c9dd4d6b4239687a27938947a38179a67c80498d29069b23ee95d0c16
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:26:16 GMT
content-encoding
br
age
1446
x-powered-by
PHP/7.3.23
x-cache
Hit from cloudfront
x-xss-protection
0
access-control-allow-origin
*
last-modified
Sun, 05 Dec 2021 01:26:16 UTC
server
nginx/1.18.0
etag
W/"7b4ba2934e1b215444c085a62f57db18"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 0c2947bdc7b8340f8e04a5a58d570237.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
EWR50-C1
x-amz-cf-id
RTjU8VzoRtNXxVqh-gvjyByDX06VY9WMHN6Y4Pge7OQYtkhfKbw3yQ==
expires
Sun, 05 Dec 2021 02:26:16 GMT
login_bg.png
www.bleepstatic.com/images/site/ 		126 B
514 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/login_bg.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
196522
cf-polished
origFmt=png, origSize=187
content-disposition
inline; filename="login_bg.webp"
content-length
126
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oQDgg492RJZLk2gJo7MSBETQyUyu2F6nxxU8Q9%2F%2B57a8RRmzd47X2Db7wu2rX1b6fs0AO0k9JJmetUjtd5%2BHx0jW2yr9oMKJVO6bbLM%2FrByzdLcl%2BScuJL32qO%2B%2BnSw2HiIPt%2FE%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 19:15:00 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f912cf37133-YUL
cf-bgj
imgq:85,h2pri
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bleepingcomputer.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 16:23:56 GMT
x-content-type-options
nosniff
age
379586
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15688
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:19 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 30 Nov 2022 16:23:56 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bleepingcomputer.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 01:28:42 GMT
x-content-type-options
nosniff
age
174100
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15828
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:28 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 03 Dec 2022 01:28:42 GMT
truncated
/ 		37 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/gif
nav_bg.png
www.bleepstatic.com/images/site/ 		72 B
644 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/nav_bg.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
191876
cf-polished
origFmt=png, origSize=83
content-disposition
inline; filename="nav_bg.webp"
content-length
72
last-modified
Sat, 04 Mar 2017 07:57:02 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ezrV%2FRho6opbTKsC0Ng25Frbtru%2FgPFkwG8nWYZGrueXMmZHvlKIGU1bLgiMbbD8cHk9KRvVy9x%2F9n%2BNjsuxSPLAXXhBwJnQ55ud6cofnQVkadcH4hUJPmyAqm%2F4xKiQOgdyE1k%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 20:32:26 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f914d167133-YUL
cf-bgj
imgq:85,h2pri
20x20-printer.png
www.bleepstatic.com/images/site/ 		422 B
832 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/20x20-printer.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1064735
cf-polished
origFmt=png, origSize=824
content-disposition
inline; filename="20x20-printer.webp"
content-length
422
last-modified
Sat, 03 Oct 2015 03:18:32 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kxctrZ43hups%2FZLL%2FZ%2Boq9Xd%2FDAguVZnWHEvVHPhQLN4bw2fdNwkzNEa9A86SpIJvwhmt4mNHCsRx99cpCrPb5FLlvOdOxiSQJsnAoKvgaKKbBQSteBG%2FVehJuXgic6m9RD09lo%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Wed, 22 Dec 2021 18:04:47 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f914d247133-YUL
cf-bgj
imgq:85,h2pri
calendar.png
www.bleepstatic.com/images/site/ 		86 B
469 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/calendar.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/news.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
197444
cf-polished
origFmt=png, origSize=129
content-disposition
inline; filename="calendar.webp"
content-length
86
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lNXIW1CyU42cq3SHULJOSZx688YenTt3UhROIMhugOuJLQ%2F75onqmQZ4rQOYJ0g0dZO9MVb%2FF4M9pXZEM0iwtyjHYiXnjjS%2BoptBSPLJVzu8iJdTOmzebvCAv0z%2FJ9dD%2BgmS9Z0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 18:59:38 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f915d257133-YUL
cf-bgj
imgq:85,h2pri
clock.png
www.bleepstatic.com/images/site/ 		252 B
629 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/clock.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9cdb6bfef8d4212d9bf634ca6724a28e85dfa69cd404e6f9d3760d70a7873949

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/news.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1066122
cf-polished
origFmt=png, origSize=1316
content-disposition
inline; filename="clock.webp"
content-length
252
last-modified
Fri, 29 May 2015 07:08:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZH%2BYpJxBOKp1YDb7M6bm2uI%2BvknNGKVwutLQYmsjQRs6OdXyQVLVa2MeYjMznXwBarWzF5VBp2nWqNGkpuIcAORS386U0Tzi1KXDX7UD2TYGCeBA8he6NhnKCMQKUZSry1gFcU8%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Wed, 22 Dec 2021 17:41:40 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f915d267133-YUL
cf-bgj
imgq:85,h2pri
comment-light.png
www.bleepstatic.com/images/site/ 		94 B
472 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/comment-light.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cfac05f501d6d4d62e29fff1049569c3c2aa8732af8db3a36e8fa252f05f5861

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/news.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
193930
cf-polished
origFmt=png, origSize=1034
content-disposition
inline; filename="comment-light.webp"
content-length
94
last-modified
Fri, 29 May 2015 07:08:28 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EPj4Ctyfcokkzpb1xOivM63ZFBQa9bKZI5pyF1X7m8rg3pyCZ1BNasN6L5rRKGgzXtyh67iQQtA0gjXYvx4FceDmFi1iXl0i9R%2B3pQcB0TOzkdYy9MoMwtf13iY49Y3OSnDHt5A%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 19:58:12 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f915d277133-YUL
cf-bgj
imgq:85,h2pri
32x32-printer.png
www.bleepstatic.com/images/site/ 		256 B
666 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/32x32-printer.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
191850
cf-polished
origFmt=png, origSize=618
content-disposition
inline; filename="32x32-printer.webp"
content-length
256
last-modified
Fri, 02 Oct 2015 21:57:19 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r%2FSNowbCay4YxOoT6Bcp5AjF2Xrjv5hrKnOnYD2x1k34m0WK9B6WksFEVrpTyHcBUpIO9RQL2UhJ%2BP57lwT16NnhdrCuC6n5lpA0BOGLMP6QZBY3NlAPK%2FIl%2BnaDEnOGDmfRQ4s%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 20:32:52 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f915d297133-YUL
cf-bgj
imgq:85,h2pri
21beb902b545b086a90ec39f1df36b94.jpg
www.bleepstatic.com/author/photos/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/author/photos/21beb902b545b086a90ec39f1df36b94.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb845bc1998e818ffd1ebeacd695e0a60e479e5993e5f0053e34bff96b8d4c53

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1842
cf-polished
origSize=7617, status=webp_bigger
content-length
7551
last-modified
Mon, 26 Oct 2015 17:15:33 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0uVc75fJ%2BK4z%2FmYUVcFfKc%2Fy2lr0r64Q4AgcxXuSAGuOoNa4KkAUWNpVgNXXOnaShfTv5MwqmUoA5bzBw2XvwJyTtOKLIraMTY0v8Q2H16Narphc2v%2Bm%2FatfzrKuE7tJdskyvJ4%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
expires
Sun, 23 May 2021 10:26:42 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f915d2b7133-YUL
cf-bgj
imgq:85,h2pri
h4-bg.png
www.bleepstatic.com/images/site/ 		38 B
591 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/h4-bg.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1496738
cf-polished
origFmt=png, origSize=72
content-disposition
inline; filename="h4-bg.webp"
content-length
38
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zvcmn5kbJJEvxUIJwWGHL3N1II8lCQ1Jh%2By01OMWiOZp0t6kEr8JU1B7cwQxYoCNS660J%2F7NtkWQzob7SzOviogrCSpaHIRC%2B9Mp0XU2TgWiqjv%2FDjWkR8grEeL118fBnyhD6fc%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 17 Dec 2021 18:04:44 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f915d2c7133-YUL
cf-bgj
imgq:85,h2pri
news_email_icon.png
www.bleepstatic.com/images/site/ 		126 B
511 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/news_email_icon.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/home.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/home.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1066122
cf-polished
origFmt=png, origSize=1105
content-disposition
inline; filename="news_email_icon.webp"
content-length
126
last-modified
Fri, 29 May 2015 07:10:12 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v6Ldh1SIM6FiLF4iGMMx5%2BnDPW2iTGBvmIMUWoAz5fOCje2hXENe0JJ9321mXWfpIXS4aVl%2FAC4rGTVlfzQf%2Fj2UTdPyqChv%2Fu0eZwX1cxE9l2NXv9fcIJh1bU3vA6IKrYSe0oo%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Wed, 22 Dec 2021 17:41:40 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f915d2d7133-YUL
cf-bgj
imgq:85,h2pri
news_footer_icon.png
www.bleepstatic.com/images/site/ 		110 B
496 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/news_footer_icon.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
192021
cf-polished
origFmt=png, origSize=186
content-disposition
inline; filename="news_footer_icon.webp"
content-length
110
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YyBC63V%2Fq36d4czk2mViNut%2B0B%2FzeexIMa59aUjQqtvguhmeqU7rSUxdu0bjgoGoLYMldGatl1l1bRqkH03VhDQFpD1FBXPJZi%2BSydBUrbzodkUY5np6ZnE5b5AvLSL5B4Jd%2BQM%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 01 Jan 2022 20:30:01 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f915d2e7133-YUL
cf-bgj
imgq:85,h2pri
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bleepingcomputer.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 04:56:13 GMT
x-content-type-options
nosniff
age
334449
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15732
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:20 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 01 Dec 2022 04:56:13 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bleepingcomputer.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:09:49 GMT
x-content-type-options
nosniff
age
6033
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15920
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Mon, 05 Dec 2022 00:09:49 GMT
init
d.pub.network/v2/ 		62 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/v2/init?siteId=535&env=PROD
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
503747b9c54acc1a1731ff2f479ef5ad06b22240a06c9b9c13d51f01b61af954

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
jquery.fancybox.css
www.bleepstatic.com/js/redesign/fancybox/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3935
cf-polished
origSize=4895
last-modified
Wed, 14 Oct 2015 20:25:51 GMT
server
cloudflare
etag
W/"9108074"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gf2Hw3n2DgyUAGeZa7OaOzHx%2BnhDSOn6g4JKtzxx6FRxjAo4gLuiRsa6iqaxJ34zBY9%2FCbC5dhVcSxZjwj4aoC4SmjK%2BYDcyil1ZNsfLK8VbMYDvN%2BBcPQQKo1aH5t1XbA5IIlI%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Fri, 19 Nov 2021 17:02:08 GMT
cache-control
max-age=3024000
cf-ray
6b899f923e3a7133-YUL
cf-bgj
minify
font-awesome.css
www.bleepstatic.com/css/redesign/ 		22 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/css/redesign/font-awesome.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4838
cf-polished
origSize=26776
last-modified
Tue, 03 May 2016 04:39:29 GMT
server
cloudflare
etag
W/"1700274315"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fzi5X5JISU65GhaVyHxwkBq%2BnC2WiRLxB3B1ucXXkIB2ByYoR820t2i2LtEFozTw8asWTMiTYYyvFJKrrWOY5bkkDJ2690BdMR67pM86ImGZG%2FMC%2FcWn%2F8H%2BsbldOKI7dZBJPo8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Fri, 19 Nov 2021 13:03:28 GMT
cache-control
max-age=3024000
cf-ray
6b899f923e3b7133-YUL
cf-bgj
minify
favicon.ico
ad.doubleclick.net/ 		1 KB
664 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.81.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s74-in-f6.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 14:23:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
41192
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
last-modified
Tue, 08 May 2012 13:08:06 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/x-icon
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 05 Dec 2021 14:23:51 GMT
achoice.svg
widgets.outbrain.com/images/widgetIcons/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.190 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-190.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
last-modified
Sun, 28 Nov 2021 09:31:35 GMT
server
AkamaiNetStorage
etag
"9d26fa4e7238ed94f1d0d92afb453b3e:1638092476.569147"
access-control-allow-methods
GET,POST
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=2592000
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*, *
content-length
2735
expires
Tue, 04 Jan 2022 01:50:23 GMT
moatframe.js
z.moatads.com/addthismoatframe568911941483/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
3BDAE1FAB05E52F4
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=10794
accept-ranges
bytes
content-length
948
x-amz-id-2
JQEtOEyiFCqCP1YLI1OIPGBGUg/WHgpDv22+z5rvn/G8szLTqEelRVwbxuu0H6mk2GphOf1hSec=
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/ 		2 KB
855 B 		Script
General
Check archive.org
Download Go to
Full URL
https://v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/_ate.track.config_resp
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
etag
-1659864586--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=29, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
678
300lo.json
m.addthis.com/live/red_lojson/ 		128 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=61ac1adf67733f0b&bkl=0&bl=1&pdt=356&sid=61ac1adf67733f0b&pub=ra-561517d2c7f964d6&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.bleepingcomputer.com&fp=news%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=computers%2Cwindows%2Clinux%2Cmac%2Csupport%2Ctech%20support%2Cspyware%2Cmalware%2Cvirus%2Csecurity%2CBotnet%2CEmotet%2CMalware%2CTrickBot%2CTrojan%2Cvirus%20removal%2Cmalware%20removal%2Ccomputer%20help%2Ctechnical%20support&colc=1638669023156&jsl=1&uvs=61ac1adf658674c9000&skipb=1&callback=addthis.cbs.jsonp__429347298580305740
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3e16e3fa1182656e77270ea7c961eb6a022d2e4ecf14e2c289d6d0c7c82a0b50

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:23 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
p3p
policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"
content-length
128
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 0126 		0
0
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 8DCF 		71 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

server
nginx/1.15.8
content-type
text/html
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
etag
W/"5f971164-11adc"
timing-allow-origin
*
cache-control
public, max-age=86313600
p3p
CP="NON ADM OUR DEV IND COM STA"
strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
content-length
26421
x-check-cacheable
YES
date
Sun, 05 Dec 2021 01:50:23 GMT
vary
Accept-Encoding
x-host
s7.addthis.com
widget_iframe.21f942bb866c2823339b839747a0c50c.html
platform.twitter.com/widgets/ Frame 1D6B 		319 KB
103 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.21f942bb866c2823339b839747a0c50c.html?origin=https%3A%2F%2Fwww.bleepingcomputer.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8197) /
Resource Hash
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
187960
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Sun, 05 Dec 2021 01:50:23 GMT
Etag
"8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified
Thu, 02 Dec 2021 21:34:18 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (cha/8197)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
105433
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
5308
date
Sun, 05 Dec 2021 00:21:55 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Sun, 05 Dec 2021 02:21:55 GMT
fontawesome-webfont.woff
www.bleepstatic.com/fonts/ 		64 KB
65 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/fonts/fontawesome-webfont.woff?v=4.2.0
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/font-awesome.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1

Request headers

Referer
https://www.bleepstatic.com/css/redesign/font-awesome.css
Origin
https://www.bleepingcomputer.com
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
cf-cache-status
HIT
last-modified
Thu, 23 Apr 2015 09:36:00 GMT
server
cloudflare
age
540
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cWopffvlvOL1ti9x22Yz4MHusNanNfJVFqX0PPRdoSd6wnmp%2Be44iVU1JrmLVzxd5aHy6G6ufmG9uBR0PPMU9Twb0RPvH3AR9R7o9Uh9WrpEhsf6JmwqJitecMeb9EkoTu%2B5leE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
access-control-allow-origin
*
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
6b899f933d9d7139-YUL
content-length
65452
292x176_modem_router.jpg
www.bleepstatic.com/content/hl-images/2021/11/19/thumb/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/content/hl-images/2021/11/19/thumb/292x176_modem_router.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b4d031954748e7f374abdfec4a7c1e2f83f7fadf0542058010250c0024970d1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
160906
cf-polished
qual=85, origFmt=jpeg, origSize=30858
content-disposition
inline; filename="292x176_modem_router.webp"
content-length
5804
last-modified
Fri, 19 Nov 2021 13:35:17 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uPUEF4SsSFsdIpGonpUYOiSXCKIwblhW3gmFtedizzKfaW%2Bea%2FTLH3cGKrzYpyTLQ9n%2BFY3wQ%2BVhtSqzDW9qa6K1FnnCpg%2FiHFkftlN%2F1ew1zTJjwR3s2jMkzcRN3qwwPLO0fV0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sun, 02 Jan 2022 05:08:36 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f930f437133-YUL
cf-bgj
imgq:85,h2pri
292x176_Russia-VPN.jpg
www.bleepstatic.com/content/hl-images/2021/06/18/thumb/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/content/hl-images/2021/06/18/thumb/292x176_Russia-VPN.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8b7069299acb7cecdf2bd4f42505d2cd5e08783754ef2a79d30f1f886f38a75

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
74731
cf-polished
qual=85, origFmt=jpeg, origSize=38301
content-disposition
inline; filename="292x176_Russia-VPN.webp"
content-length
7714
last-modified
Fri, 18 Jun 2021 15:05:59 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nLS0TyC7bkhwRvHPc1T8FMFWOIUWnQsD7vOmfM%2BJBZ7SIViSQF2c2%2FkAev%2Fh%2BgKS4GUhpZc78aoFUHVlwHr2u8A5SuVP6w3pS57mlXrP3pEbIfmwkZOL1HwrrU%2BGQupCqtqAZ3A%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Mon, 03 Jan 2022 05:04:52 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
6b899f931f477133-YUL
cf-bgj
imgq:85,h2pri
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111170101/ 		272 KB
98 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111170101/show_ads_impl_fy2019.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
14dd32c871105de3ad507e90898b20438e3e4b46bf1492b608b4f042ee1f4247
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100169
x-xss-protection
0
server
cafe
etag
2504628295885497759
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Sun, 05 Dec 2021 01:50:23 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20211201/r20190131/ Frame C67D 		11 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20211201/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
16923f9fcc118f6870a574a73697c19eb79210b2ce401e5e1b92a2a5fcda080a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Sat, 04 Dec 2021 15:51:56 GMT
expires
Sat, 18 Dec 2021 15:51:56 GMT
content-type
text/html; charset=UTF-8
etag
6406113418471942685
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4879
x-xss-protection
0
age
35907
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
beacon.js
sb.scorecardresearch.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-62.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 17:28:38 GMT
content-encoding
gzip
etag
W/"1827f116c73f319409b97f10b8a58ade"
last-modified
Fri, 26 Feb 2021 14:35:05 GMT
server
AmazonS3
age
34936
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 8e7c396366d89944c10dfabcfcb15b3d.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
f7L10w0BE31Ps0dOVyVJpRlh17O7Gyi6TMqF_MDqasIrwP1A0DzKQA==
pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
a.pub.network/core/pubfig/ 		324 KB
97 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cabdf43589214ad0231af8ec71b0ba10b72b5541a6a3238ac1b2d58cdac68329

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=O4ulCw==, md5=7swA9tv3eGkRs/SVH+GPiQ==
date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
363514
x-guploader-uploadid
ADPycds2671R1HqE_dJsh6l6jQlEygYmB4Z4SC8lpRaKkPY8xYY6RfGZiE1D1qg7L9FutRAofNaxSwPbAVNhWeDTG42DwQ9DKw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Thu, 18 Nov 2021 17:40:06 GMT
server
cloudflare
etag
W/"eecc00f6dbf7786911b3f4951fe18f89"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eAd4lob7LV62qHC3Hi0TBTwqYodD1d8%2BLOybn%2BfMFZaGflQCWwFQ2B4XXs%2BGBGdTt5sEu0%2Fut7095cMtRK7QG646n4%2BAwpQdaaIzUjxLXYa5CTy5Ep4chzkq%2Fi0ZpqCgnlXsiCwPv4rFmJc%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1637257206820465
access-control-expose-headers
*
cache-control
public, max-age=3600
x-goog-stored-content-length
332222
cf-ray
6b899f93587a7138-YUL
expires
Tue, 30 Nov 2021 21:45:12 GMT
connatix.playspace.css
cds.connatix.com/p/140482/ 		96 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/140482/connatix.playspace.css
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
51ae4c5642051d85bcfb8ed5d7ce619a0fd7cd201723c823f7495a829eefaa72

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
last-modified
Fri, 26 Nov 2021 12:04:31 GMT
age
739548
etag
"8080ed2619ce4713545db8f29021c7e4"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
13367
spc_fi.php
cdn.firstimpression.io/delivery/ 		39 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.firstimpression.io/delivery/spc_fi.php?id=5971&url=%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&charset=UTF-8&ch=1&ref=www.bleepingcomputer.com&viewerId=null&referer=&_firid=31958207
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-70.ewr50.r.cloudfront.net
Software
nginx/1.18.0 / PHP/7.3.23
Resource Hash
ee2d0daef461b1efaf8fc5787127e202cf7b3d40aca343bcdaf474c6948c2168

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
x-amz-cf-pop
EWR50-C1
x-powered-by
PHP/7.3.23
x-cache
Miss from cloudfront
p3p
CP="CUR ADM OUR NOR STA NID"
pragma
no-cache
access-control-allow-origin
https://www.bleepingcomputer.com
server
nginx/1.18.0
vary
Accept-Encoding
content-type
application/json; charset=UTF-8
via
1.1 0c2947bdc7b8340f8e04a5a58d570237.cloudfront.net (CloudFront)
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-amz-cf-id
Dz287FQSqjt3rK4ygltU8LZD3xMLRqfO8w0lcF-3bJhPjm8p6D0Ilw==
expires
0
collect
www.google-analytics.com/j/ 		1 B
21 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=694903207&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ul=en-us&de=UTF-8&dt=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=2045019152&gjid=1936036935&cid=748970943.1638669023&tid=UA-91740-1&_gid=1454516622.1638669023&_r=1&gtm=2ouc10&z=2140206696
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:23 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
pandg-sdk.js
pghub.io/js/ 		14 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pghub.io/js/pandg-sdk.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.45.217 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
217.45.241.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
9cd1b5630bcc34ecc71dbcbdfe45ddb9ed3cb4c0464a2abeb76bcc490635e376

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:15:18 GMT
content-encoding
gzip
age
2105
x-guploader-uploadid
ADPycdsQlUYkgNHaj8E9QTsfUw5AkvG_hcc2BFC-zYsCGInWmnhYIDpjIh3Cdy8YupVrsjsMU0eD-ndK2Ostyib_SgJ3CGnMLA
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3637
last-modified
Mon, 22 Nov 2021 21:22:46 GMT
server
UploadServer
etag
"9f5012774da47c70284c82ae0ce443d7"
vary
Accept-Encoding
x-goog-hash
crc32c=oAHW2w==, md5=n1ASd02kfHAoTIKuDORD1w==
x-goog-generation
1637616166247508
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=3600
x-goog-stored-content-length
3637
accept-ranges
bytes
content-type
application/javascript
gpt.js
www.googletagservices.com/tag/js/ 		78 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bf1f337991b6ffd7afff952440f4a93dfc4fbe21b3a223b6efae13e8d7d6b194
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1063 / 645 of 1000 / last-modified: 1638572869"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26933
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Sun, 05 Dec 2021 01:50:23 GMT
tag
btloader.com/
Redirect Chain
  • https://freestar-io.videoplayerhub.com/gallery.js
  • https://btloader.com/tag?h=freestar-io&upapi=true
114 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://btloader.com/tag?h=freestar-io&upapi=true
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
2606:4700:20::681a:78b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4c8d6c66cf7bb5cf29e1a2cda44dcbed9df8bd54fb633aa5a4afb9933b73156

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

cf-ray
6b899f959b324bcb-YUL
date
Sun, 05 Dec 2021 01:50:23 GMT
via
1.1 google
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
1919
etag
W/"8d0de24faa294ec738a65b9be8e61766"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tkf1eGLz4EqaQkb5sGelV72NFZUFsJdm5vvrIVn7Z10N74U5E4VuBMLKtceGQ0S8N7IYYb4vvoPw56R7g2pdhNhepjBgq7yTaM5WCjIz2JZzLs%2F9Nt%2F22CZ56cVdsp1VprFkbhJ4fHzgpg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=1800, must-revalidate
content-encoding
br

Redirect headers

date
Sun, 05 Dec 2021 01:50:23 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4ZA4Fm8gMpar9992Opdu3KmqcNpRRIRwsyMYy1HVT2haJn8sV2wuUNp8Pfyl4oSQjwF35WdkXbCqGebxvwGbrbN25%2FL%2FtMYqkv%2FmZwk0f%2Fk5xq96zRBstokHNUE09uktzc7g0c5rw18JOHbxpnuAqErkB4dVb%2BsMrjZqxQ%3D%3D"}],"group":"cf-nel","max_age":604800}
location
https://btloader.com/tag?h=freestar-io&upapi=true
cache-control
max-age=3600
cf-ray
6b899f94bc75713e-YUL
expires
Sun, 05 Dec 2021 02:50:23 GMT
184310-82987131453484.js
js-sec.indexww.com/ht/p/ 		0
453 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/ht/p/184310-82987131453484.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:23 GMT
Content-Encoding
gzip
Last-Modified
Sun, 05 Dec 2021 00:56:00 GMT
Server
Apache
ETag
"764008-0-5d25b9a899e34"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=340
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
20
Expires
Sun, 05 Dec 2021 01:56:03 GMT
prebid-analytics-4.42.7.js
a.pub.network/core/ 		458 KB
136 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/prebid-analytics-4.42.7.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
844d16730113c50876b1ea84b4ba3a56a4c0f115d04b8a25da0d558f1d799b00

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=Chz8kg==, md5=qHN8a/kkUDZkU6QAridSuQ==
date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
17909
x-guploader-uploadid
ADPycdvLZcWREBLMwRs5zTGWxs-F8hHrhY7yECBFlUWEHBfjoutzLO5ETYIZ9mHbRnn_ccSUQokT93H_L2vsZDnpgZJ8D9Qwvg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
content-type
text/html
last-modified
Wed, 03 Nov 2021 15:36:10 GMT
server
cloudflare
etag
W/"a8737c6bf92450366453a400ae2752b9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zw%2FUPhho8Rzx3r5KfIr%2B8vjHIlqI5bsd186sdE8RlqoD4weF54sdLpYKLkQg71xEHAajwPw15W8LKZaZA9LyNpMY7H0MoyywNVEsbn8uBt1sFvjMqY1tlA15x3Kd9fMOegisgxDjwhp1Oe4%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1635953770715042
access-control-expose-headers
*
cache-control
private, max-age=86400
x-goog-stored-content-length
469259
cf-ray
6b899f947a377138-YUL
expires
Sun, 04 Dec 2022 20:51:54 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=23384447&cs_ucfr=1&ns__t=1638669023476&ns_c=UTF-8&cv=3.5&c8=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&c7=https%3A%2F...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=23384447&cs_ucfr=1&ns__t=1638669023476&ns_c=UTF-8&cv=3.5&c8=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&c7=https%3A%2...
0
224 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=23384447&cs_ucfr=1&ns__t=1638669023476&ns_c=UTF-8&cv=3.5&c8=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&c9=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
13.226.37.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-62.ewr53.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
via
1.1 8e7c396366d89944c10dfabcfcb15b3d.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-C2
etag
W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
x-amz-cf-id
x9VdJ_8GdSEetf0SUoQfVpl_yURQDCIkrdyqhwxgnlF-Px_F4inpiw==
x-cache
Miss from cloudfront

Redirect headers

date
Sun, 05 Dec 2021 01:50:23 GMT
via
1.1 8e7c396366d89944c10dfabcfcb15b3d.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-C2
vary
Accept
x-cache
Miss from cloudfront
content-type
text/plain; charset=utf-8
location
https://sb.scorecardresearch.com/b2?c1=2&c2=23384447&cs_ucfr=1&ns__t=1638669023476&ns_c=UTF-8&cv=3.5&c8=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&c9=
content-length
336
x-amz-cf-id
5rjD91GU4CTm9q-YBE79Q6j5hAGpATSCAtwysxMv_6Zmn_-xY9U7rA==
story
capi.connatix.com/core/ Frame 3CCD 		3 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/story?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
04b722c670faf50123f03075e9cca12fe701d81d72fa7cc67b5dd000d313511e

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:23 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
2674
content-type
multipart/form-data
cookie.js
partner.googleadservices.com/gampad/ 		224 B
653 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=www.bleepingcomputer.com&callback=_gfp_s_&client=ca-pub-0920899300397823
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111170101/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
0172189e50951241e88f46ac748223e09805978ea91d6182ec81df40a92464ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
209
x-xss-protection
0
integrator.js
adservice.google.ca/adsid/ 		107 B
792 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.ca/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111170101/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111170101/show_ads_impl_fy2019.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:808::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 6789 		121 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111170101/show_ads_impl_fy2019.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e77d232c6654987822f0f5bb073e5c15f210420715a2dea085bec290ea72f545
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Sun, 05 Dec 2021 01:50:24 GMT
server
cafe
content-length
25374
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Sun, 05 Dec 2021 01:50:24 GMT
cache-control
private
/
tag.escalated.io/ 		180 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tag.escalated.io/?i=KxxajmhPPCsT&d=www.bleepingcomputer.com&type=display&cust=5971&sid=direct&c=&cust2=direct
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.14.21.152 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-14-21-152.us-east-2.compute.amazonaws.com
Software
Apache /
Resource Hash
42c5d1ff6266b93bad630f3aa7c50546c78d6af2580f4c15b02ecc31c1887f3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:23 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 02 Dec 2021 19:30:54 GMT
Server
Apache
ETag
"2d194-5d22ed4331780"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
no-cache, max-age=0
Connection
close
Accept-Ranges
bytes
Content-Length
49444
X-XSS-Protection
1; mode=block
layers.fa6cd1947ce26e890d3d.js
s7.addthis.com/static/ 		263 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-41cf5"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Sun, 05 Dec 2021 01:50:23 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
77651
gen_204
pagead2.googlesyndication.com/pagead/ 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tn=HEADER&ign=false&pw=1600&ph=1200&x=0&y=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:23 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 8BD9 		210 KB
58 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1637072838&plat=2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023230&bpp=2&bdt=488&idt=322&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&prev_fmts=834x500&nras=1&correlator=7337172799486&frm=20&pv=1&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=330
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111170101/show_ads_impl_fy2019.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9e21a21d6b098168808f2c5550c6480a4a32a58f96fad2b35dc9e1ea23e8280e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Sun, 05 Dec 2021 01:50:24 GMT
server
cafe
content-length
59737
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Sun, 05 Dec 2021 01:50:24 GMT
cache-control
private
settings
syndication.twitter.com/ Frame 1D6B 		233 B
447 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://syndication.twitter.com/settings?session_id=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.21f942bb866c2823339b839747a0c50c.html?origin=https%3A%2F%2Fwww.bleepingcomputer.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
2816082c025f64540b613fde3096d814ae21ac75279461ec1d6bcb5c07099fdd
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-response-time
7
date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
last-modified
Sun, 05 Dec 2021 01:50:23 GMT
server
tsa_b
vary
Origin
strict-transport-security
max-age=631138519
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
x-connection-hash
a4f736c600a14401d9ff31c2261c0d6df3cbac33d47e1b17cfb86291c13cb494
content-length
167
pubads_impl_2021120201.js
securepubads.g.doubleclick.net/gpt/ 		347 KB
117 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js?31063889
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
sffe /
Resource Hash
947dd8624842a892adc7ecc70ec3270e5792bb3cc509dd1ff5720f2f8fe66419
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
119206
x-xss-protection
0
last-modified
Thu, 02 Dec 2021 15:41:51 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Sun, 05 Dec 2021 01:50:23 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		213 B
761 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bleepingcomputer.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
3fef19e536824cf94f0a91aa3c591c5cce3a2324b0cb39b2a848ec4ea8ff642c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
125
x-xss-protection
0
expires
Sun, 05 Dec 2021 01:50:23 GMT
48.008759e9efe1c1b693dd.js
s7.addthis.com/static/ 		281 B
486 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/48.008759e9efe1c1b693dd.js
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-119"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Sun, 05 Dec 2021 01:50:23 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
246
shares-post.json
api-public.addthis.com/url/serviceapi/ 		2 B
321 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-public.addthis.com/url/serviceapi/shares-post.json?services=sFbt&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-type
text/plain

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
surrogate-key
sFbt=https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
last-modified
Sun, 05 Dec 2021 01:00:00 GMT
server
nginx/1.15.8
date
Sun, 05 Dec 2021 01:50:23 GMT
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-transform, max-age=0, s-maxage=14400
access-control-allow-credentials
true
content-length
2
info.json
www.reddit.com/api/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.reddit.com/api/info.json?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&jsonp=_ate.cbs.rcb_7yx30
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
041a94f744701dd78e5a939b8b4aa778a534d53ce094b6a6b5389aec664615e8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-ratelimit-used
1
content-encoding
gzip
x-content-type-options
nosniff
access-control-allow-origin
*
strict-transport-security
max-age=15552000; includeSubDomains; preload
vary
accept-encoding
content-length
1842
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-moose
majestic
x-clacks-overhead
GNU Terry Pratchett
server
snooserv
x-frame-options
SAMEORIGIN
date
Sun, 05 Dec 2021 01:50:23 GMT
x-ratelimit-remaining
299
content-type
application/javascript; charset=UTF-8
via
1.1 varnish
access-control-expose-headers
X-Moose
cache-control
private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
x-ratelimit-reset
577
accept-ranges
bytes
expires
-1
info.json
www.reddit.com/api/ 		144 B
693 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.reddit.com/api/info.json?url=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&jsonp=_ate.cbs.rcb_fggm0
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
8627bbb29fb2d60d2746e532d38bc82a583df733c33d929677855167e3bb2c83
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-ratelimit-used
2
via
1.1 varnish
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-length
144
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-moose
majestic
x-clacks-overhead
GNU Terry Pratchett
server
snooserv
x-frame-options
SAMEORIGIN
date
Sun, 05 Dec 2021 01:50:23 GMT
x-ratelimit-remaining
298
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
X-Moose
cache-control
private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
x-ratelimit-reset
577
accept-ranges
bytes
expires
-1
sr
capi.connatix.com/tr/ Frame 3CCD 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/sr?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:22 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		79 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
sffe /
Resource Hash
f3385adf33b15d77200af558761f6a92bbeeab7254fa981f16089d6ea81db1dd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1063 / 897 of 1000 / last-modified: 1638572771"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26973
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Sun, 05 Dec 2021 01:50:23 GMT
e479d936-f266-4695-b31e-4cbbd2412beb.bin
vid.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ Frame 3CCD 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/e479d936-f266-4695-b31e-4cbbd2412beb.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
eb2c939431e6250150a8cde81a5203d320e4e83df92c11a11e90b16074581e0e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
last-modified
Sun, 05 Dec 2021 01:29:21 GMT
age
1216
etag
"de91140eeb3c57cdfe88ac582e1382ab"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
829
ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame 3CCD 		374 KB
124 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b630bfefb18b047f36806ca3d09555730a686f944adedef8ef6fabc3751b58f9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
126291
x-xss-protection
0
expires
Sun, 05 Dec 2021 01:50:23 GMT
1.png
img.connatix.com/067e5169-ece3-4ce8-87ad-c7961b8bb396/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/067e5169-ece3-4ce8-87ad-c7961b8bb396/1.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
956035a88a8424f2d36b292231cd4cd7ed705d412b47a7aa929f7b537196c1cb

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
age
3183407
etag
"o7hSHwAUmCBIixIgiGzuW02nJNU8oGEvPnjWp++AQj4"
access-control-max-age
86400
fastly-io-info
ifsz=11996 idim=794x206 ifmt=png ofsz=9784 odim=794x206 ofmt=png
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/png
content-length
9610
cks
cks.connatix.com/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gapzaid&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=gapzaid&ttd_tpi=1
  • https://cks.connatix.com/cks?pid=19&uid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&ttl=1641261023
146 B
232 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cks.connatix.com/cks?pid=19&uid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&ttl=1641261023
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4be2095a1a1043b3de6b7726927c81c0406534705b23ffee70abf9ccfeae315c

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
content-length
146
retry-after
0

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:23 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cks.connatix.com/cks?pid=19&uid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&ttl=1641261023
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
213
usync.html
eus.rubiconproject.com/ Frame CDE3
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=19564_2&endpoint=us-east
  • https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40334-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Sun, 05 Dec 2021 01:50:23 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Server
AkamaiGHost
Content-Length
0
Location
https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Date
Sun, 05 Dec 2021 01:50:23 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
userSync.js
ads.pubmatic.com/AdServer/js/ Frame 3CCD 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/userSync.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
5a49ffdeec0e61058ab6cdd783275b84a2c27a7a26b95a644f7764a78b510a7a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
last-modified
Tue, 15 Jun 2021 06:08:14 GMT
server
Apache/2.2.15 (CentOS)
etag
"1300709-1af3-5c4c7cca9e573"
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
public, max-age=101193
accept-ranges
bytes
content-type
text/javascript
content-length
2267
expires
Mon, 06 Dec 2021 05:56:56 GMT
us
capi.connatix.com/core/ Frame 3CCD
Redirect Chain
  • https://sync.technoratimedia.com/services?srv=cs&pid=70&uid=38868d4c88eb47018e4265d2b8cd3a09&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d26%26ev%3d38868d4c88eb47018e4265d2b8cd3a09%26pname%3dSyn...
  • https://cks.connatix.com/cks?pid=26&ev=38868d4c88eb47018e4265d2b8cd3a09&pname=Synacor&uid=11CC0AD6C88B446C9139DC1BA85CB120&direct=1
  • https://capi.connatix.com/core/us?DemandPartner=26&DemandPartnerUserId=11CC0AD6C88B446C9139DC1BA85CB120&UserId=
0
156 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://capi.connatix.com/core/us?DemandPartner=26&DemandPartnerUserId=11CC0AD6C88B446C9139DC1BA85CB120&UserId=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0

Redirect headers

date
Sun, 05 Dec 2021 01:50:23 GMT
location
https://capi.connatix.com/core/us?DemandPartner=26&DemandPartnerUserId=11CC0AD6C88B446C9139DC1BA85CB120&UserId=
access-control-max-age
86400
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
accept-ranges
bytes
content-length
0
retry-after
0
px.gif
ad-delivery.net/ 		43 B
939 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.40102132986410655
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:246 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
date
Sun, 05 Dec 2021 01:50:23 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
620
x-guploader-uploadid
ADPycdupfa7KCtOe0TVtQ1XEXjEqBcYS55h5xltmciWkwyT05QVbX3hl2G6BY1wwXXVxP-9l4WeFTPgHVnUrgCoq0nDtipi3Jg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
5
x-goog-stored-content-encoding
identity
content-type
image/gif
content-length
43
last-modified
Wed, 05 May 2021 19:25:32 GMT
server
cloudflare
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BMzwxFDsG8V5XG2gJ1g5HN%2BgapZKhFXwvxVeuFYuzifGiuClAxb6%2F9naPYE%2FEcBKVss%2BEQeFi00XBbJKB2KRYTjv46ia2JrBOThqF9bUUMP%2BZ9g9YwcpSJvI12woNoCSvxjQxaHJc0ennnjiAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1620242732037093
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=86400
x-goog-stored-content-length
43
accept-ranges
bytes
cf-ray
6b899f96f9b0713c-YUL
expires
Sun, 05 Dec 2021 02:11:30 GMT
floors
api.floors.dev/sgw/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.floors.dev/sgw/v1/floors
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.238.208 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
208.238.227.35.bc.googleusercontent.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains;preload;

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type,x-api-key
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
access-control-allow-methods
ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
access-control-max-age
3600
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
0
strict-transport-security
max-age=31536000;includeSubDomains;preload;
content-length
0
via
1.1 google
alt-svc
clear
floors
api.floors.dev/sgw/v1/ 		4 KB
4 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.floors.dev/sgw/v1/floors
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.238.208 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
208.238.227.35.bc.googleusercontent.com
Software
/
Resource Hash
f2af1d078e181893a9db7bafac60a67bd5969e371396ea80599af15563d21ae3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains;preload;

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
x-api-key
4e799501-b8b6-4ef1-bad5-225b3dd1aa8d
Content-Type
application/json

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:23 GMT
via
1.1 google
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key
access-control-max-age
3600
access-control-allow-methods
ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
strict-transport-security
max-age=31536000;includeSubDomains;preload;
alt-svc
clear
expires
0
horizon_tweet.4027cff8c5dfbbf9b414b0df963e6b7d.js
platform.twitter.com/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/js/horizon_tweet.4027cff8c5dfbbf9b414b0df963e6b7d.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81BC) /
Resource Hash
7ca703a20171d4d4440daefb529292d7720e3bb2b0aa1aa6d797228bcd3b762c

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:23 GMT
Content-Encoding
gzip
Last-Modified
Thu, 02 Dec 2021 21:34:11 GMT
Server
ECS (cha/81BC)
Age
187995
Etag
"8e55b85bd8d8e443c9a80691ed34d775+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
2438
ao
capi.connatix.com/tr/ Frame 3CCD 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/ao?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:23 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
g
capi.connatix.com/rtb/ Frame 3CCD 		503 B
759 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/rtb/g?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
faa1ac04570af7f7acc7ea28d18aff407c880890d321309188b51de1c36747e2

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:23 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
503
content-type
multipart/form-data
514171
vid.springserve.com/vast/ Frame 3CCD 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain=
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.142.30.148 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-142-30-148.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
befa27fe12a5ea2cf69198a1a717c4d8dffc53ef4d71b4f6a426f2f67d8b81ac

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:23 GMT
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
nginx
content-encoding
gzip
content-type
application/xml;charset=UTF-8
ps
capi.connatix.com/tr/ Frame 3CCD 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/ps?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:23 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
mq
capi.connatix.com/tr/ Frame 3CCD 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/mq?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:23 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
9e0ef252-3a22-4b6a-b9d3-1c6ee222ab4d.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		8 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/9e0ef252-3a22-4b6a-b9d3-1c6ee222ab4d.jpg?crop=834:541,smart&width=834&height=541&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
080d3929d4c6f0ca45ddef3f56e45b6372b9b00b03ade7fc36c959f94ef8baff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
age
1229
etag
"GICP79pa/FQ/5snpiMTH+uDruqrSZtYgD0cxofMRTR4"
access-control-max-age
86400
fastly-io-info
ifsz=44391 idim=1600x900 ifmt=jpeg ofsz=8220 odim=834x541 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
7114
9e0ef252-3a22-4b6a-b9d3-1c6ee222ab4d.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		8 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/9e0ef252-3a22-4b6a-b9d3-1c6ee222ab4d.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3b7c7d6643053e78c799bbf5dbadb05e66477a788da19dba5789bb2e46f1ee71

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
age
1228
etag
"+XNcC/j52nCPkKz7qa5JIShnW9QN+S3lmkccfyLGLrc"
access-control-max-age
86400
fastly-io-info
ifsz=44391 idim=1600x900 ifmt=jpeg ofsz=7923 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
7020
8ed26cb4-b50e-41dd-ba67-e8086312396e.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		69 KB
69 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/8ed26cb4-b50e-41dd-ba67-e8086312396e.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
555c76ffcebb70f2c31d10cebc64edba66846cfee5755ce7fd8cf195ea1c4d0b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
age
1229
etag
"LbkCPVVyzDtkYJbZmy6PebvwPwJs2S4k8kI2TvSG5Ro"
access-control-max-age
86400
fastly-io-info
ifsz=235010 idim=1600x900 ifmt=jpeg ofsz=70726 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
70734
937e1f6a-4c86-481c-8fb2-5a6018496d53.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/937e1f6a-4c86-481c-8fb2-5a6018496d53.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
222e34a90789c24c76384279358846781b332116af4bc26e5c04439a44c55250

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
age
1229
etag
"AjEA2j4c35WeErBHyWuRSWnNTBqPYkgR6bIYAK/sw7k"
access-control-max-age
86400
fastly-io-info
ifsz=110792 idim=1600x900 ifmt=jpeg ofsz=25808 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
25353
28ca3347-a097-4ef3-bf98-57243a8fddba.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/28ca3347-a097-4ef3-bf98-57243a8fddba.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
22e1299474bc27ea501a2ea192fc8de44a72d6be7947c75dd08aedbba683c91b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
age
1229
etag
"k8KeyYYnkaAhkpGT//HhZbg8T+MxETwFEQrlX8rarOs"
access-control-max-age
86400
fastly-io-info
ifsz=130632 idim=1600x900 ifmt=jpeg ofsz=28544 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
28087
6f1c8b5f-b627-4778-a2d3-261997f48ae2.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		74 KB
74 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/6f1c8b5f-b627-4778-a2d3-261997f48ae2.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e4a783177bbd97d5981bdc4b33b9bf4692fb715864e15dd9a693f339e7d01867

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
br
age
1229
etag
"3KLLCg4nyGx1kwPDasjRJo6R6JalLWdR34sk2oJAI/I"
access-control-max-age
86400
fastly-io-info
ifsz=267428 idim=1600x800 ifmt=jpeg ofsz=75995 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
76003
pv
api.btloader.com/ 		0
96 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.btloader.com/pv?tid=sQS3bUGfE&w=5733492711227392&o=5714937848528896&cv=2.0.2-2-gfdc9054&r=false&pageURL=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&upapi=true
Requested by
Host: freestar-io.videoplayerhub.com
URL: https://freestar-io.videoplayerhub.com/gallery.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sun, 05 Dec 2021 01:50:24 GMT
cache-control
no-cache, no-store, must-revalidate
vary
Origin
alt-svc
clear
via
1.1 google
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 9BAF 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/userSync.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=65956
expires
Sun, 05 Dec 2021 20:09:39 GMT
date
Sun, 05 Dec 2021 01:50:23 GMT
vary
Accept-Encoding
bridge3.490.0_en.html
imasdk.googleapis.com/js/core/ Frame 8A25 		595 KB
193 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.490.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
448a333dfdb98768c6308de7aeb073d319ec34bef67636b30fdf97abba0683b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
197951
date
Tue, 30 Nov 2021 23:07:22 GMT
expires
Wed, 30 Nov 2022 23:07:22 GMT
last-modified
Tue, 30 Nov 2021 18:00:51 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
355381
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
client.js
s0.2mdn.net/instream/video/ Frame 3CCD 		44 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::2006 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16746
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 05 Dec 2021 01:50:24 GMT
bridge3.490.0_en.html
imasdk.googleapis.com/js/core/ Frame 09E6 		595 KB
193 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.490.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
448a333dfdb98768c6308de7aeb073d319ec34bef67636b30fdf97abba0683b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
197951
date
Tue, 30 Nov 2021 23:07:22 GMT
expires
Wed, 30 Nov 2022 23:07:22 GMT
last-modified
Tue, 30 Nov 2021 18:00:51 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
355382
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bridge3.490.0_en.html
imasdk.googleapis.com/js/core/ Frame 860F 		595 KB
193 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.490.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
448a333dfdb98768c6308de7aeb073d319ec34bef67636b30fdf97abba0683b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length
197951
date
Tue, 30 Nov 2021 23:07:22 GMT
expires
Wed, 30 Nov 2022 23:07:22 GMT
last-modified
Tue, 30 Nov 2021 18:00:51 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
355382
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
usync.js
eus.rubiconproject.com/ Frame CDE3 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
952ff494a4f911577bd010f4a1e393e93cb090ce1976f464442cc8aa1ac6b12b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=17367
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9514
Expires
Sun, 05 Dec 2021 06:39:51 GMT
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5e89733d8a8e055100cda68bf7a712ab0e1b24fefee7e39792b47cb5ff7c3cb1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 6D2C 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:42:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
447
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Sun, 05 Dec 2021 02:42:57 GMT
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 8E87 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:42:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
447
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Sun, 05 Dec 2021 02:42:57 GMT
vpaid_25214542.js
vpaid.springserve.com/production/ Frame 5207 		495 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vpaid.springserve.com/production/vpaid_25214542.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:8400:15:6f6c:b180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6b065f38eaed75574515532e2d687fd23450a662a972d044626b848d6e9d1045

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 01:33:13 GMT
content-encoding
br
last-modified
Fri, 19 Nov 2021 18:30:16 GMT
server
AmazonS3
age
519432
etag
W/"185feb14359001049d144410afbeaaa4"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 ee623581f95aa65c7c8707871d87b791.cloudfront.net (CloudFront)
cache-control
max-age=2678400
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
dCf9Qnfi_z8nN7TAiNeO3JpnprXiP-TYD7gJziGzTG_7ZuhSkeD8Zg==
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 7B56 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:42:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
447
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Sun, 05 Dec 2021 02:42:57 GMT
Tweet.html
platform.twitter.com/embed/ Frame 4BD7 		487 B
1001 B 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8095) /
Resource Hash
03b0b4ea7bd75f32536e7c0cad82a35dacd449b1f626ef7ffe06591b210363de

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Age
168
Cache-Control
public, max-age=1800
Content-Type
text/html; charset=utf-8
Date
Sun, 05 Dec 2021 01:50:24 GMT
Etag
"05f259906620f2f7f0a6236a2691bcda"
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (cha/8095)
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
487
Tweet.html
platform.twitter.com/embed/ Frame EF1B 		487 B
1000 B 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/80E1) /
Resource Hash
03b0b4ea7bd75f32536e7c0cad82a35dacd449b1f626ef7ffe06591b210363de

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Age
34
Cache-Control
public, max-age=1800
Content-Type
text/html; charset=utf-8
Date
Sun, 05 Dec 2021 01:50:24 GMT
Etag
"05f259906620f2f7f0a6236a2691bcda"
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (cha/80E1)
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
487
us
capi.connatix.com/core/ Frame 3CCD 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/us?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:23 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
apstag.js
c.amazon-adsystem.com/aax2/ 		134 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.160.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-160-42.ewr53.r.cloudfront.net
Software
Server /
Resource Hash
d8c62b0d4ac621bedd0ca5a4e96b12a77118338d4166f94d65c15bb154d455aa

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
4VmutqpMSKe44XUliQiub0_OOWAXoLbl
content-encoding
gzip
etag
4da12c74ee926b2a11a4e43bfb72b2fd
age
1871
x-cache
Hit from cloudfront
server
Server
x-amz-rid
1AXJK7YK9WCP0270HSY0
date
Sun, 05 Dec 2021 01:19:40 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 29cdae592cbcdf154c4515153175497f.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
UJsfIIRNb7trLfsAnjVCaZISmMrAivq_bhnpoBhoV_uc6H7fqm4waQ==
op.js
tagan.adlightning.com/freestar/ 		58 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/op.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c8092940d0da633c702f549149732cc636a04efd05b0bb72ae1b7a38b4a106aa

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
Imk.hL55kfoqge2j8zj9YIb6TmRX8I0L
content-encoding
gzip
etag
"451770a2c73672eb3c48c10928427abb"
age
492
x-cache
Hit from cloudfront
content-length
24153
x-amz-meta-git_commit
5a99e50
last-modified
Fri, 03 Dec 2021 20:58:55 GMT
server
AmazonS3
date
Sun, 05 Dec 2021 01:42:13 GMT
content-type
application/javascript
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
x-amz-cf-id
xbRCETV65XCbeElXq1CplZQNKB1t9Lhcc7hzxQZqjJccUbtxfXsEUQ==
khaos.jpg
token.rubiconproject.com/ Frame CDE3 		284 B
920 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://token.rubiconproject.com/khaos.jpg?
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
284
X-RPHost
d3682eda7e5cb79782b1d5475f50e8fc
Content-Type
image/jpg
post
tag.escalated.io/ 		21 B
454 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://tag.escalated.io/post
Requested by
Host: tag.escalated.io
URL: https://tag.escalated.io/?i=KxxajmhPPCsT&d=www.bleepingcomputer.com&type=display&cust=5971&sid=direct&c=&cust2=direct
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.14.21.152 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-14-21-152.us-east-2.compute.amazonaws.com
Software
Apache /
Resource Hash
6f4f564d2412b732e0f672f4454c7a03fc8acf3405d7ecf6331ac66f1f6ee2f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
Apache
Vary
Accept-Encoding
Access-Control-Allow-Methods
POST, GET
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-store
Connection
close
Access-Control-Allow-Headers
content-type
Content-Length
41
X-XSS-Protection
1; mode=block
PugMaster
image6.pubmatic.com/AdServer/ Frame 9BAF 		5 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=73582067&p=156592&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
f5e007cd8ff828404cc0e37ef6ac52dab7652109c184da41cc16f112b8e1e47b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:22 GMT
content-type
text/html; charset=UTF-8
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
json
gum.criteo.com/sid/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&lsw=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
strict-transport-security
max-age=31536000
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1784
date
Sun, 05 Dec 2021 01:50:23 GMT
content-encoding
gzip
vary
Accept-Encoding
quant.js
secure.quantserve.com/ 		24 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:61c0:eb61:c438:2f4e , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
487fce51fd801415c362f3f9f2df43c445a4b9ba38f9b6d49dfc898dc85ede94

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:39 GMT
content-encoding
gzip
etag
"FMCWFRCBdbNj8Eh2c0G78Q=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
expires
Sun, 12 Dec 2021 01:50:39 GMT
freestar.js
dggaenaawxe8z.cloudfront.net/ic/audiencesegment/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dggaenaawxe8z.cloudfront.net/ic/audiencesegment/freestar.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.205.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-205-105.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ace5c7a57a33a8c21d81ff1ab27c6e2fb71d14c98f007bc9e990880063a32b42

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 08:07:30 GMT
content-encoding
gzip
last-modified
Mon, 22 Nov 2021 05:51:31 GMT
server
AmazonS3
age
63775
etag
W/"069b7e72e08ae247bc61b83397caaea1"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 5163ef6f21ebac65d5a58243b15e5dbe.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR50-C1
x-amz-cf-id
zPeuck262AiZ8eqwQw5Ri2zf5nYdg07DzdSzPcF9Ypqy-scetMdUuw==
load.js
s.ntv.io/serve/ 		392 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.ntv.io/serve/load.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.163 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-163.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
3e6aee43ce232f5c967d532d699c8dd2366873b4a61a6d6cbebb3606174a4a61

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Encoding
gzip
x-amz-request-id
HBVV9S02R09RAT56
x-amz-server-side-encryption
AES256
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
x-amz-id-2
2z36AkBChaadYludaE81TTVS5JslCWsqWkFVVqfR+zok7oV/y4/5++FKUCJItKTWKm9jomhQSrQ=
Last-Modified
Thu, 02 Dec 2021 15:07:54 GMT
Server
AmazonS3
ETag
"0de0bc397fd51514098ef13d672152b4"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b60f65161ce3517c2794eecab25981c51ffbcbc951a781270403e2f3572d0290

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/svg+xml
sid
mug.criteo.com/
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&lsw=1
  • https://mug.criteo.com/sid?cpp=PeplHHxBWG9KZFZUQ21yYnFyZDQ4a2xheDdya2pIVVF6SXZQN0liL3EvWk5CWDBKa0JiWHBZenBuTmxzUzFEM3VDODBFeGlic1RocC9mWlBRUkNlOWxxa2VTL1E1K1piR21QVjZsQzZMb3pEV09Wc2kwMzlGWmlaTkFYdm...
387 B
632 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=PeplHHxBWG9KZFZUQ21yYnFyZDQ4a2xheDdya2pIVVF6SXZQN0liL3EvWk5CWDBKa0JiWHBZenBuTmxzUzFEM3VDODBFeGlic1RocC9mWlBRUkNlOWxxa2VTL1E1K1piR21QVjZsQzZMb3pEV09Wc2kwMzlGWmlaTkFYdm5uU0hMSllKdDQ3NlhVZ3I5V0xGYmp5V3lPeTZ1YnVrYnBKMml0c1BjVHJwTWhCZmYvK3YrMFU3SUlYb1czNFB1RTBLTUs5NThaMzQ2a2s4Wkw1Qi9hWWNyS3drb1ZEa3pyNVN5cGtuZTJxQ3RQZHNpRGZESi81V3VreDFrMExEcW45b0F0ZXEvfA&cppv=2
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
cecddc842a97425d7e3f179c4312564acc05c3c06357b31e1b10e42ec2cfb469
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
date
Sun, 05 Dec 2021 01:50:24 GMT
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
2754
expires
0

Redirect headers

pragma
no-cache
strict-transport-security
max-age=31536000
date
Sun, 05 Dec 2021 01:50:23 GMT
location
https://mug.criteo.com/sid?cpp=PeplHHxBWG9KZFZUQ21yYnFyZDQ4a2xheDdya2pIVVF6SXZQN0liL3EvWk5CWDBKa0JiWHBZenBuTmxzUzFEM3VDODBFeGlic1RocC9mWlBRUkNlOWxxa2VTL1E1K1piR21QVjZsQzZMb3pEV09Wc2kwMzlGWmlaTkFYdm5uU0hMSllKdDQ3NlhVZ3I5V0xGYmp5V3lPeTZ1YnVrYnBKMml0c1BjVHJwTWhCZmYvK3YrMFU3SUlYb1czNFB1RTBLTUs5NThaMzQ2a2s4Wkw1Qi9hWWNyS3drb1ZEa3pyNVN5cGtuZTJxQ3RQZHNpRGZESi81V3VreDFrMExEcW45b0F0ZXEvfA&cppv=2
access-control-allow-methods
GET
content-type
text/html; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1914
content-length
509
expires
0
prebid
ib.adnxs.com/ut/v3/ 		138 B
828 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
37ec84bbddcd7f889bfb1f8c28cad5311c6fe78bb5679d9586d8f37ebb312983
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:24 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
914eeddc-8ca1-4c2b-ae30-885d0f70bdca
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
138
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cygnus
htlb.casalemedia.com/ 		36 B
336 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=393562&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2230d0079f6aa825%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%224.42.1%22%2C%22userIds%22%3A%5B%22pubcid%22%5D%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%22412%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2244fd1ab38f8c3a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%225fe9e4b789f719%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.199.204.79 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-199-204-79.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ad5179d4701c1063d3e4a4bc6bbafdf044d87a2cfc173296b2f602009858212f

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
x-ak-initial-geo
CC:[CA], RC:[QC], CN:[NA], CIP:[37.120.205.180], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
x-cs-client-geo
19
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
36
x-ak-client-geo
19
expires
Sun, 05 Dec 2021 01:50:24 GMT
auction
tlx.3lift.com/header/ 		19 B
270 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=4.42.1&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tmax=1200
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.224.175.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-175-57.compute-1.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
prebid
ib.adnxs.com/ut/v3/ 		19 B
708 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:24 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
1c1ed749-83c4-4d84-9886-7972157c9711
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ 		0
122 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:23 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
hbjson
grid.bidswitch.net/ 		2 B
318 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://grid.bidswitch.net/hbjson
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.211.165.199 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
199.165.211.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Server
nginx
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
2
hb
ssc.33across.com/api/v1/ 		118 B
342 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ssc.33across.com/api/v1/hb?guid=dPGcAuqZ0r6Ok4aKlId8sQ
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
76.20.149.34.bc.googleusercontent.com
Software
/ 33Across
Resource Hash
e246d0ac54efd560be566168845070b764c03b307099961a626a7f65614e5efc

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
arj
freestar-d.openx.net/w/1.0/ 		174 B
598 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=aaadbb5d-5af0-48c9-ac2d-0309955ede3a&nocache=1638669024350&pubcid=23ab3b00-8d24-4048-bf37-b882fba90a8f&schain=1.0%2C1!freestar.com%2C412%2C1%2C%2C%2C&aus=728x90%2C970x90&divids=bleepingcomputer_970x90_728x90_320x50_sticky&aucs=%252F15184186%252Fbleepingcomputer_970x90_728x90_320x50_sticky%252Fbleepingcomputer_970x90_728x90_320x50_sticky&auid=540959250
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
a7e921e799d9b82a18e0d41aae0898f911d917899fe7bed4865dcadba0649fca

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
164
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
341 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707c7680952&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
68bb3cbd1ae3ee1da75a097f778ede2b79079634ca983b42977a7277cd567298

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
547 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a969d1301787836013037fa80ed00db&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
d0f65b99494d15cd4f8aaa6e7d7d6904145e6295446f83ce909d562a5565f34a

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
prebid
prebid.media.net/rtb/ 		13 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
139.148.107.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
7647ad7d85bb73f5df6a939db40fad7cd0ad32054f0eaaddf4e0a3d17c909eb0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
content-encoding
gzip
server
nginx
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
v1
dmx.districtm.io/b/ 		0
340 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
origin, Accept-Encoding
access-control-allow-methods
OPTIONS, POST
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6b899f9a7e00ca4f-YUL
access-control-allow-headers
origin, content-type
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
120 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:24 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:24 GMT
access-control-allow-credentials
true
vary
Origin
prebid
ads.yieldmo.com/exchange/ 		0
231 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.yieldmo.com/exchange/prebid?pbav=4.42.1&p=%5B%7B%22placement_id%22%3A%22bleepingcomputer_970x90_728x90_320x50_sticky%22%2C%22callback_id%22%3A%22326fe795daef669%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%5D&page_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&bust=1638669024357&pr=&scrd=1&dnt=false&description=The%20Emotet%20malware%20was%20considered%20the%20most%20widely%20spread%20malware%20in%20the%20past%2C%20using%20spam%20campaigns%20and%20malicious%20attachments%20to%20distribute%20the%20malware.&title=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&w=1600&h=1200&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%7D&us_privacy=&pubcid=23ab3b00-8d24-4048-bf37-b882fba90a8f&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%22412%22%2C%22hp%22%3A1%7D%5D%7D
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.226.174.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-226-174-129.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
access-control-allow-credentials
true
x-robots-tag
none,NOINDEX,NOFOLLOW
access-control-allow-methods
POST, GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma
fastlane.json
fastlane.rubiconproject.com/a/api/ 		753 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55&rp_schain=1.0,1!freestar.com,412,1,,,&eid_pubcid.org=23ab3b00-8d24-4048-bf37-b882fba90a8f%5E1&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-9%2CIAB19-10&tg_i.sectioncat=IAB19-9%2CIAB19-10&tg_i.pagecat=IAB19-9%2CIAB19-10&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tg_i.fs_ad_product=stickyFooter&tg_i.dfp_ad_unit_code=15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky&tg_i.pbadslot=15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%2Fbleepingcomputer_970x90_728x90_320x50_sticky&tk_flint=pbjs_lite_v4.42.1&x_source.tid=aaadbb5d-5af0-48c9-ac2d-0309955ede3a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8228140899343721
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c002:200::41 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
b100e4ba08c53b0a7aaa749fdaf83ff4ceeefd054ee1273b13c6d19102923a76

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:24 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
753
Expires
Wed, 17 Sep 1975 21:32:10 GMT
embed.runtime.73157d07ac400de4c606.js
platform.twitter.com/embed/ Frame 4BD7 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8197) /
Resource Hash
655e1b1c2df2d432818e7b88a43034255279b0b75d20a08cbca8ff6ccbf85330

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/8197)
Age
187996
Etag
"3a95da679725b97563da931fc8fd306d+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
3523
embed.modules.66e311263622456867b1.js
platform.twitter.com/embed/ Frame 4BD7 		519 KB
163 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.modules.66e311263622456867b1.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81E1) /
Resource Hash
8e60f604f0ca5f472149b3e3a02c184ae1082ad59b54ce7eb26c1b6ff51ccfc4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81E1)
Age
187996
Etag
"d2a7d4d81994376470f2560f453ad37b+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
166772
embed.i18n.c052951fae9a0c2b4020.js
platform.twitter.com/embed/ Frame 4BD7 		146 B
651 B 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.i18n.c052951fae9a0c2b4020.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81DE) /
Resource Hash
9863c7532e26b3e9a2e1ac1d7ee7d96bc03db512a2af9174aa5c1d07046376cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Access-Control-Allow-Methods
GET
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81DE)
Age
187996
Etag
"ae3db27722181e85d0a069a920b4ed89"
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
Content-Length
146
embed.Tweet.c4f48f6a1a0886631005.js
platform.twitter.com/embed/ Frame 4BD7 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.Tweet.c4f48f6a1a0886631005.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8195) /
Resource Hash
d9473dc254914f26f7000bc3eacc42988538946d23e38b6a98f7648f22e13378

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/8195)
Age
187996
Etag
"d9dd9adbd164ddf67c4413784c471ff5+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
5739
us
capi.connatix.com/core/ Frame CDE3
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=19564_2
  • https://ck.connatix.com/cks?pid=11&uid=KWSL87CK-1M-EIIR
  • https://capi.connatix.com/core/us?DemandPartner=11&DemandPartnerUserId=KWSL87CK-1M-EIIR&UserId=
0
156 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://capi.connatix.com/core/us?DemandPartner=11&DemandPartnerUserId=KWSL87CK-1M-EIIR&UserId=
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0

Redirect headers

date
Sun, 05 Dec 2021 01:50:24 GMT
location
https://capi.connatix.com/core/us?DemandPartner=11&DemandPartnerUserId=KWSL87CK-1M-EIIR&UserId=
access-control-max-age
86400
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
accept-ranges
bytes
content-length
0
retry-after
0
embed.runtime.73157d07ac400de4c606.js
platform.twitter.com/embed/ Frame EF1B 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8197) /
Resource Hash
655e1b1c2df2d432818e7b88a43034255279b0b75d20a08cbca8ff6ccbf85330

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/8197)
Age
187996
Etag
"3a95da679725b97563da931fc8fd306d+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
3523
embed.modules.66e311263622456867b1.js
platform.twitter.com/embed/ Frame EF1B 		519 KB
163 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.modules.66e311263622456867b1.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8094) /
Resource Hash
8e60f604f0ca5f472149b3e3a02c184ae1082ad59b54ce7eb26c1b6ff51ccfc4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/8094)
Age
187995
Etag
"d2a7d4d81994376470f2560f453ad37b+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
166772
embed.i18n.c052951fae9a0c2b4020.js
platform.twitter.com/embed/ Frame EF1B 		146 B
651 B 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.i18n.c052951fae9a0c2b4020.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81DE) /
Resource Hash
9863c7532e26b3e9a2e1ac1d7ee7d96bc03db512a2af9174aa5c1d07046376cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Access-Control-Allow-Methods
GET
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81DE)
Age
187996
Etag
"ae3db27722181e85d0a069a920b4ed89"
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
Content-Length
146
embed.Tweet.c4f48f6a1a0886631005.js
platform.twitter.com/embed/ Frame EF1B 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.Tweet.c4f48f6a1a0886631005.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8195) /
Resource Hash
d9473dc254914f26f7000bc3eacc42988538946d23e38b6a98f7648f22e13378

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/8195)
Age
187996
Etag
"d9dd9adbd164ddf67c4413784c471ff5+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
5739
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1445063
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
Z6DP2y9rdpPXey-t0z98VBYWBENd89jbSJrQGI29fT9P5JlKMtLdtw==
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102981
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
8gsZF7gfs0RxxvIDJDlFNlF0IG4HjOHwdUIAhbsjyJ0lqVHDYRLmPw==
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
92e649098eefaf82db65282d7cbb4e65c738aca33c3fc8073a9c770fbcb0623d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/webp
prebid
ib.adnxs.com/ut/v3/ Frame 5207 		160 B
850 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
6bb2fb707e140928d063074922d43052eb0e71cfb0b792b5335e7615c6f6c846
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:24 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
404f5743-6248-4c2e-80d1-25e94e73d344
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
160
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame 5207 		0
66 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:22 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
openrtb
ads.adaptv.advertising.com/rtb/ Frame 5207 		0
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.81.191.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-81-191-231.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
openrtb
ads.adaptv.advertising.com/rtb/ Frame 5207 		0
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.81.191.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-81-191-231.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
sync
ups.analytics.yahoo.com/ups/57304/ Frame 5207
Redirect Chain
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true
  • https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&verify=true
  • https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
  • https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VVBiNmI0Yzg5OS01NTZkLTExZWMtOWYwOS0wZTk4Y2U1MzBlMzc%3D
  • https://pixel.advertising.com/ups/57304/sync?uid=CAESEO01pAcaofDSUIFp0YjhlV8&google_cver=1
  • https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEO01pAcaofDSUIFp0YjhlV8&google_cver=1&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEO01pAcaofDSUIFp0YjhlV8&google_cver=1&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
3.218.90.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-218-90-66.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEO01pAcaofDSUIFp0YjhlV8&google_cver=1&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
date
Sun, 05 Dec 2021 01:50:25 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
m7y5t93k
sync-tm.everesttech.net/ct/upi/pid/ Frame 5207
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
  • https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_...
85 B
161 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=Yawa4AAJjkWJWwBR
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
151.101.2.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
via
1.1 varnish
server
Jetty(9.4.35.v20201120)
age
2184
x-served-by
cache-yul12826-YUL
x-cache
HIT
content-type
image/png
cache-control
no-cache
accept-ranges
bytes
x-timer
S1638669025.677777,VS0,VE0
content-length
85
x-cache-hits
36211

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
via
1.1 varnish
server
Jetty(9.4.35.v20201120)
x-timer
S1638669025.619327,VS0,VE14
x-served-by
cache-yul12826-YUL
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=Yawa4AAJjkWJWwBR
cache-control
no-cache
accept-ranges
bytes
access-control-allow-origin
*
content-length
0
x-cache-hits
0
sync
ups.analytics.yahoo.com/ups/55953/ Frame 5207
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&_origin=1&gdpr=0&gdpr_consent=
0
477 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55953/sync?uid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&_origin=1&gdpr=0&gdpr_consent=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
3.218.90.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-218-90-66.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ups.analytics.yahoo.com/ups/55953/sync?uid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&_origin=1&gdpr=0&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
267
pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
a.pub.network/core/pubfig/ 		182 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50a427a86edd270a769be6b028c0513a241e39b623e44774b9fa7ad4aeb6b084

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=wLSKRQ==, md5=Idua+ByzLTp8zzRhkdYDlA==
date
Sun, 05 Dec 2021 01:50:24 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
363513
x-guploader-uploadid
ADPycduhmtYH3FUx7LqvrdsYBzin6415otMowGE46Y5BiA5RCzgyspkZwtitWe0tF-ETYB-J4zbLIbWdv2bFDFYhLvw5XK3Tyw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Thu, 18 Nov 2021 17:40:17 GMT
server
cloudflare
etag
W/"21db9af81cb32d3a7ccf346191d60394"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kgQVLkTjQYF0yT2ng5d%2FKWthdhbcIrIxeGDmqi015gTyU8KbnPnE2w1dsrA4YJsJwlLQYjOH0DltynZOCOG454VEwLYe1M7tCVHYkFwDgSS7aeWwEnDkD8Hwc9J%2BVUOhZ1IYy461p%2BA3%2BKc%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1637257217859608
access-control-expose-headers
*
cache-control
public, max-age=3600
x-goog-stored-content-length
186040
cf-ray
6b899f9b9c2b7138-YUL
expires
Tue, 30 Nov 2021 21:45:13 GMT
548bdb63b969e5c27f75e62faf543d70.js
www.gstatic.com/mysidia/ Frame 6789 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/548bdb63b969e5c27f75e62faf543d70.js?tag=client_fast_engine_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
541a22e85f3238899f2589d44b9390a8d6d6e193a5d436c10e8ec9ce7b256e76
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 03:42:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
338875
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3286
x-xss-protection
0
last-modified
Tue, 16 Nov 2021 04:29:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="mysidia"
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Tue, 01 Mar 2022 03:42:29 GMT
css
fonts.googleapis.com/ Frame 6789 		8 KB
714 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C500%2C700
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sun, 05 Dec 2021 01:41:03 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sun, 05 Dec 2021 01:50:24 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 05 Dec 2021 01:50:24 GMT
match
c1.adform.net/serving/cookie/ Frame 90E1
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&cid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
35 B
468 B 		Document
General
Check archive.org
Download Go to
Full URL
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.167.164.39 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
expires
-1
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
strict-transport-security
max-age=31536000; includeSubDomains

Redirect headers

server
nginx
date
Sun, 05 Dec 2021 01:50:24 GMT
content-length
0
location
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
expires
-1
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
strict-transport-security
max-age=31536000; includeSubDomains
Pug
simage2.pubmatic.com/AdServer/ Frame 512C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Yawa4AAJpMVYSwBG&gdpr=0&gdpr_consent=&_test=Yawa4AAJpMVYSwBG
1 B
547 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Yawa4AAJpMVYSwBG&gdpr=0&gdpr_consent=&_test=Yawa4AAJpMVYSwBG
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
text/html; charset=utf-8
content-length
1
x-lat
njrpug007:0:560
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

server
Varnish
retry-after
0
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Yawa4AAJpMVYSwBG&gdpr=0&gdpr_consent=&_test=Yawa4AAJpMVYSwBG
accept-ranges
bytes
date
Sun, 05 Dec 2021 01:50:24 GMT
via
1.1 varnish
x-served-by
cache-yul12826-YUL
x-cache
HIT
x-cache-hits
0
x-timer
S1638669025.655111,VS0,VE0
cache-control
no-cache
pragma
no-cache
content-length
0
adx
match.prod.bidr.io/cookie-sync/ Frame 327F
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEUlBVN0RXRFlBQUMxdFJTczFzQQ&bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&...
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
43 B
430 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.166.81.178 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-166-81-178.compute-1.amazonaws.com
Software
nginx /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

cache-control
no-cache, must-revalidate
content-type
image/gif
Date
Sun, 05 Dec 2021 01:50:24 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma
no-cache
Server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
Content-Length
43
Connection
keep-alive

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Cpp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
date
Sun, 05 Dec 2021 01:50:24 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
content-length
361
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
usersync.aspx
dis.criteo.com/dis/ Frame 444B 		43 B
334 B 		Document
General
Check archive.org
Download Go to
Full URL
https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
image/gif
server
Kestrel
cache-control
no-cache
pragma
no-cache
expires
Sun, 05 Dec 2021 00:00:00 GMT
x-errorlevel
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
286978
141
match.deepintent.com/usersync/ Frame 3FE9 		0
222 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
g.deepintent.com
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

p3p
policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
content-type
image/gif
content-length
0
date
Sun, 05 Dec 2021 01:50:24 GMT
server
b
Pug
simage2.pubmatic.com/AdServer/ Frame 2A71
Redirect Chain
  • https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
  • https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=b6b28f1a-556d-11ec-a2e0-2e68efb6964a
42 B
223 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=b6b28f1a-556d-11ec-a2e0-2e68efb6964a
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug009:0:663
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Type
image/gif
Content-Length
0
Connection
keep-alive
server
Cowboy
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=b6b28f1a-556d-11ec-a2e0-2e68efb6964a
X-RealServer-NX
lga-delivery-8
Cache-Control
no-cache, no-store, must-revalidate, proxy-revalidate
Pragma
no-cache
Expires
Thu, 23 Sep 2004 17:42:04 GMT
P3P
CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin
*
Pug
simage2.pubmatic.com/AdServer/ Frame 2E74
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=11
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=xswp1o64ToFOAZv37ofaZSV4zbQ
42 B
218 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=xswp1o64ToFOAZv37ofaZSV4zbQ
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug001:0:513
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Content-Type
text/html; charset=utf-8
Date
Sun, 05 Dec 2021 01:50:24 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=xswp1o64ToFOAZv37ofaZSV4zbQ
Content-Length
159
Connection
keep-alive
i.match
s.tribalfusion.com/z/ Frame FF17
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...
43 B
411 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:c05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
image/gif; charset=utf-8
content-length
43
p3p
CP="NOI DEVo TAIa OUR BUS"
x-function
302
cache-control
no-cache private
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6b899f9cc9a9ca57-YUL
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
text/html
location
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p
CP="NOI DEVo TAIa OUR BUS"
x-function
206
x-reuse-index
344
cache-control
no-cache private
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6b899f9c08f4ca57-YUL
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
Pug
simage2.pubmatic.com/AdServer/ Frame 24AE
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:DyLVqr8t1MTGFy5&gdpr=0&gdpr_consent=
42 B
212 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:DyLVqr8t1MTGFy5&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug012:0:568
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Cache-Control
no-cache, must-revalidate
Date
Sun, 05 Dec 2021 01:50:24 GMT
Expires
Fri, 01 Jan 1990 00:00:00 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:DyLVqr8t1MTGFy5&gdpr=0&gdpr_consent=
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Pragma
no-cache
Server
PingMatch/v2.0.30-691-gbabbd08#rel-ec2-master i-0c4ee88f294942f85@us-east-1d@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
Content-Length
0
Connection
keep-alive
usersync
match.bnmla.com/ Frame 755F 		0
114 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.bnmla.com/usersync?sspid=10738&redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw%26piggybackCookie%3D%5BUUID%5D
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
38.27.122.101 , United States, ASN174 (COGENT-174, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Length
0
Connection
keep-alive
Pug
simage2.pubmatic.com/AdServer/ Frame 6B5D
Redirect Chain
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=368769996
  • https://sync.1rx.io/usersync/tradedesk/0a060ae1-17dc-465b-b9b3-37e0e67725c6
  • https://sync.targeting.unrulymedia.com/csync/RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005
42 B
229 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug015:0:737
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Server
Tengine
Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005
ETag
RXdcbd78ba409c4a89959fd5740b5432ce005
Pug
simage2.pubmatic.com/AdServer/ Frame 858F
Redirect Chain
  • https://ums.acuityplatform.com/tum?umid=6
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=627776628284
42 B
224 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=627776628284
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug010:0:494
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Content-Length
0
Access-Control-Allow-Origin
*
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=627776628284
Pug
image2.pubmatic.com/AdServer/ Frame 8B98
Redirect Chain
  • https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=3e303838-ca53-42df-8019-95c7b3b85253
1 B
272 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=3e303838-ca53-42df-8019-95c7b3b85253
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
text/html; charset=utf-8
content-length
1
x-lat
va1pug011:0:987
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

date
Sun, 05 Dec 2021 01:50:24 GMT
content-length
0
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=3e303838-ca53-42df-8019-95c7b3b85253
expires
Thu, 01 Jan 1970 00:00:00 GMT
strict-transport-security
max-age=15724800; includeSubDomains
Pug
simage2.pubmatic.com/AdServer/ Frame FA02
Redirect Chain
  • https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ6919554241026313953&uid=Q691955424102631...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6919554241026313953
42 B
235 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6919554241026313953
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:50:24 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
njrpug018:0:561
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Server
Apache/2.2.15 (CentOS)
Content-Length
154
Content-Type
text/html
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q6919554241026313953
X-Powered-By
PHP/5.3.3
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Vary
Accept-Encoding
Cache-Control
max-age=60253
Date
Sun, 05 Dec 2021 01:50:24 GMT
Connection
keep-alive
us
capi.connatix.com/core/ Frame 7212 		0
156 B 		Document
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/us?DemandPartner=2&UserId=38868d4c88eb47018e4265d2b8cd3a09&DemandPartnerName=Pubmatic&DemandPartnerUserId=6B5103A8-1986-4A80-BC68-1BDBA8628E47
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

access-control-allow-credentials
true
date
Sun, 05 Dec 2021 01:50:24 GMT
server
Kestrel
Content-Length
0
Connection
keep-alive
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 9BAF
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=a1EDqBmGSoC8aBvbqGKORw%3D%3D
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
content-encoding
gzip
last-modified
Tue, 15 Jun 2021 06:08:03 GMT
server
Apache/2.2.15 (CentOS)
etag
"1300708-3945-5c4c7cc02bd56"
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=65955
accept-ranges
bytes
content-type
text/html; charset=UTF-8
content-length
5054
expires
Sun, 05 Dec 2021 20:09:39 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
272
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
458249.gif
idsync.rlcdn.com/ Frame 9BAF
Redirect Chain
  • https://idsync.rlcdn.com/420486.gif?partner_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
  • https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJDZCNTEwM0E4LTE5ODYtNEE4MC1CQzY4LTFCREJBODYyOEU0NxAAGg0I4LWwjQYSBQjoBxAAQgBKAA
  • https://pippio.com/api/sync?pid=5324&it=1&iv=d77e6eafd0ef7466a040c54e7bef15b485c1c6b2b5a5735392e63cbea5b1ac5e791426b5417dce21&_=2
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBkNzdlNmVhZmQwZWY3NDY2YTA0MGM1NGU3YmVmMTViNDg1YzFjNmIyYjVhNTczNTM5MmU2M2NiZWE1YjFhYzVlNzkxNDI2YjU...
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBkNzdlNmVhZmQwZWY3NDY2YTA0MGM1NGU3YmVmMTViNDg1YzFjNmIyYjVhNTczNTM5MmU2M2NiZWE1YjFhYzVlNzkxNDI2YjU0MTdkY2UyMRAAGgwI4bWwjQYSBAgCEABCAEoA&goog...
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
  • https://idsync.rlcdn.com/458249.gif?partner_uid=44c7da8c-5e50-4546-92e6-57ef95acf025
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/458249.gif?partner_uid=44c7da8c-5e50-4546-92e6-57ef95acf025
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:25 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

location
https://idsync.rlcdn.com/458249.gif?partner_uid=44c7da8c-5e50-4546-92e6-57ef95acf025
date
Sun, 05 Dec 2021 01:50:25 GMT
via
1.1 google
x-samesite
secure
alt-svc
clear
content-length
111
content-type
text/html; charset=utf-8
SPug
image4.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=7aed61ac-1ae0-4800-b82d-f5c0a29185e4
0
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=7aed61ac-1ae0-4800-b82d-f5c0a29185e4
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:23 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Server
MT3 4133 baa842e master iad-pixel-x28 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=7aed61ac-1ae0-4800-b82d-f5c0a29185e4
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:50:23 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NkI1MTAzQTgtMTk4Ni00QTgwLUJDNjgtMUJEQkE4NjI4RTQ3&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
340 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
cache-control
no-store, no-cache, private
x-lat
va1pug005:0:407
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDEgAIYuA8A0YTTZ8reLelQ&google_cver=1
42 B
360 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDEgAIYuA8A0YTTZ8reLelQ&google_cver=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
cache-control
no-store, no-cache, private
x-lat
va1pug001:0:466
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDEgAIYuA8A0YTTZ8reLelQ&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:C65D11E4B81E46FF927733811942FFDC
42 B
381 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:C65D11E4B81E46FF927733811942FFDC
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
cache-control
no-store, no-cache, private
x-lat
va1pug012:0:1210
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date
Sun, 05 Dec 2021 01:50:24 GMT
x-content-type-options
nosniff
server
nginx
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:C65D11E4B81E46FF927733811942FFDC
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
138
expires
Sat, 04 Dec 2021 01:50:24 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2848199581176410271&gdpr=0&gdpr_consent=&us_privacy=
1 B
323 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2848199581176410271&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:24:01 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug023:0:641
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2848199581176410271&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Pug
simage2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=0a060ae1-17dc-465b-b9b3-37e0e67725c6
42 B
293 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=0a060ae1-17dc-465b-b9b3-37e0e67725c6
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug015:0:539
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=0a060ae1-17dc-465b-b9b3-37e0e67725c6
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
313
Pug
simage2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:473961ac-1ae0-4c00-8c08-33debe008775&gdpr=0&gdpr_consent=
42 B
339 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:473961ac-1ae0-4c00-8c08-33debe008775&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug029:0:359
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Server
MT3 4133 baa842e master iad-pixel-x2 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:473961ac-1ae0-4c00-8c08-33debe008775&gdpr=0&gdpr_consent=
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:50:23 GMT
SPug
image4.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&redir=true&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-6UNyri9E2uVLoBNwqFyP_nXB11yT4jM-~A&gdpr=0&gdpr_consent=
0
128 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-6UNyri9E2uVLoBNwqFyP_nXB11yT4jM-~A&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-6UNyri9E2uVLoBNwqFyP_nXB11yT4jM-~A&gdpr=0&gdpr_consent=
date
Sun, 05 Dec 2021 01:50:24 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
6B5103A8-1986-4A80-BC68-1BDBA8628E47
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 9BAF 		43 B
870 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/pubmatic/6B5103A8-1986-4A80-BC68-1BDBA8628E47?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a02:1f9d:78fd:b4f5:2185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
Pug
image2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA%3D%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7205020425431634120&gdpr=0&gdpr_consent=
42 B
284 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7205020425431634120&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
cache-control
no-store, no-cache, private
x-lat
10:0:731
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:25 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
b746080e-a9a7-4d5c-914c-1f3b411f13d8
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7205020425431634120&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=0&gdpr_consent=
  • https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=630fc92bcdff122d&is_secure=true&networkId=17100&version=1&nuid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGdRmaSRjYIgNw_dHNAAAAAAA&expiration=1638755425&nuid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&...
42 B
285 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGdRmaSRjYIgNw_dHNAAAAAAA&expiration=1638755425&nuid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&is_secure=true&gdpr_consent=&gdpr=0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug001:0:490
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:25 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGdRmaSRjYIgNw_dHNAAAAAAA&expiration=1638755425&nuid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&is_secure=true&gdpr_consent=&gdpr=0
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 9BAF 		0
88 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.215.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-215-106.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
0
Content-Type
text/plain
Pug
simage2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=b6d19fed-556d-11ec-9a2f-0ff9f1b4f0e7&gdpr=0&gdpr_consent=
1 B
372 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=b6d19fed-556d-11ec-9a2f-0ff9f1b4f0e7&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:07:36 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug028:0:419
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=b6d19fed-556d-11ec-9a2f-0ff9f1b4f0e7&gdpr=0&gdpr_consent=
Date
Sun, 05 Dec 2021 01:50:24 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
Content-Length
0
X-CI-RTID
b6d19fee-556d-11ec-9a2f-0ff9f1b4f0e7
sn.ashx
pmp.mxptint.net/ Frame 9BAF
Redirect Chain
  • https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R1D531_E7995223_281F66E4D&r=https://pmp.mxptint.net/sn.ashx?ak=1
  • https://pmp.mxptint.net/sn.ashx?ak=1
43 B
266 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pmp.mxptint.net/sn.ashx?ak=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
HTTP/1.1
Server
38.67.14.233 , United States, ASN174 (COGENT-174, US),
Reverse DNS
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Strict-Transport-Security max-age=-321655825; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:25 GMT
Cache-Control
no-cache
Expires
-1
Content-Length
43
Strict-Transport-Security
max-age=-321655825; includeSubDomains
Content-Type
image/gif

Redirect headers

location
https://pmp.mxptint.net/sn.ashx?ak=1
date
Sun, 05 Dec 2021 01:50:25 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug003:0:669
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Pug
image2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&gdpr=0&gdpr_consent=
42 B
311 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
cache-control
no-store, no-cache, private
x-lat
va1pug012:0:931
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:25 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=D4eL2AjXj4oUhN2DDYfHgg3T34wU14-PANUUCyfc
42 B
467 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=D4eL2AjXj4oUhN2DDYfHgg3T34wU14-PANUUCyfc
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 22:46:51 GMT
cache-control
no-store, no-cache, private
x-lat
va2pug001:0:445
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:25 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=D4eL2AjXj4oUhN2DDYfHgg3T34wU14-PANUUCyfc
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=0&gdpr_consent=&gdpr_pd=
  • https://x.bidswitch.net/sync?dsp_id=413&ssp=pubmatic&user_id=csonata_7cbb47e2-9baa-4929-abd4-16d57c47f86d&bsw_param=91fae357-6d96-49d0-85ee-50af585ffd28&expires=10
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=&gdpr_consent=&gdpr_pd=
1 B
483 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:12:26 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug030:0:385
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
//simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=&gdpr_consent=&gdpr_pd=
Date
Sun, 05 Dec 2021 01:50:25 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Pug
simage2.pubmatic.com/AdServer/ Frame 9BAF
Redirect Chain
  • https://sync.resetdigital.co:10001/csync/pubmatic
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=0000008DA3C2A7C6
42 B
209 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=0000008DA3C2A7C6
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug019:0:839
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Sun, 05 Dec 2021 01:50:27 GMT
Server
nginx/1.18.0 (Ubuntu)
Front-End-Https
on
Content-Type
text/html
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=0000008DA3C2A7C6
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
config
c.amazon-adsystem.com/cdn/prod/ 		662 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com&pubid=0ab198dd-b265-462a-ae36-74e163ad6159
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.160.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-160-42.ewr53.r.cloudfront.net
Software
Server /
Resource Hash
a20ccaf6978bd71c43456b6bc78288abdc57c3b6fa987eecb2e9f59b69d384e1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 22:19:16 GMT
via
1.1 29cdae592cbcdf154c4515153175497f.cloudfront.net (CloudFront)
server
Server
age
12667
x-cache
Hit from cloudfront
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
x-amz-cf-pop
EWR53-C3
content-length
662
x-amz-cf-id
ciM2QUAcW036s-snbgFBCDme-QfsljlNn3awAQ8EbRSxPa3v5-QnjA==
bid
c.amazon-adsystem.com/e/dtb/ 		182 B
659 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&pid=gNew1BSHbHVSY&cb=0&ws=1600x1200&v=7.71.1&t=1000&slots=%5B%7B%22sd%22%3A%22bleepingcomputer_970x90_728x90_320x50_sticky%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%5D&schain=1.0%2C1!freestar.com%2C412%2C1%2C%2C%2C&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.160.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-160-42.ewr53.r.cloudfront.net
Software
Server /
Resource Hash
df888bff9ec6e7f70b4e273ccbbcc1adb8dd8b4c725ae2860ca434f51ff36bbf
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
via
1.1 29cdae592cbcdf154c4515153175497f.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
EWR53-C3
x-amz-rid
EEK0CSHM4GSE5SVV792X
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
182
x-amz-cf-id
KCkR8LixW9Au0kZq-yFPACbqWs_xgWYoXXZBEJp2rhAnYbsdZFYVpQ==
bid
c.amazon-adsystem.com/e/dtb/ 		182 B
657 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&pid=gNew1BSHbHVSY&cb=1&ws=1600x1200&v=7.71.1&t=1000&slots=%5B%7B%22sd%22%3A%22bleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_728x90_320x50_InContent_1%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_2%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_3%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%5D&schain=1.0%2C1!freestar.com%2C412%2C1%2C%2C%2C&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.160.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-160-42.ewr53.r.cloudfront.net
Software
Server /
Resource Hash
8569f8a54b841f9b5cbfbf1f340a1c29ee63e52b2fbf042d1b54bd9f5bcbbb07
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
via
1.1 29cdae592cbcdf154c4515153175497f.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
EWR53-C3
x-amz-rid
44H1SJYZP0BBDFS7X8EJ
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
182
x-amz-cf-id
D3w7R0V9guwQeGYnhq1HVfxAwic0-WCkFQFAr2T0c_7DswkNHCmswg==
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.160.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-160-42.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 10:52:09 GMT
content-encoding
gzip
vary
Accept-Encoding,Origin
age
53896
x-cache
Hit from cloudfront
access-control-allow-origin
*
last-modified
Tue, 09 Nov 2021 22:55:20 GMT
server
AmazonS3
etag
W/"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
gYbY2ORQY5Qmsyt0ob0SiGH6tjIhuo4B
via
1.1 48242c037992a87d34be1f3c114efc0a.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
EWR53-C3
content-type
application/javascript
x-amz-cf-id
3NpIKSZXWNDemWQSg5DhNyFs7z2kV_X2YB2G00TYXdttuZA90ijwSg==
sid
mug.criteo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=PeplHHxBWG9KZFZUQ21yYnFyZDQ4a2xheDdya2pIVVF6SXZQN0liL3EvWk5CWDBKa0JiWHBZenBuTmxzUzFEM3VDODBFeGlic1RocC9mWlBRUkNlOWxxa2VTL1E1K1piR21QVjZsQzZMb3pEV09Wc2kwMzlGWmlaTkFYdm5uU0hMSllKdDQ3NlhVZ3I5V0xGYmp5V3lPeTZ1YnVrYnBKMml0c1BjVHJwTWhCZmYvK3YrMFU3SUlYb1czNFB1RTBLTUs5NThaMzQ2a2s4Wkw1Qi9hWWNyS3drb1ZEa3pyNVN5cGtuZTJxQ3RQZHNpRGZESi81V3VreDFrMExEcW45b0F0ZXEvfA&cppv=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
null
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
strict-transport-security
max-age=31536000
access-control-allow-origin
null
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1067
date
Sun, 05 Dec 2021 01:50:24 GMT
content-encoding
gzip
vary
Accept-Encoding
pixel
cm.g.doubleclick.net/ Frame CDE3
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dTTDg3Q0stMU0tRUlJUg==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dTTDg3Q0stMU0tRUlJUg==
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dTTDg3Q0stMU0tRUlJUg==
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
382e2818ca015d35b02cd449aa60881d
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame CDE3
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/aNhLELx_CQCDPbWMrlc408n5EUdSAgOZEtemQ7w0kco?csrc=
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6939458453206114118
42 B
677 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6939458453206114118
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
d5a7ef20801cf5cb1ee516b6110e672f
Content-Type
image/gif

Redirect headers

date
Sun, 05 Dec 2021 01:50:25 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6939458453206114118
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
tap.php
pixel.rubiconproject.com/ Frame CDE3
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=17d961ac-1ae0-4000-b6db-9706d9b036cb
42 B
677 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=17d961ac-1ae0-4000-b6db-9706d9b036cb
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
e1bddfc34a927e97bda010c0d8a62b62
Content-Type
image/gif

Redirect headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Server
MT3 4133 baa842e master iad-pixel-x14 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=17d961ac-1ae0-4000-b6db-9706d9b036cb
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:50:23 GMT
709414.gif
id.rlcdn.com/ Frame CDE3 		42 B
297 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/709414.gif
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:24 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
tap.php
pixel.rubiconproject.com/ Frame CDE3
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D
  • https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=Yawa4AAJpMVYSwBG
42 B
677 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=Yawa4AAJpMVYSwBG
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
9a0c641c0479142b55591fdf2031b15f
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
via
1.1 varnish
server
Varnish
x-timer
S1638669025.654688,VS0,VE0
x-served-by
cache-yul12826-YUL
x-cache
HIT
location
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=Yawa4AAJpMVYSwBG
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
tap.php
pixel.rubiconproject.com/ Frame CDE3
Redirect Chain
  • https://match.adsrvr.org/track/cmf/rubicon
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=0a060ae1-17dc-465b-b9b3-37e0e67725c6&gdpr=0&gdpr_consent=&expires=30
42 B
677 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=0a060ae1-17dc-465b-b9b3-37e0e67725c6&gdpr=0&gdpr_consent=&expires=30
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
29af2665c43893332e84c235bac366c1
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=0a060ae1-17dc-465b-b9b3-37e0e67725c6&gdpr=0&gdpr_consent=&expires=30
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
289
pixel
cm.g.doubleclick.net/ Frame CDE3
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTNhMmQ4YzVhZGNlM2Y4MDc2MWQxOTFkYzczMDQ4MzFlNWZjMDQ0Mw
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTNhMmQ4YzVhZGNlM2Y4MDc2MWQxOTFkYzczMDQ4MzFlNWZjMDQ0Mw
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:25 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTNhMmQ4YzVhZGNlM2Y4MDc2MWQxOTFkYzczMDQ4MzFlNWZjMDQ0Mw
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
19c1ac3b9706c83a73951eba4d239689
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame CDE3
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEI31rRsvbfY4PRISMi0T5J4&google_cver=1
42 B
677 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEI31rRsvbfY4PRISMi0T5J4&google_cver=1
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
78008fe701b681dce86a72fc23cacc40
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEI31rRsvbfY4PRISMi0T5J4&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
326
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 6789 		1 KB
880 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:37:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
801
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
853
x-xss-protection
0
server
cafe
etag
7170004918125193417
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:37:03 GMT
b11ca96b96753a896831283c9f885acc.js
www.gstatic.com/mysidia/ Frame 6789 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/b11ca96b96753a896831283c9f885acc.js?tag=exit_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4beda28dcae03d0a09cf69fca1ebf4479111dd8479ac6657815888be6841a194
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 06:20:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
156618
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8028
x-xss-protection
0
last-modified
Tue, 16 Nov 2021 04:29:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="mysidia"
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Thu, 03 Mar 2022 06:20:06 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 6789 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
615050cfd7cd77d6941c6c0b4551d20c4d5ad825bc9fd7acc61a0bdca7783d26
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:40:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
570
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7857
x-xss-protection
0
server
cafe
etag
2255741555227857113
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:40:54 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 6789 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:47:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
183
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:47:21 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 6789 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:50:25 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 6789 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:49:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
71
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6446
x-xss-protection
0
server
cafe
etag
5472324691301332805
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:49:13 GMT
womptv2nm.js
cdn.krxd.net/controltag/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/controltag/womptv2nm.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e1023fc5b7b2cb762dd4ad14fcf4787fa945fca4a37518cd0d6b411c248dc201

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-cdn-backend
4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date
Sun, 05 Dec 2021 01:50:24 GMT
via
1.1 varnish, 1.1 varnish
age
222
x-cache
MISS, HIT, HIT
x-app-cache
HIT
x-age
0
content-encoding
gzip
content-length
3716
x-served-by
config-service-a005-ash-prod.krxd.net, cache-bwi5155-BWI, cache-yul12829-YUL
x-response-time
1
x-do-esi
esi
x-timer
S1638669025.722919,VS0,VE0
etag
"fa213313d0f749c73627133b4ab4942a6489b2c7"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
public, max-age=1200
accept-ranges
bytes
x-cache-hits
0, 4, 198
logs
uat5-a.investingchannel.com/ 		0
454 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://uat5-a.investingchannel.com/logs?gdprapplicable=false&uspstatus=NOT_APPLICABLE
Requested by
Host: dggaenaawxe8z.cloudfront.net
URL: https://dggaenaawxe8z.cloudfront.net/ic/audiencesegment/freestar.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.20.92.17 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-20-92-17.compute-1.amazonaws.com
Software
Jetty(9.4.12.v20180830) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
server
Jetty(9.4.12.v20180830)
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
logs
uat5-a.investingchannel.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://uat5-a.investingchannel.com/logs?gdprapplicable=false&uspstatus=NOT_APPLICABLE
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.20.92.17 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-20-92-17.compute-1.amazonaws.com
Software
Jetty(9.4.12.v20180830) /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:50:24 GMT
content-length
0
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers Accept-Encoding, User-Agent
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-methods
POST
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-max-age
1800
allow
GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
server
Jetty(9.4.12.v20180830)
t
jadserve.postrelease.com/ 		288 B
759 B 		Script
General
Check archive.org
Download Go to
Full URL
https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ntv_mvi
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.124.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-146-124-230.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
4937adcc7dcaf8896352bc39065f7bdf60cb876095f04609ff1eac0befb0d05e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:24 GMT
content-encoding
gzip
server
nginx/1.12.1
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
text/javascript;charset=UTF-8
content-length
232
expires
Mon, 1 Jan 1990 12:00:00 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/18440255559143235926/ Frame 6789 		54 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/18440255559143235926/downsize_200k_v1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e8a0f1b344943369c2c5be278754a85602e3c7688fc857e3edf715c3be2771f1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 19:39:47 GMT
x-content-type-options
nosniff
age
454237
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
55722
x-xss-protection
0
last-modified
Tue, 13 Apr 2021 19:55:07 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Tue, 29 Nov 2022 19:39:47 GMT
15993820937207506906
tpc.googlesyndication.com/icore_images/ Frame 6789 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/icore_images/15993820937207506906
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5cbd8dc729043efb7fe66a51d9d5eda549dec7321059f03f3be5665d1e9ea027
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 23:14:13 GMT
x-content-type-options
nosniff
age
95771
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9182
x-xss-protection
0
last-modified
Mon, 31 Jul 2017 18:26:56 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 03 Dec 2022 23:14:13 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/3603385802686940598/ Frame 6789 		55 KB
55 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/3603385802686940598/downsize_200k_v1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bfb080d58f027d962eaaa9d437e72faab804291483f4b40c29c9aa0aaeca72bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 05:56:33 GMT
x-content-type-options
nosniff
age
158031
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
55999
x-xss-protection
0
last-modified
Wed, 24 Nov 2021 22:14:48 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 03 Dec 2022 05:56:33 GMT
8157428483862788059
tpc.googlesyndication.com/icore_images/ Frame 6789 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/icore_images/8157428483862788059
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0c0248c11ea32b5473ed1e5e23797342cb05f360f3078eab3231fae6f550e036
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 04:52:55 GMT
x-content-type-options
nosniff
age
334649
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12594
x-xss-protection
0
last-modified
Wed, 11 Aug 2021 07:36:08 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Thu, 01 Dec 2022 04:52:55 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/14316058307346410540/ Frame 6789 		71 KB
71 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/14316058307346410540/downsize_200k_v1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c3f1108df7bbfe540c77dbde63875debd023b17b9fdcee9a9e44e4cf7c1d3b3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 01:16:01 GMT
x-content-type-options
nosniff
age
174863
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
72626
x-xss-protection
0
last-modified
Tue, 23 Nov 2021 00:07:21 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 03 Dec 2022 01:16:01 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/8163445682332296060/ Frame 6789 		71 KB
71 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/8163445682332296060/downsize_200k_v1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e281529d43f5a8f2615392f7092ce45b34c2baa407ad74be49485438f0be0c5e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:33:19 GMT
x-content-type-options
nosniff
age
101825
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
72991
x-xss-protection
0
last-modified
Thu, 24 Sep 2020 04:49:04 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 03 Dec 2022 21:33:19 GMT
3669418499724479651
tpc.googlesyndication.com/icore_images/ Frame 6789 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/icore_images/3669418499724479651
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2d74ea00c0e8d18b22d73aa5ec7a393f1c14490f5a202f59c7ab7d0be7044e23
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 23:15:32 GMT
x-content-type-options
nosniff
age
9292
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13336
x-xss-protection
0
last-modified
Wed, 13 Oct 2021 01:52:14 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sun, 04 Dec 2022 23:15:32 GMT
1242355791437087463
tpc.googlesyndication.com/icore_images/ Frame 6789 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/icore_images/1242355791437087463
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1bfc2c2ee9af9b35c72c475c8c25d1004f5b43e34b2da6bfd4d99798afe12c9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 19:05:48 GMT
x-content-type-options
nosniff
age
283476
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13982
x-xss-protection
0
last-modified
Thu, 14 Oct 2021 03:01:34 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Thu, 01 Dec 2022 19:05:48 GMT
pubcid.min.js
secure.cdn.fastclick.net/js/pubcid/latest/ 		53 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.5.238.78 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-5-238-78.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
content-encoding
gzip
last-modified
Tue, 01 Jun 2021 17:06:57 GMT
server
Apache
etag
"d398-5c3b75e9ebb41-gzip"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=900
accept-ranges
bytes
content-length
17087
expires
Sun, 05 Dec 2021 02:05:25 GMT
id5-api.js
cdn.id5-sync.com/api/1.0/ 		35 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/id5-api.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.202.126 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
eb6883bc39782219d9eb3868c4e21acbdf949cc1a13bd35fb86bcb447488a977
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
br
x-cacheable
Matched cache
x-cdn-pop-ip
137.74.122.0/26
date
Sun, 05 Dec 2021 01:22:10 GMT
content-type
text/javascript;charset=utf-8
cache-control
max-age=3600
x-cdn-pop
bhs
content-disposition
attachment;filename="id5-api.js"
accept-ranges
bytes
content-length
10053
x-request-id
352750782
embed.vendors~ondemand.horizon-web.en-js.b7421551ee3ebed56e9a.js
platform.twitter.com/embed/ Frame 4BD7 		29 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.horizon-web.en-js.b7421551ee3ebed56e9a.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81FC) /
Resource Hash
95c423bf8171e23d66d1b74a7f5bd90ad1806e8a3bea717280f9d71577389230

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81FC)
Age
187996
Etag
"243d823d043564092099acd4323c5b02+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
9316
embed.ondemand.i18n.en-js.803ee907f212c9d5c2a8.js
platform.twitter.com/embed/ Frame 4BD7 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.ondemand.i18n.en-js.803ee907f212c9d5c2a8.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81E1) /
Resource Hash
c39f38776508cc2a307bc5b09b86446fb7ed06e2d0e77f0ba25639ed35cab1cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:24 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81E1)
Age
187996
Etag
"6c690ed926a46ac53582571243a1209b+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
1789
embed.vendors~ondemand.horizon-web.en-js.b7421551ee3ebed56e9a.js
platform.twitter.com/embed/ Frame EF1B 		29 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.horizon-web.en-js.b7421551ee3ebed56e9a.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81FC) /
Resource Hash
95c423bf8171e23d66d1b74a7f5bd90ad1806e8a3bea717280f9d71577389230

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81FC)
Age
187997
Etag
"243d823d043564092099acd4323c5b02+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
9316
embed.ondemand.i18n.en-js.803ee907f212c9d5c2a8.js
platform.twitter.com/embed/ Frame EF1B 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.ondemand.i18n.en-js.803ee907f212c9d5c2a8.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81E1) /
Resource Hash
c39f38776508cc2a307bc5b09b86446fb7ed06e2d0e77f0ba25639ed35cab1cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81E1)
Age
187997
Etag
"6c690ed926a46ac53582571243a1209b+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
1789
prebid
ib.adnxs.com/ut/v3/ 		19 B
863 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:25 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
cbf61855-b16e-40ac-94fc-bb860b6e2167
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
hbjson
grid.bidswitch.net/ 		2 B
318 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://grid.bidswitch.net/hbjson
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.211.165.199 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
199.165.211.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sun, 05 Dec 2021 01:50:25 GMT
Server
nginx
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
2
cygnus
htlb.casalemedia.com/ 		37 B
337 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=393562&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22532f80d9c86b34c%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A5%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A5%2C%22ren%22%3Afalse%2C%22version%22%3A%224.42.1%22%2C%22userIds%22%3A%5B%22pubcid%22%5D%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%22412%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%225474139db2cae11%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2255e0e19b76e5e5b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2256ecfadcf01120e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%225740905499162a5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2258e474c2903c39b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22591ceb85701e826%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22609c703cc9de0ec%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2261e8134cd1116a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2262eca7953189be4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2263bcb7237007f1e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2264606e0460fd34%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.199.204.79 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-199-204-79.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
6e5968ac1dd065886764d838eb95108a423e152ce9ee903e3553e4525fb5901b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:25 GMT
x-ak-initial-geo
CC:[CA], RC:[QC], CN:[NA], CIP:[37.120.205.180], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
x-cs-client-geo
19
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
37
x-ak-client-geo
19
expires
Sun, 05 Dec 2021 01:50:25 GMT
auction
tlx.3lift.com/header/ 		29 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=4.42.1&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tmax=1200
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.224.175.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-175-57.compute-1.amazonaws.com
Software
/
Resource Hash
46e8439d0cff6acd4b246b26b7ccd4b668f5bf35aff26ea33d01f0bc953e7ceb
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:25 GMT
content-encoding
gzip
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
6996
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
/
hb.emxdgt.com/ 		0
165 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.emxdgt.com/?t=1200&ts=1638669025062&src=pbjs
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.205.221.238 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-205-221-238.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:25 GMT
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
security, Content-Type
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707c7680952&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
05230fa1f83647d43dcb7632b136c71e49ae04f6d86a9e26563eef6de18ee9ee

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
364 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194700601d06e7&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
587d41f06f7469a073f09bc77ffbd126d4882cdb3c35cd7449e1d3d7110e83f8

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a969d1301787836013037fa80ed00db&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
4d395f336edc3e775494ded7d2713c96dca83a9cc84bbab7c031aad36023cb67

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707c7680952&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
4ea3b3d39eee99715c64650cf694bcca527eae19db309bdcbf8dc8cbeac5bdf9

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707caca0954&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
791717086abb6ea94a5e97b7dc8b2e63924f8350f075a137fae1e5c4226c28ce

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a969412017474441319470061cb06e8&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
ecaa9d4a3ef5a8cd47ec2bf3747762739543591a34bf62360368df99e4b9e918

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707caca0954&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e7aa6af87d3cd8f6339d05ce2327c7471f626ac2473c5cf06e5f76a3c9376ce6

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a969412017474441319470061cb06e8&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
92e21e86224e0c6c3a68d26a25667d910b4190567dcf634074b318314b2c82f0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707c7680952&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
be86a52f2acab160a1cf798efc6518336779f05b415d03478ea6e2fc2fa98a29

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194700601d06e7&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
2f4b66e4051d9fed10569b3fbc24f652d2d464beebfbf1a4d4f291b10f20401c

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a969d1301787836013037fa80ed00db&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
17ae37864657a8edd224972d360c9ebe2c3d10fb9933e168526070ef4829f9da

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
prebid
prebid.media.net/rtb/ 		82 KB
14 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
139.148.107.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
5a15ddc370c3422a67623432e8fc11183f35ab4dfda84740f3e1d221cec5bbdd

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:25 GMT
content-encoding
gzip
server
nginx
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
v1
dmx.districtm.io/b/ 		0
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
origin, Accept-Encoding
access-control-allow-methods
OPTIONS, POST
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6b899f9eca15ca4f-YUL
access-control-allow-headers
origin, content-type
fastlane.json
fastlane.rubiconproject.com/a/api/ 		1 KB
985 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2%3B2%3B15%3B15%3B2&alt_size_ids=55%2C57%3B%3B10%3B10%3B55%2C57&rp_schain=1.0,1!freestar.com,412,1,,,&eid_pubcid.org=23ab3b00-8d24-4048-bf37-b882fba90a8f%5E1&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-9%2CIAB19-10&tg_i.sectioncat=IAB19-9%2CIAB19-10&tg_i.pagecat=IAB19-9%2CIAB19-10&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tg_i.fs_ad_product=banner&tg_i.dfp_ad_unit_code=15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%3B15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%3B15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%3B15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%3B15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF&tg_i.pbadslot=15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%3B15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%2Fbleepingcomputer_728x90_320x50_InContent_1%3B15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%3B15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%3B15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF&tk_flint=pbjs_lite_v4.42.1&x_source.tid=b5203fe1-2007-461d-835d-17122abfefd0%3Bb5101387-c90d-4d5d-abf6-6429057d6775%3Bd57a675f-e9b4-413f-9244-e949eec5899d%3Bf57a9c6f-28d1-4907-ab2d-7ef30e35baeb%3B4d098272-0931-43df-8557-29771fa4cd68&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=5&rand=0.4151736705344906
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c002:200::41 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
d9795324d204a94340a892e55fcdbf8f830614148f2be33435bbaea3aac66695

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:25 GMT
Content-Encoding
gzip
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
496
Expires
Wed, 17 Sep 1975 21:32:10 GMT
prebid
ib.adnxs.com/ut/v3/ 		19 B
863 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:25 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
0b84d4ca-1067-48db-9c2c-0187c8444120
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
prebid
ads.yieldmo.com/exchange/ 		7 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.yieldmo.com/exchange/prebid?pbav=4.42.1&p=%5B%7B%22placement_id%22%3A%22bleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%2C%22callback_id%22%3A%22123ca4d6c908e3a2%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%2C%5B970%2C250%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%2C%7B%22placement_id%22%3A%22bleepingcomputer_728x90_320x50_InContent_1%22%2C%22callback_id%22%3A%22124e3ab3a51cdb8f%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%2C%7B%22placement_id%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_2%22%2C%22callback_id%22%3A%221256f5ee68d7149%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%2C%7B%22placement_id%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_3%22%2C%22callback_id%22%3A%22126736d91ff30168%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%2C%7B%22placement_id%22%3A%22bleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%2C%22callback_id%22%3A%22127be34b9440f806%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%2C%5B970%2C250%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%5D&page_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&bust=1638669025072&pr=&scrd=1&dnt=false&description=The%20Emotet%20malware%20was%20considered%20the%20most%20widely%20spread%20malware%20in%20the%20past%2C%20using%20spam%20campaigns%20and%20malicious%20attachments%20to%20distribute%20the%20malware.&title=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&w=1600&h=1200&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%7D&us_privacy=&pubcid=23ab3b00-8d24-4048-bf37-b882fba90a8f&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%22412%22%2C%22hp%22%3A1%7D%5D%7D
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.226.174.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-226-174-129.compute-1.amazonaws.com
Software
/
Resource Hash
7f3b6990b1bdb2d2341d8b2be3dbd4496fb2d853834f4ff403bee2923f107184

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:25 GMT
content-encoding
gzip
vary
accept-encoding
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
access-control-request-headers
Cache-Control, Pragma
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:25 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:25 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:25 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:25 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:25 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:25 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:25 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:25 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:25 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:25 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:25 GMT
access-control-allow-credentials
true
vary
Origin
arj
freestar-d.openx.net/w/1.0/ 		175 B
187 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=b5203fe1-2007-461d-835d-17122abfefd0%2Cb5101387-c90d-4d5d-abf6-6429057d6775%2Cd57a675f-e9b4-413f-9244-e949eec5899d%2Cf57a9c6f-28d1-4907-ab2d-7ef30e35baeb%2C4d098272-0931-43df-8557-29771fa4cd68&nocache=1638669025077&pubcid=23ab3b00-8d24-4048-bf37-b882fba90a8f&schain=1.0%2C1!freestar.com%2C412%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250%7C728x90%7C300x250%2C300x600%7C300x250%2C300x600%7C728x90%2C970x90%2C970x250&divids=bleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_300x250_300x600_160x600_Right_3%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF&aucs=%252F15184186%252Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%252Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2C%252F15184186%252Fbleepingcomputer_728x90_320x50_InContent_1%252Fbleepingcomputer_728x90_320x50_InContent_1%2C%252F15184186%252Fbleepingcomputer_300x250_300x600_160x600_Right_2%252Fbleepingcomputer_300x250_300x600_160x600_Right_2%2C%252F15184186%252Fbleepingcomputer_300x250_300x600_160x600_Right_3%252Fbleepingcomputer_300x250_300x600_160x600_Right_3%2C%252F15184186%252Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%252Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF&auid=540959250%2C540959250%2C540959250%2C540959250%2C540959250
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
d7038bb26a1de77b35dbf2b30731cc0fb12223262581356d8823c62509357c86

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:25 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
164
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
translator
hbopenbid.pubmatic.com/ 		142 KB
40 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
973cb6ccf3daaa415a40fc466276a835fb7b61c1f5225bf01da320f8be395996

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:24 GMT
content-encoding
gzip
x-openrtb-version
2.3
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
application/json
ads
securepubads.g.doubleclick.net/gampad/ 		42 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=376184159304027&correlator=930032852318362&output=ldjh&impl=fifs&eid=31060438%2C31063889%2C44748553&vrg=2021120201&ptt=17&sc=1&sfv=1-0-38&ecs=20211205&iu_parts=15184186%2Cbleepingcomputer_970x90_728x90_320x50_sticky&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90&prev_scp=fsrefresh%3D0%26fsrebid%3D0%26floors_id%3D65983f%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_970x90_728x90_320x50_sticky%26fs_ad_product%3DstickyFooter%26amznbid%3D2%26amznp%3D2%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dmedianet_728x90%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.00%26hb_adid%3D1586c5be54bccc69%26hb_bidder%3Dmedianet&eri=1&cust_params=user-agent%3DChrome%26section%3Dnews&cookie=ID%3De3d418217285c23d-2293398380ce0073%3AT%3D1638669023%3ART%3D1638669023%3AS%3DALNI_MZCmNLdy2a59hplq6e41XAGeMLYUw&bc=31&abxe=1&lmt=1637072838&dt=1638669025156&dlt=1638669022742&idt=1080&frm=20&biw=1600&bih=1200&oid=2&adxs=436&adys=1110&adks=3056404191&ucis=1&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x-1&msz=1600x-1&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=true&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js?31063889
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
33051e81a7a7411895e690a3dac013f80d48abc32fb3d11c4386225a29b700e6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10525
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E6CA 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js?31063889
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Sun, 05 Dec 2021 01:50:25 GMT
expires
Mon, 05 Dec 2022 01:50:25 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads.adaptv.advertising.com/a/h/ Frame 5207 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669023986&gdpr=&gdpr_consent=&us_privacy=&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=[scpid]&hp=[hp]&eov=eov&pi.width=640&pi.height=480
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.81.191.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-81-191-231.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
15bd4e840e8331b9bb7ce0b92976dea62e54431f2a2e5f5b29092e519d5fac97
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
server
adaptv/1.0
content-type
text/xml
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
952
expires
0
adview
googleads.g.doubleclick.net/pagead/ Frame 6789 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=ClaxZ3xqsYfbdI5OrowbEj76ID-6S36Zi_aLg_tcNwI23ARABIMeD_AEoCGD96KKB8AOgAc6B_9MDyAEGqQII5sE4KCCqPqgDAcgDAqoEqgJP0EZSsvCvQH9ppKKFTcvIfxZQVxx0v7EnITWSoVQzxa5e5ny0gBrM0I0pHq16i87LA2uuplFdWPAog7rLjm5QEhy2zAyDy9IiMQcvW-uqn1M9Q20_-zQw1dtUH7dFnEfRydsfqouaxC6Tn5YjDUWhSfZqf3uZsQjUYxujKDcSKU0hxqasgknjHdXVoy2AZ68kc26OxuluGQT1zy5DFWYKUBgtD7N1WQ0cpHNs7EUgPNYWM9ZuIlIwWZLy_xVZ9hdDKDXu_GXEShqf3R1KDkqjcRRA0svnVi9Rx2ZTcxeyiBilnUvEWeT2TUCR99U3fj6RHpKMOakn2nYUxWHgbyg47Bjp-QaeF-0_iZ1dAi8T64zHDCeIlCMd6_-x2F6l7W6ZzFM9oBJi-0z5wASG9fnkvQOSBQQIBBgBkgUECAUYBKAGN4AHmv6ALKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEOzEHtIIBwiAYRABGB-ACgHICwHCEwYYzoH_0wPYEw3QFQGYFgGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=_SEHaHHT64U&uach_m=[UACH]&template_id=492
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:50:25 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 6789 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CoKIJ3xqsYfbdI5OrowbEj76ID6XVnbEFjdzCup8Cpp6tjWsQAiDHg_wBKAhg_eiigfADyAEBqAMByAMCqgTrAU_QrKY6ybbzRnBh1OoU3tM0EUxbF2O1sC0yL4u0U2nDsx0_Et4CKP-Qiy1WQkvWfL4ac6noDgEVqHDar9DFaUweF6HGDYnYyDskAHVd9unTUjUbcHX_InzTzF4evAONU5HY0wTzg4-FNJOBhG8WU6FC5CR2N5u0QZh_GuwvOxw4TSPF4quRF6cLyYyvJ4AkvDk_NZPVrXkAD_nQY-xjSBpSoq_lsSxdXoHOnZwHnpnLPRWi0MLUs7WxkSoI41o2F0OZw-18Z8S_7Jzd3Ur7vKJxFEInPeRWL1MykFBxF7J97qedS8S7Fyiv-6fABKXAy4o0kgUECBoYBKAGRcAGC4AH5ffiNagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEOzEHtIIBwiAYRABGB-ACgHICwHQFQGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=3Z9bXYJ0ZqU&uach_m=[UACH]
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:50:25 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 6789 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CyS7G3xqsYfbdI5OrowbEj76ID5Hl5dxmkKH3q-kOv-iivcABEAMgx4P8ASgIYP3oooHwA6AB6azS8APIAQaoAwHIAwKqBKkCT9B2ZxfptHlG2he76k3LkTMYWVcJbbi4Iy03j6RVItLyE-p-Yzsc89uKZVOoemEVpwZ3rqJSFE3wcIO6ksJgWRIJr8sFh8fQPzQGPky355NRfwJmLf9obMPdQhisWJERm8HZBLuaw4QinoSAMBoN5VOoJXx5kfdE22lS_D8wBTVIKcuhpcgN_hqLmq42mmy-fShxhoqwaAIO_cYjWE7J8FDZrwt6v64oBseAnAf9mdY9hKQ4hcO13bJJKAjjWvYXB5nDbXxlxL_snB3dSvu8oHEWQic95FYvUTKQUnEXsn3upp1Lxq4S9U1AkQIjNX8-kf50WV7g6xaRkvdWbqjtMOwYqSOWtzx_fe33whDZQdqeYTCLJL8BHefrX4A-rHJeu8xdKypaV4rqwATSydnM6QOSBQQIBBgBkgUECAUYBKAGN4AH_9KtD6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEOzEHtIIBwiAYRABGB-ACgHICwHCEwYY6azS8APYEw3QFQGYFgGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=A_vADFWY33k&uach_m=[UACH]&template_id=492
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:50:25 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 6789 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CGZXi3xqsYfbdI5OrowbEj76ID6XVnbEFjdzCup8Cpp6tjWsQBCDHg_wBKAhg_eiigfADyAEBqAMByAMCqgTrAU_QrKY8ybbzRnBh1OoU3tM0EUxbF2O1sC0yL4u0U2nDsx0_Et4CKP-Qiy1WQkvWfL4ac6noDgEVqHDar9DFaUweF6HGDYnYyDskAHVd9unTUjUbcHX_InzTzF4evAONU5HY0wTzg4-FNJOBhG8WU6FC5CR2N5u0QZh_GuwvOxw4TSPF4quRF6cLyYyvJ4AkvDk_NZPVrXkAD_nQY-xjSBpSoq_lsSxdXoHOnZwHnpnLPRWi0MLUs7WxkSoI41o2F0OZw-18Z8S_7Jzd3Ur7vKJxFEInPeRWL1MykFBxF7J97qedS8S7Fyiv-6fABKXAy4o0kgUECBoYBKAGRcAGC4AH5ffiNagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEOzEHtIIBwiAYRABGB-ACgHICwHQFQGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=1Hk2tUFzLfQ&uach_m=[UACH]
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:50:25 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 6789 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=Cgys03xqsYfbdI5OrowbEj76ID_Dh3fBm6e6LvoUPue7wyKoBEAUgx4P8ASgIYP3oooHwA6AB34mLgAPIAQapAgjmwTgoIKo-qAMByAMCqgSxAk_QD0E_6bJ5RtoXu-pNy5EzGFlXCW24uCMtN4-kVSLS8hPqfmM7HPPbimVTqHphFacGd66iUhRN8HCDupLCYFkSCa_LBYfH0D80Bj5Mt-eTUX8CZi3_aGzD3UIYrFiREZvB2QS7msOEIp6EgDAaDeVTqCV8eZH3RNtpUvw_MAU1SCnLoaXIDf4ai5quNppsvn0ocYaKsGgCDv3GI1hOyfBQua-9abubtITkmteCr1Em1hYZ0m4iITNZksj4CFkuFbZvwO18ITFJb5zd3b8Nv2BxFLfRPuRUL6TEk1BxF0eL76adSzFYEfVNQmT0IDR_PmQdc4qzVnvyl_NCdtjxZTEMH2gKGJ757bMTTZ6CLbco-oC72D-d7eBJHb10i19mfLfUv84acrUa_u21CUUKYPhEwATNut3p2QOSBQQIBBgBkgUECAUYBKAGN4AHifb0f6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEOzEHtIIBwiAYRABGB-ACgHICwHCEwYY34mLgAPYEwzQFQGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=Sexk1XRG2vw&uach_m=[UACH]&template_id=492
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:50:25 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 6789 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=Crvrz3xqsYfbdI5OrowbEj76ID5Xc6ZFe3ciclfYLv-EeEAYgx4P8ASgIYP3oooHwA6ABpqTizAPIAQapAlEB18fweqc-qAMByAMCqgSqAk_QHhqD869Hf2mkooVNy8h_FlBXHHS_sSchNZKhVDPFrl7mfLSAGszQjSkerXqLzssDa66mUV1Y8CiDusuOblASHLbMDIPL0iIxBy9b66qfUz1DbT_7NDDV21Qft0WcR9HJ2x-qi5rELpOfliMNRaFJ9mp_e5mxCNRjG6MoNxIpTSHGpqyCSeMd1dWjLYBnryRzbo7G6W4ZBPXPLkMVZnJTGG0Pt3VZUkPjFnbsRSA81hYz1m4iUjBZkvL_FVn2F0MoNe78ZcRKGp_dHUoOSqNxFEDSy-dWL1HHZlNzF7KIGKWdS8RZ5PZNQJH31Td-PpEekowJ8m7FdhTFYeBvKDjZSjeGBp4X7X3n4EcML1_l1MUHJ7qXIx3r_7GeAebWY5nMUz2gWl2db_HABNPkxLmOA5IFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAY3gAfC250zqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQ7MQe0ggHCIBhEAEYH4AKAcgLAcITBhimpOLMA9gTDYgUA9AVAYAXAbIXHAoaCAASFHB1Yi0wOTIwODk5MzAwMzk3ODIzGAA&sigh=caNtxWDJTRk&uach_m=[UACH]&template_id=492
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:50:25 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 6789 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CSXwm3xqsYfbdI5OrowbEj76ID6XVnbEFjdzCup8Cpp6tjWsQByDHg_wBKAhg_eiigfADyAEBqAMByAMCqgTrAU_QrKY_ybbzRnBh1OoU3tM0EUxbF2O1sC0yL4u0U2nDsx0_Et4CKP-Qiy1WQkvWfL4ac6noDgEVqHDar9DFaUweF6HGDYnYyDskAHVd9unTUjUbcHX_InzTzF4evAONU5HY0wTzg4-FNJOBhG8WU6FC5CR2N5u0QZh_GuwvOxw4TSPF4quRF6cLyYyvJ4AkvDk_NZPVrXkAD_nQY-xjSBpSoq_lsSxdXoHOnZwHnpnLPRWi0MLUs7WxkSoI41o2F0OZw-18Z8S_7Jzd3Ur7vKJxFEInPeRWL1MykFBxF7J97qedS8S7Fyiv-6fABKXAy4o0kgUECBoYBKAGRcAGC4AH5ffiNagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEOzEHtIIBwiAYRABGB-ACgHICwHQFQGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=wWvy--x1EYg&uach_m=[UACH]
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:50:25 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
adview
googleads.g.doubleclick.net/pagead/ Frame 6789 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CZ6Eg3xqsYfbdI5OrowbEj76ID6XVnbEFjdzCup8Cpp6tjWsQCCDHg_wBKAhg_eiigfADyAEBqAMByAMCqgTrAU_QrKYwybbzRnBh1OoU3tM0EUxbF2O1sC0yL4u0U2nDsx0_Et4CKP-Qiy1WQkvWfL4ac6noDgEVqHDar9DFaUweF6HGDYnYyDskAHVd9unTUjUbcHX_InzTzF4evAONU5HY0wTzg4-FNJOBhG8WU6FC5CR2N5u0QZh_GuwvOxw4TSPF4quRF6cLyYyvJ4AkvDk_NZPVrXkAD_nQY-xjSBpSoq_lsSxdXoHOnZwHnpnLPRWi0MLUs7WxkSoI41o2F0OZw-18Z8S_7Jzd3Ur7vKJxFEInPeRWL1MykFBxF7J97qedS8S7Fyiv-6fABKXAy4o0kgUECBoYBKAGRcAGC4AH5ffiNagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEOzEHtIIBwiAYRABGB-ACgHICwHQFQGAFwGyFxwKGggAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxgA&sigh=x6ZQbWSW_3M&uach_m=[UACH]
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1637072838&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&flash=0&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638669023212&bpp=5&bdt=470&idt=291&shv=r20211201&mjsv=m202111170101&ptt=9&saldr=aa&abxe=1&correlator=7337172799486&frm=20&pv=2&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4024&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063824%2C44748553&oid=2&pvsid=376184159304027&pem=71&tmod=373207473&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=YyhEAzhLID&p=https%3A//www.bleepingcomputer.com&dtd=312
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Sun, 05 Dec 2021 01:50:25 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
c
c.pub.network/ 		36 B
328 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
830b8ca5f78f00f8a0d79813f2ba95b0a7efd1ee7536567b5c25219323f3209b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
iu3
s.amazon-adsystem.com/ Frame ABF6
Redirect Chain
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t
304 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
cf26bdbf5ff75c910f2127a46e8d6feb959eeb10eaa979e58112dd0bc0f8a16e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Server
Server
Date
Sun, 05 Dec 2021 01:50:25 GMT
Content-Type
text/html;charset=ISO-8859-1
Content-Length
304
Connection
keep-alive
x-amz-rid
6YHQPCTSP230EF8N091R
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()

Redirect headers

Server
Server
Date
Sun, 05 Dec 2021 01:50:25 GMT
Content-Length
0
Connection
keep-alive
x-amz-rid
M8MXHKTPQME03ZSWKKGN
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()
o2shim
acds.prod.vidible.tv/ Frame 38B2 		15 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=0ae1c91a-6d9d-433e-b513-fd08330d91a4&pblob=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.222.130.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-222-130-154.compute-1.amazonaws.com
Software
/
Resource Hash
ffabd3e0e054bec572a1df233ad9636fe9b70ba9af31bda68270edfbfb2ed4b2

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
content-encoding
gzip
access-control-max-age
3600
access-control-allow-methods
POST, GET, HEAD, PUT, PATCH, DELETE
content-type
application/javascript
access-control-allow-origin
*
access-control-allow-headers
content-length
6639
reactive_library_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111170101/ 		149 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111170101/reactive_library_fy2019.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111170101/show_ads_impl_fy2019.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6df1827608a96dd3fa744c7761b93b60e29466be2e5b5f2180f4c92ffe4fd823
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54303
x-xss-protection
0
server
cafe
etag
11462445750197226460
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Sun, 05 Dec 2021 01:50:25 GMT
controltag.js.a1705c5ac5f06cf0c202ff70908fc042
cdn.krxd.net/ctjs/ 		259 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/womptv2nm.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-cdn-backend
4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date
Sun, 05 Dec 2021 01:50:25 GMT
content-encoding
gzip
age
10762335
x-amz-server-side-encryption
AES256
x-cache
HIT
x-cache-hits
10886778
content-length
84509
x-served-by
cache-yul12829-YUL
last-modified
Mon, 02 Aug 2021 12:06:17 GMT
x-timer
S1638669026.563629,VS0,VE0
etag
"a1705c5ac5f06cf0c202ff70908fc042"
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=315360000
accept-ranges
bytes
expires
Thu, 31 Jul 2031 12:06:16 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		143 KB
36 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=376184159304027&correlator=930032852318362&output=ldjh&impl=fifs&eid=31060438%2C31063889%2C44748553&vrg=2021120201&ptt=17&sc=1&sfv=1-0-38&ecs=20211205&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_300x250_300x600_160x600_Right_3%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_1x1&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6&prev_iu_szs=728x90%7C970x90%7C970x250%2C728x90%2C300x250%7C300x600%2C300x250%7C300x600%2C728x90%7C970x90%7C970x250%2C1x1&ists=1&prev_scp=fsrefresh%3D0%26fsrebid%3D0%26floors_id%3D332193%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_728x90_970x90_970x250_320x50_ATF%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%26fsbid%3D0%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dpubmatic_970x250%26hb_format%3Dbanner%26hb_size%3D970x250%26hb_pb%3D0.66%26hb_adid%3D1690d4e9aa6a65ec%26hb_bidder%3Dpubmatic%7Cfsrefresh%3D0%26fsrebid%3D0%26floors_id%3D332193%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_728x90_320x50_InContent_1%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%26fsbid%3D0%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dpubmatic_728x90%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.21%26hb_adid%3D1712f788e6fdac4e%26hb_bidder%3Dpubmatic%7Cfsrefresh%3D0%26fsrebid%3D0%26floors_id%3D332193%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_300x250_300x600_160x600_Right_2%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%26fsbid%3D0%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dpubmatic_300x600%26hb_format%3Dbanner%26hb_size%3D300x600%26hb_pb%3D0.48%26hb_adid%3D1732d06997472a75%26hb_bidder%3Dpubmatic%7Cfsrefresh%3D0%26fsrebid%3D0%26floors_id%3D65983f%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_300x250_300x600_160x600_Right_3%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%26fsbid%3D0%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dpubmatic_300x600%26hb_format%3Dbanner%26hb_size%3D300x600%26hb_pb%3D0.48%26hb_adid%3D1755d4603d4429a5%26hb_bidder%3Dpubmatic%7Cfsrefresh%3D0%26fsrebid%3D0%26floors_id%3D332193%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_728x90_970x90_970x250_320x50_BTF%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%26fsbid%3D0%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dpubmatic_970x250%26hb_format%3Dbanner%26hb_size%3D970x250%26hb_pb%3D0.66%26hb_adid%3D177b03d9026e9403%26hb_bidder%3Dpubmatic%7Cfsrefresh%3D0%26fsrebid%3D0%26floors_id%3Dc91a37%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_1x1%26fs_ad_product%3Dbanner%26fsbid%3D0&eri=1&cust_params=user-agent%3DChrome%26section%3Dnews&cookie=ID%3De3d418217285c23d-2293398380ce0073%3AT%3D1638669023%3ART%3D1638669023%3AS%3DALNI_MZCmNLdy2a59hplq6e41XAGeMLYUw&bc=31&abxe=1&lmt=1637072838&dt=1638669025618&dlt=1638669022742&idt=1080&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C268%2C1082%2C1082%2C436%2C800&adys=271%2C4088%2C1752%2C2504%2C5600%2C6156&adks=960084856%2C4047242158%2C2389526111%2C523518761%2C976516616%2C2635258439&ucis=2%7C3%7C4%7C5%7C6%7C7&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1170x280%7C834x90%7C306x600%7C306x600%7C1200x250%7C1600x6180&msz=1170x250%7C834x90%7C306x600%7C306x600%7C1170x250%7C1600x0&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=true&fws=4%2C4%2C4%2C516%2C4%2C4&ohw=1170%2C834%2C306%2C306%2C1170%2C1600&btvi=0%7C1%7C2%7C3%7C4%7C5&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js?31063889
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
157248036947872e0484a5744b9a483c1267e4804dd3a96acc7585ea2549435c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36403
x-xss-protection
0
google-lineitem-id
-1,-1,-1,-1,5334928069,-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-1,-1,-1,-1,138307546612,-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
882.json
id5-sync.com/g/v2/ 		1 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/882.json
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.195.5.231 , France, ASN16276 (OVH, FR),
Reverse DNS
p35.id5-sync.com
Software
/
Resource Hash
3ceece0239e6870f6cd23047c8a35316027b35d0b7865315299e43a6b3b34bee
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sun, 05 Dec 2021 01:50:16 GMT
Vary
Origin
P3P
CP="CAO PSA OUR"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Access-Control-Allow-Credentials
true
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/json;charset=UTF-8
Transfer-Encoding
chunked
embed.vendors~ondemand.TimelineList~ondemand.TimelineProfile~ondemand.Tweet.29715ca2e27538cc4c88.js
platform.twitter.com/embed/ Frame 4BD7 		383 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.TimelineList~ondemand.TimelineProfile~ondemand.Tweet.29715ca2e27538cc4c88.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/80C2) /
Resource Hash
7abdd47254800f35ffef0fc434fa7fcf432e13651b27670b2e6f8e08143d4b00

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/80C2)
Age
187997
Etag
"28a37f9b17808aa66f17b1c227be059e+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
96013
embed.vendors~ondemand.Tweet.215918e9c83880e27bc2.js
platform.twitter.com/embed/ Frame 4BD7 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.Tweet.215918e9c83880e27bc2.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81E0) /
Resource Hash
0e8670554443313b972c10ae1a34baeb408d060fc5e82c6a358f77d7e98dd15e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81E0)
Age
187994
Etag
"c247e426d2ec154064a87aaff54defce+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
5857
embed.ondemand.Tweet.aae5a43a2a0769f682d8.js
platform.twitter.com/embed/ Frame 4BD7 		66 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.ondemand.Tweet.aae5a43a2a0769f682d8.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81FE) /
Resource Hash
6cbf3d5198e3c67803ca9868b5ee9c2c464f2e6ddcce9cef64ed608c5c57949f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460302706954981385&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81FE)
Age
187997
Etag
"97f699efb69f30d41bbda8690575fe25+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
16017
embed.vendors~ondemand.TimelineList~ondemand.TimelineProfile~ondemand.Tweet.29715ca2e27538cc4c88.js
platform.twitter.com/embed/ Frame EF1B 		383 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.TimelineList~ondemand.TimelineProfile~ondemand.Tweet.29715ca2e27538cc4c88.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/80C2) /
Resource Hash
7abdd47254800f35ffef0fc434fa7fcf432e13651b27670b2e6f8e08143d4b00

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/80C2)
Age
187997
Etag
"28a37f9b17808aa66f17b1c227be059e+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
96013
embed.vendors~ondemand.Tweet.215918e9c83880e27bc2.js
platform.twitter.com/embed/ Frame EF1B 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.Tweet.215918e9c83880e27bc2.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81E0) /
Resource Hash
0e8670554443313b972c10ae1a34baeb408d060fc5e82c6a358f77d7e98dd15e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81E0)
Age
187994
Etag
"c247e426d2ec154064a87aaff54defce+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
5857
embed.ondemand.Tweet.aae5a43a2a0769f682d8.js
platform.twitter.com/embed/ Frame EF1B 		66 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/embed/embed.ondemand.Tweet.aae5a43a2a0769f682d8.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.73157d07ac400de4c606.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:131d:1d30:1f1d:238b:1e56 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81FE) /
Resource Hash
6cbf3d5198e3c67803ca9868b5ee9c2c464f2e6ddcce9cef64ed608c5c57949f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=BleepinComputer&dnt=false&embedId=twitter-widget-1&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3NwYWNlX2NhcmQiOnsiYnVja2V0Ijoib2ZmIiwidmVyc2lvbiI6bnVsbH19&frame=false&hideCard=false&hideThread=false&id=1460308766767915013&lang=en&origin=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&sessionId=80fed72db0e8c09c072a281bd0e8f8774bbb8cd5&siteScreenName=BleepinComputer&theme=light&widgetsVersion=9fd78d5%3A1638479056965&width=550px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Nov 2021 23:20:58 GMT
Server
ECS (cha/81FE)
Age
187997
Etag
"97f699efb69f30d41bbda8690575fe25+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
16017
proxy.3d2100fd7107262ecb55ce6847f01fa5.html
cdn.krxd.net/partnerjs/xdi/ Frame 96B8 		805 B
828 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3bcfa04dbc2db44af54bd72a0f7b98912368f16f525729a1b9b673f62ca7e5c9

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

last-modified
Tue, 21 Feb 2017 17:50:54 GMT
etag
"3d2100fd7107262ecb55ce6847f01fa5"
cache-control
public, max-age=315360000
expires
Fri, 19 Feb 2027 17:50:50 GMT
content-type
text/html
x-cdn-backend
4FrRTvEr9h480D4BywjehZ--F_Partner_JS_S3
content-encoding
gzip
accept-ranges
bytes
date
Sun, 05 Dec 2021 01:50:25 GMT
via
1.1 varnish
age
15519546
x-served-by
cache-yul12829-YUL
x-cache
HIT
x-cache-hits
3243964
x-timer
S1638669026.747904,VS0,VE0
vary
Accept-Encoding
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length
525
0.js
cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/ Frame 38B2 		319 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Requested by
Host: acds.prod.vidible.tv
URL: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=0ae1c91a-6d9d-433e-b513-fd08330d91a4&pblob=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4998:14:800::1001 Ashburn, United States, ASN14777 (YAHOO, US),
Reverse DNS
Software
ATS /
Resource Hash
415522d8ed63727924c2a9dcfe8ee62e86d97f0860aa9d73103efccef9e6c969
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

ats-carp-promotion
1
date
Mon, 29 Nov 2021 16:25:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
465873
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-length
104909
x-amz-id-2
ViDU7qxIVXCQ1OoL+wnEuf7bcOjIs2T7ni4ZpbYjPgnIAOe5CwvGhyqrgU0nSXPjJWD8zviCczc=
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 29 Oct 2021 12:07:18 GMT
server
ATS
etag
"ad866575d644f8b5c5d7a56ff730d7e3-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET
x-amz-request-id
XVSF9HDPN0WNYG5D
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=1209600
x-amz-version-id
null
accept-ranges
bytes
content-type
application/javascript
impression.gif
trk.vidible.tv/trk/ Frame 38B2 		43 B
246 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/impression.gif?pid=59947c0544a64b1a49e52a48&bcid=603d9102810cd10001d1d12f&s=true&pv=10.2.82&ifr=true&cb=0.9141370566459621&pt=o2unit&sid=267b94f2-7637-43b3-9a93-ab22d2a5d8af&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.41.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-41-176.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:50:25 GMT
truncated
/ Frame 6789 		212 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d43c1b31c0d4fbbefe63a9983b96d675b6124244b3049c350e7996ad1021bfec

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 6789 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C500%2C700
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://googleads.g.doubleclick.net
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 01:28:42 GMT
x-content-type-options
nosniff
age
174103
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15828
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:28 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 03 Dec 2022 01:28:42 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 6789 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C500%2C700
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://googleads.g.doubleclick.net
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:09:49 GMT
x-content-type-options
nosniff
age
6036
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15920
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Mon, 05 Dec 2022 00:09:49 GMT
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 6789 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C500%2C700
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://googleads.g.doubleclick.net
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 04:56:13 GMT
x-content-type-options
nosniff
age
334452
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15732
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:20 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 01 Dec 2022 04:56:13 GMT
pr
s.amazon-adsystem.com/v3/ Frame E47A 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
d2abe9d5f7eec7dfc53021326811dd6770437e66cd21623e7f92eac2bf95aa5a
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&dcc=t

Response headers

Server
Server
Date
Sun, 05 Dec 2021 01:50:25 GMT
Content-Type
text/html;charset=ISO-8859-1
Content-Length
2355
Connection
keep-alive
x-amz-rid
DNW64H6ETDAH61V56AFH
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()
9427dd0d-835c-471c-a5db-ab01ae8a681c
consumer.krxd.net/consent/get/ 		249 B
438 B 		Script
General
Check archive.org
Download Go to
Full URL
https://consumer.krxd.net/consent/get/9427dd0d-835c-471c-a5db-ab01ae8a681c?idt=device&dt=kxcookie&callback=Krux.ns.investingchannelinc.kxjsonp_consent_get_0
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
5195609afbc1fca03f3200b50d97a90a8eb0e4652108db990a1aa9a1c9f7a0af

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:25 GMT
via
1.1 varnish
age
0
x-served-by
consumer-a001-ash-prod.krxd.net, cache-yul12823-YUL
vary
Accept-Encoding
x-cache
MISS, MISS
content-type
text/javascript; charset=UTF-8
content-encoding
gzip
cache-control
max-age=1800
x-age
0
accept-ranges
bytes
x-timer
S1638669026.858601,VS0,VE16
content-length
199
x-cache-hits
0, 0
integrator.js
adservice.google.ca/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.ca/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:808::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/ Frame E836 		11 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
16923f9fcc118f6870a574a73697c19eb79210b2ce401e5e1b92a2a5fcda080a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Sat, 04 Dec 2021 17:08:35 GMT
expires
Sat, 18 Dec 2021 17:08:35 GMT
content-type
text/html; charset=UTF-8
etag
6406113418471942685
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4879
x-xss-protection
0
age
31310
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/ Frame 1CBD 		11 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
16923f9fcc118f6870a574a73697c19eb79210b2ce401e5e1b92a2a5fcda080a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Sat, 04 Dec 2021 17:08:35 GMT
expires
Sat, 18 Dec 2021 17:08:35 GMT
content-type
text/html; charset=UTF-8
etag
6406113418471942685
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4879
x-xss-protection
0
age
31310
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
womptv2nm.js
cdn.krxd.net/controltag/ Frame 96B8 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/controltag/womptv2nm.js
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e1023fc5b7b2cb762dd4ad14fcf4787fa945fca4a37518cd0d6b411c248dc201

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-cdn-backend
4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date
Sun, 05 Dec 2021 01:50:25 GMT
via
1.1 varnish, 1.1 varnish
age
223
x-cache
MISS, HIT, HIT
x-app-cache
HIT
x-age
0
content-encoding
gzip
content-length
3716
x-served-by
config-service-a005-ash-prod.krxd.net, cache-bwi5155-BWI, cache-yul12829-YUL
x-response-time
1
x-do-esi
esi
x-timer
S1638669026.973596,VS0,VE0
etag
"fa213313d0f749c73627133b4ab4942a6489b2c7"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
public, max-age=1200
accept-ranges
bytes
x-cache-hits
0, 4, 199
tweet
cdn.syndication.twimg.com/ Frame 4BD7 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.syndication.twimg.com/tweet?features=tfw_experiments_cookie_expiration%3A1209600%3Btfw_horizon_tweet_embed_9555%3Ahte%3Btfw_space_card%3Aoff&id=1460302706954981385&lang=en
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.modules.66e311263622456867b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:1410:489:141e:20bb:12f6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
tsa_b / Express
Resource Hash
0f35719d73ced9e0bc4385a027050b3ecf4fe24b70fe1e7b6337422e342e633a
Security Headers
Name Value
Content-Security-Policy connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
content-encoding
gzip
etag
W/"576-knqBWYtZ2BjxGtSHrsAKuD67/GI"
x-powered-by
Express
access-control-allow-methods
GET
strict-transport-security
max-age=631138519
x-xss-protection
0
x-response-time
47
server
tsa_b
x-frame-options
SAMEORIGIN
date
Sun, 05 Dec 2021 01:50:26 GMT
vary
Origin, Accept-Encoding
x-tw-cdn
VZ, VZ
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=60
access-control-allow-credentials
true
x-connection-hash
b8b00d35ee7bb569984ac2b6ea977ba35920cc09c8caacb323e9f17b7fc40477
x-content-type-options
nosniff
access-contol-allow-origin
platform.twitter.com
ecm3
s.amazon-adsystem.com/ Frame E47A
Redirect Chain
  • https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D
  • https://s.amazon-adsystem.com/ecm3?id=C65D11E4B81E46FF927733811942FFDC&ex=simpli.fi&status=ok
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=C65D11E4B81E46FF927733811942FFDC&ex=simpli.fi&status=ok
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
4JD7SBZ968EB56XDGJG6
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date
Sun, 05 Dec 2021 01:50:26 GMT
x-content-type-options
nosniff
server
nginx
location
https://s.amazon-adsystem.com/ecm3?id=C65D11E4B81E46FF927733811942FFDC&ex=simpli.fi&status=ok
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
138
expires
Sat, 04 Dec 2021 01:50:26 GMT
tweet
cdn.syndication.twimg.com/ Frame EF1B 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.syndication.twimg.com/tweet?features=tfw_experiments_cookie_expiration%3A1209600%3Btfw_horizon_tweet_embed_9555%3Ahte%3Btfw_space_card%3Aoff&id=1460308766767915013&lang=en
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.modules.66e311263622456867b1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:1410:489:141e:20bb:12f6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
tsa_b / Express
Resource Hash
1c2529c4a862e2aeb90919c7185507f674d87b517c404964d4ce831e13bca0dd
Security Headers
Name Value
Content-Security-Policy connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
content-encoding
gzip
etag
W/"f9d-UlyqDM2nXb92rZtUhXDKQBG4fEc"
x-powered-by
Express
access-control-allow-methods
GET
strict-transport-security
max-age=631138519
x-xss-protection
0
x-response-time
88
server
tsa_b
x-frame-options
SAMEORIGIN
date
Sun, 05 Dec 2021 01:50:26 GMT
vary
Origin, Accept-Encoding
x-tw-cdn
VZ, VZ
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=60
access-control-allow-credentials
true
x-connection-hash
4d26162d6647ccf2049fb7b27d735b525a3b782d781d3525c4e5dfa2b1b33f12
x-content-type-options
nosniff
access-contol-allow-origin
platform.twitter.com
moatapi.js
z.moatads.com/aolvidibleapi29384728347/ Frame 5207 		133 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/aolvidibleapi29384728347/moatapi.js
Requested by
Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
90542f9de6cab010087ab4bcab0e3b0a2ec1e449e445434dc1bb5c852033f046

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
content-encoding
gzip
last-modified
Tue, 25 Feb 2020 18:37:38 GMT
server
AmazonS3
x-amz-request-id
248CC7A683259DAA
etag
"d678022569896f7b7293494e3a69c8c7"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=10938
accept-ranges
bytes
content-length
44266
x-amz-id-2
3gL1G73xdwsJvoBVhRBYvjjgpoiElrEMgkbddhjUjbkesF76DaTRBtuV3PjNJcRAEgbxpZrGLm4=
VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads-ec.v.ssp.yahoo.com/a/h/ Frame 38B2
Redirect Chain
  • https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669023986&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&p...
  • https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669023986&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.he...
249 B
0 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669023986&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=036e5c75-60d1-4e56-a0cc-560aaee09b40&a.is_yahoo=3&redirect_y=dHM9MTYzODY2OTAyNjA1NC42MDA4MzA6YXBpZD1VUGI2YjRjODk5LTU1NmQtMTFlYy05ZjA5LTBlOThjZTUzMGUzNzpyZXF1ZXN0X2lkPTAzNmU1Yzc1LTYwZDEtNGU1Ni1hMGNjLTU2MGFhZWUwOWI0MA==
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
3.231.253.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-231-253-205.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
content-encoding
gzip
server
ATS/9.1.0.33
Age
0
content-type
text/xml
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
192
expires
0

Redirect headers

strict-transport-security
max-age=31536000
server
adaptv/1.0
access-control-allow-origin
https://www.bleepingcomputer.com
content-type
text/plain
location
https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669023986&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=036e5c75-60d1-4e56-a0cc-560aaee09b40&a.is_yahoo=3&redirect_y=dHM9MTYzODY2OTAyNjA1NC42MDA4MzA6YXBpZD1VUGI2YjRjODk5LTU1NmQtMTFlYy05ZjA5LTBlOThjZTUzMGUzNzpyZXF1ZXN0X2lkPTAzNmU1Yzc1LTYwZDEtNGU1Ni1hMGNjLTU2MGFhZWUwOWI0MA==
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
0
display.gif
trk.vidible.tv/trk/ Frame 38B2 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/display.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=267b94f2-7637-43b3-9a93-ab22d2a5d8af&vvuid=e937566a-f65e-41d2-99ff-fe9ce1ebdf40&orgId=28949&plcid=1279691&vrid=0ae1c91a-6d9d-433e-b513-fd08330d91a4&ab=0&dt=291&h=469&spaceid=793604934&w=834&cb=0.401792268196143
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.41.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-41-176.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:50:26 GMT
ad-request.gif
trk.vidible.tv/trk/ Frame 38B2 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/ad-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=267b94f2-7637-43b3-9a93-ab22d2a5d8af&vvuid=e937566a-f65e-41d2-99ff-fe9ce1ebdf40&orgId=28949&plcid=1279691&vrid=0ae1c91a-6d9d-433e-b513-fd08330d91a4&at=preroll&ps=html5-vpaid&spaceid=793604934&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&cb=0.9003902348121744
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.41.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-41-176.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:50:26 GMT
ad-engine-request.gif
trk.vidible.tv/trk/ Frame 38B2 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/ad-engine-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=267b94f2-7637-43b3-9a93-ab22d2a5d8af&vvuid=e937566a-f65e-41d2-99ff-fe9ce1ebdf40&orgId=28949&plcid=1279691&vrid=0ae1c91a-6d9d-433e-b513-fd08330d91a4&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=834&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&h=469&cb=0.6929680340730955
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.41.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-41-176.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:50:26 GMT
usermatch
ssum-sec.casalemedia.com/ Frame 29F3
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
92e7acf4ea8ad8442db61a7022ad3ad9091d199b21513602563f1c17f9d3a111

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
45|241|230|39|206|105|195|13
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1822
Expires
Sun, 05 Dec 2021 01:50:26 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Connection
keep-alive

Redirect headers

Server
Apache
Content-Length
324
Content-Type
text/html; charset=iso-8859-1
Location
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Expires
Sun, 05 Dec 2021 01:50:26 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Connection
keep-alive
/
match.sharethrough.com/jwumXNuB/v1/ Frame 21C3 		427 B
613 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.200.159.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-159-147.compute-1.amazonaws.com
Software
/
Resource Hash
a239be1a45bd5867274446da4bfb80892da21905979e53629f411b3cb26fc831

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
content-length
427
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 4FC8 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=65953
expires
Sun, 05 Dec 2021 20:09:39 GMT
date
Sun, 05 Dec 2021 01:50:26 GMT
vary
Accept-Encoding
tamptsync
sync-amz.ads.yieldmo.com/ Frame A395 		886 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.200.184.86 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-184-86.compute-1.amazonaws.com
Software
/
Resource Hash
d70a6a620f3f39a178a167bafb9033b6043269d332b4be0ce15ee9b41d748a1f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
usync.html
eus.rubiconproject.com/ Frame E081 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40334-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Sun, 05 Dec 2021 01:50:26 GMT
Connection
keep-alive
Vary
Accept-Encoding
ecm3
s.amazon-adsystem.com/ Frame 6DAF
Redirect Chain
  • https://ssbsync-us.smartadserver.com/api/sync?callerId=2
  • https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=3167836846926884602&gdpr=0&gdpr_consent=
43 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=3167836846926884602&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
Server
Date
Sun, 05 Dec 2021 01:50:26 GMT
Content-Type
image/gif
Content-Length
43
Connection
keep-alive
x-amz-rid
1HAGTGBMPNVESXS278EY
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()

Redirect headers

date
Sun, 05 Dec 2021 01:50:25 GMT
content-length
0
location
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=3167836846926884602&gdpr=0&gdpr_consent=
ecm3
s.amazon-adsystem.com/ Frame B757
Redirect Chain
  • https://sync.inmobi.com/TAM?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D
  • https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D
  • https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOeR3usMl58fx9rdUH-t26syo_nrB7dPYFI7TPsw
43 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOeR3usMl58fx9rdUH-t26syo_nrB7dPYFI7TPsw
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
Server
Date
Sun, 05 Dec 2021 01:50:26 GMT
Content-Type
image/gif
Content-Length
43
Connection
keep-alive
x-amz-rid
EG0QMAMPY8VABY2SN5W9
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()

Redirect headers

P3P
CP="CAO PSA OUR"
Location
https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOeR3usMl58fx9rdUH-t26syo_nrB7dPYFI7TPsw
Transfer-Encoding
chunked
Date
Sun, 05 Dec 2021 01:50:16 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
ecm3
s.amazon-adsystem.com/ Frame EF29
Redirect Chain
  • https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D
  • https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=96a88f567c2122e&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D
  • https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAGdRmaSRjYVwN4bHoHAAAAAAA&expiration=1638755426&is_secure=true
43 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAGdRmaSRjYVwN4bHoHAAAAAAA&expiration=1638755426&is_secure=true
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
Server
Date
Sun, 05 Dec 2021 01:50:26 GMT
Content-Type
image/gif
Content-Length
43
Connection
keep-alive
x-amz-rid
XFD8JM96RVKNNDEVETN0
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()

Redirect headers

server
nginx
date
Sun, 05 Dec 2021 01:50:26 GMT
content-length
0
cache-control
no-cache, private, max-age=0, no-store
expires
0
pragma
no-cache
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAGdRmaSRjYVwN4bHoHAAAAAAA&expiration=1638755426&is_secure=true
amazon
ap.lijit.com/beacon/ Frame A0FF
Redirect Chain
  • https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com
  • https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
63.251.86.50 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
5c98fe33f2b609572fd74d0d40984ea007e47010b13815720de4fc857a75347f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
nginx
Date
Sun, 05 Dec 2021 01:50:26 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Vary
Accept-Encoding
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma
no-cache
P3P
CP="CUR ADM OUR NOR STA NID"
X-Powered-By
raptor
Content-Encoding
gzip
X-Sovrn-Pod
ad_ap2dca1

Redirect headers

Server
nginx
Date
Sun, 05 Dec 2021 01:50:26 GMT
Content-Length
0
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma
no-cache
P3P
CP="CUR ADM OUR NOR STA NID"
Location
https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
X-Powered-By
raptor
X-Sovrn-Pod
ad_ap2dca1
ecm3
s.amazon-adsystem.com/ Frame 8796
Redirect Chain
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
  • https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=13493460417766279847
43 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=13493460417766279847
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_n-sharethrough_n-LoopMe_pm-db5_n-simpli.fi_ym_rbd_smrt_n-inmobi_cnv_sovrn_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

Server
Server
Date
Sun, 05 Dec 2021 01:50:26 GMT
Content-Type
image/gif
Content-Length
43
Connection
keep-alive
x-amz-rid
D8BW8XMR48B1XNBTP09Q
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Permissions-Policy
interest-cohort=()

Redirect headers

date
Sun, 05 Dec 2021 01:50:26 GMT
content-length
0
location
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=13493460417766279847
cache-control
no-cache, no-store, must-revalidate
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
css2
fonts.googleapis.com/ Frame E836 		4 KB
634 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sun, 05 Dec 2021 01:43:23 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sun, 05 Dec 2021 01:50:26 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 05 Dec 2021 01:50:26 GMT
feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame E836 		205 B
229 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 07:50:39 GMT
x-content-type-options
nosniff
age
64787
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
205
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Sun, 04 Dec 2022 07:50:39 GMT
settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame E836 		604 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 12:50:01 GMT
x-content-type-options
nosniff
age
133225
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
604
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Sat, 03 Dec 2022 12:50:01 GMT
interstitial_ad_frame_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame E836 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/interstitial_ad_frame_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1d71682fbb31fc64ba19097a9eb389593ba1bf9f9f913bef6eaf563eb08c2a7a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:45:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
320
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8210
x-xss-protection
0
server
cafe
etag
6499249944067270656
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:45:06 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 1CBD 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssnehkBg9oDPvqnd0T9AaQ7zl0SzjAETwWPhrodykI2iLtKhuElRW1KRSIcrf3149sKlUdVB0BXimoHFkNY_ubMUli-1YLF0qUQC1FdzbM-dz2GmeANvDeeD8qvJhLbfxRISMg2bsxdXTGvkq2lBU3UR1bW96mvHfDgRdaebhSC1SQMT-4WDUmsVefltZa277O1J6dQeRweGQ_OCDlWiNDddPW8th2wcPwRSi_qg0k96OGQ-Y4FXspk_9SJ0-NUxpBtA88gMCJ5bkUmIDnFu0KdoX6-Sdwkqk8Q9sVwGq52GI3IB3glbIdlx7GhptiP_NaC0UvN2ORW70893CAi5U20KUCsAm8KnIGklYg9Vt0CUJBeSbuoRW_Lpni2Ff7NqRudS2EuaOQB56sRDHEmMAQogiW1o5G88QmDIibKt5ADskltBoUaChWyi3GXj6GhddfgVvAoXlykcuqyUEMaTbbVtVBJ56VShHOqinpt6CIDJe0B9c8-a0xwLPkU52-EMaFU1ZnqSP8iQnGZy8Vh2FCpwdzcbMQ0edTPCvTXeIEInkACEl_C1bjWt1nIENJYSv8M6n2qwfy7w9arbM3rpNqMp7-kl1RdJGYpJYU5YwB1nwOf2v4bi7Mn_aMoMsrPX7Y37-t_KrrLy8dY6HrCtqQZIGrBzSyR-uYrwIP3JThWo5nOWeGoiAGbq3F-h_ksbS2qSk567-EiTvTmDf-PfnS-i1SUt6tArvnMf_lg-4fKMWt9XUEGCHqjp2U3HtzwjZXQ-kaS4qAV5AoJFf-H8jg55C1xHLWGneVqhfAbu5tEBbZjjCbhpR7Ep0hF5VM9LwuvWr3mjlO-v35Cj7zI_ygKVX8RcOnOxyxJqtRnCz8LSJtFAbIPWKQaFp80dZSRjAvUA-eBzPn5wEC4aN0tzVOuvJLN35mw4wCU6SKxKokOu0O37hKHxOSlTyFVA75_4mmCkfhxwH6kMGAltgA6SW_4JN2n2DCRBspq1Pz-GcYWu7vq62wdqv4_0xpw0gKiNucXlLNG-99KVC7P4-Eu9N-ol8W4Ptp25melC4axXVlrbetcX4JNQQg6zvkDY0yze6sSQ2r-HW_EecadMkDwHezpyUN7jIx7onByj2LNYJpUorHCt6n2_Smbu5i5Egq-m4xENg&sai=AMfl-YS5u9m1NKKQGvqsN5HvjObtcRzCuMz6yEsvuWRUQHYMXhUf3LCgBX_R5A&sig=Cg0ArKJSzFU-ECW34hEOEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date
Sun, 05 Dec 2021 01:50:26 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 1CBD 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 04:11:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77915
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Sun, 04 Dec 2022 04:11:51 GMT
m_js_controller_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 1CBD 		32 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/m_js_controller_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c1643c27ced6443bbfeddac4404c8c0f373729c1eda97da555b76938ac8609b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:25:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1484
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13170
x-xss-protection
0
server
cafe
etag
8711390877983841680
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:25:42 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 1CBD 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:47:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
185
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:47:21 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 1CBD 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:50:26 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 1CBD 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:49:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
73
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6446
x-xss-protection
0
server
cafe
etag
5472324691301332805
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:49:13 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 1CBD 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
615050cfd7cd77d6941c6c0b4551d20c4d5ad825bc9fd7acc61a0bdca7783d26
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:40:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
572
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7857
x-xss-protection
0
server
cafe
etag
2255741555227857113
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:40:54 GMT
11773118923286934530
s0.2mdn.net/simgad/ Frame 1CBD 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/11773118923286934530
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2006 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8c59a910812fee6f23b648fcc223b90ed307fb11f885787a52df0190460ff245
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 18:54:59 GMT
x-content-type-options
nosniff
age
111327
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40035
x-xss-protection
0
last-modified
Fri, 03 Dec 2021 18:51:01 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sat, 03 Dec 2022 18:54:59 GMT
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame 555F 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102983
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
O83T541LZal4AYKRbcSmx2vFln1XM-jG6_SoFmJB0Q5hQU0vYKoVGw==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame 555F 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1445065
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
7jQ1gaxGumQpKCzzeDPrQKuIvrULQWLjTVxrXQ-g8MCQwSKEHf375Q==
controltag.js.a1705c5ac5f06cf0c202ff70908fc042
cdn.krxd.net/ctjs/ Frame 96B8 		259 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/womptv2nm.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-cdn-backend
4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date
Sun, 05 Dec 2021 01:50:26 GMT
content-encoding
gzip
age
10762336
x-amz-server-side-encryption
AES256
x-cache
HIT
x-cache-hits
10886781
content-length
84509
x-served-by
cache-yul12829-YUL
last-modified
Mon, 02 Aug 2021 12:06:17 GMT
x-timer
S1638669026.307454,VS0,VE0
etag
"a1705c5ac5f06cf0c202ff70908fc042"
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=315360000
accept-ranges
bytes
expires
Thu, 31 Jul 2031 12:06:16 GMT
8.gif
id5-sync.com/i/882/ 		79 B
79 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id5-sync.com/i/882/8.gif?id5id=ID5*dWFAwFY04z_mUPxzUoTYiNX0tzwFFpM_VF37igydwjwA5QhPLSD5o1Swnj08Tk6UAOh9aiVnveTVVCsBXDpuZgDpHSEGeGBDjBgTBiC7caQA6olNF9n_KskrpSCHOAQXAOu7wa6YAvaE6r4dOmeh9QDtFQX-qPqtAef0DFG5fq0A92cgDjw_kZZsNLm_ReZrAPlIqvfbKm0DsaGNtJaIwgD7GOUGa99XsKwZnAZG_DEA_uBbUJVVsEzFSg01jWzTAQHwa2AumL7_E8EqYlptpwEEsFGdLXq5e0Q-23lAx2YBCPmw7yxYgmG1s6Okf_HvAQs6IOkEGxGYI-di1tLVxgEOfweOP2j6m0ts3kNke70BEeoIg2f2NZ_BVB_yO_1PARQXubUMoIgdD3jCa-cqhgFC6XkFdBrSh5wMHs4tOAkBRGJaAOuIjE8DzHDSFK75AUeRkulYLZSzlzkvdsIt2gFOglo7kIEDimTlus2Ev8MBURu6W0SkzWmOv23m2IS7&o=api&gdpr_consent=undefined&gdpr=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.195.5.231 , France, ASN16276 (OVH, FR),
Reverse DNS
p35.id5-sync.com
Software
/
Resource Hash
06ecc1573d3bd555fe29b67a1f5f9a4f560413c5d3a979eb7ad1960866ddbad8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Date
Sun, 05 Dec 2021 01:50:17 GMT
Transfer-Encoding
chunked
Content-Type
text/html;charset=utf-8
jot
syndication.twitter.com/i/ Frame 4BD7 		43 B
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1638669026380%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22results%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%229fd78d5%3A1638479056965%22%2C%22dnt%22%3Afalse%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22BleepinComputer%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22BleepinComputer%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22320980a%3A1637165373563%22%2C%22item_ids%22%3A%5B%221460302706954981385%22%5D%2C%22item_details%22%3A%7B%221460302706954981385%22%3A%7B%22item_type%22%3A0%7D%7D%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
10
pragma
no-cache
last-modified
Sun, 05 Dec 2021 01:50:26 GMT
server
tsa_b
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
a4f736c600a14401d9ff31c2261c0d6df3cbac33d47e1b17cfb86291c13cb494
x-transaction
8a762476fc1eb21e
expires
Tue, 31 Mar 1981 05:00:00 GMT
1f4a5.svg
abs-0.twimg.com/emoji/v2/svg/ Frame EF1B 		842 B
649 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://abs-0.twimg.com/emoji/v2/svg/1f4a5.svg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d700b57f2d2a20509c05ba3130977df9b7ca52f89aa886a5d7e49c7a7a44b91a
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT, HIT
server-timing
x-cache;desc=HIT, HIT, x-tw-cdn;desc=FT
content-length
510
etag
"0Zj5K5kRx/27ErqmlKgZog=="
x-served-by
cache-fty13727-FTY, cache-yul12822-YUL
last-modified
Wed, 21 Feb 2018 22:31:04 GMT
date
Sun, 05 Dec 2021 01:50:26 GMT
vary
Accept-Encoding
x-tw-cdn
FT
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
expires
Thu, 26 Aug 2021 17:28:23 GMT
1f4aa.svg
abs-0.twimg.com/emoji/v2/svg/ Frame EF1B 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://abs-0.twimg.com/emoji/v2/svg/1f4aa.svg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9abe6b1f8f8e8903d93e62630394568dbbd09e4fdad84026e2374f3935d5d25f
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT, HIT
server-timing
x-cache;desc=HIT, HIT, x-tw-cdn;desc=FT
content-length
690
etag
"GDfFcZqXc2JkL/r0mQtrrA=="
x-served-by
cache-fty21334-FTY, cache-yul12822-YUL
last-modified
Wed, 15 Apr 2020 20:58:46 GMT
date
Sun, 05 Dec 2021 01:50:26 GMT
vary
Accept-Encoding
x-tw-cdn
FT
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
expires
Wed, 08 Jun 2022 09:51:00 GMT
1f6e1.svg
abs-0.twimg.com/emoji/v2/svg/ Frame EF1B 		433 B
404 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://abs-0.twimg.com/emoji/v2/svg/1f6e1.svg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
01c03b8eb0f7f27dd5ec8e28f4fe83079c56521e05b05e5099675154c7f10458
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT, HIT
server-timing
x-cache;desc=HIT, HIT, x-tw-cdn;desc=FT
content-length
293
etag
"rS5NbnuQymAFpQOOIrCZzA=="
x-served-by
cache-fty13727-FTY, cache-yul12822-YUL
last-modified
Wed, 21 Feb 2018 22:31:13 GMT
date
Sun, 05 Dec 2021 01:50:26 GMT
vary
Accept-Encoding
x-tw-cdn
FT
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
expires
Wed, 08 Jun 2022 10:47:41 GMT
1f449.svg
abs-0.twimg.com/emoji/v2/svg/ Frame EF1B 		563 B
512 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://abs-0.twimg.com/emoji/v2/svg/1f449.svg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.43.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
41578770d740012d57be1d400db47fdba90631e27363a4877af6cc54a032ad10
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT, HIT
server-timing
x-cache;desc=HIT, HIT, x-tw-cdn;desc=FT
content-length
372
etag
"Ay2Qf/SaY+B1fK3V82qyFg=="
x-served-by
cache-fty21325-FTY, cache-yul12822-YUL
last-modified
Wed, 21 Feb 2018 22:30:55 GMT
date
Sun, 05 Dec 2021 01:50:26 GMT
vary
Accept-Encoding
x-tw-cdn
FT
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
expires
Wed, 08 Jun 2022 10:38:51 GMT
jot
syndication.twitter.com/i/ Frame EF1B 		43 B
124 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1638669026450%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22results%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%229fd78d5%3A1638479056965%22%2C%22dnt%22%3Afalse%2C%22widget_id%22%3A%22twitter-widget-1%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22BleepinComputer%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22BleepinComputer%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22320980a%3A1637165373563%22%2C%22item_ids%22%3A%5B%221460308766767915013%22%5D%2C%22item_details%22%3A%7B%221460308766767915013%22%3A%7B%22item_type%22%3A0%7D%7D%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
11
pragma
no-cache
last-modified
Sun, 05 Dec 2021 01:50:26 GMT
server
tsa_b
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
a4f736c600a14401d9ff31c2261c0d6df3cbac33d47e1b17cfb86291c13cb494
x-transaction
6c87ef2916fe4b84
expires
Tue, 31 Mar 1981 05:00:00 GMT
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
830b8ca5f78f00f8a0d79813f2ba95b0a7efd1ee7536567b5c25219323f3209b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
5itnu6hP_normal.jpg
pbs.twimg.com/profile_images/1062794957721821184/ Frame 4BD7 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/profile_images/1062794957721821184/5itnu6hP_normal.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:1410:489:141e:20bb:12f6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/80C2) /
Resource Hash
755af9e996edb7ac0fb05eeb681a187e51f8b5e9f11fcb3249228c7cfcff99fd
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
x-content-type-options
nosniff
age
469580
x-cache
HIT
content-length
1959
x-response-time
11
surrogate-key
profile_images profile_images/bucket/4 profile_images/1062794957721821184
last-modified
Wed, 14 Nov 2018 19:48:38 GMT
server
ECS (cha/80C2)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
e322764c40d02551952fbfbf63d79d2a806fa29a56f5d030408cc922f93cb7cd
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&ac=1&bq=7&i=AOL_VIDIBLE_API1&t=1638669026528&de=196180107442&d=201%3A-%3A-%3A-&bo=bleepingcomputer.com&bd=bleepingcomputer.com&f=0&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:26 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:50:26 GMT
usync.js
eus.rubiconproject.com/ Frame E081 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
952ff494a4f911577bd010f4a1e393e93cb090ce1976f464442cc8aa1ac6b12b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:26 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=17365
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9514
Expires
Sun, 05 Dec 2021 06:39:51 GMT
ecm3
s.amazon-adsystem.com/ Frame 21C3 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=8169d5dd-0a59-4fc8-aa31-a786caffc331
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
X1S0Y4G5R831Q1AAMJB1
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
v1
match.sharethrough.com/sync/ Frame 21C3
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
  • https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=$UID
  • https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=7205020425431634120
68 B
261 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=7205020425431634120
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol
H2
Server
34.200.159.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-159-147.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
content-length
68
content-type
image/png

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 569.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
ca92b6c8-8c7c-4203-8143-a374cb756264
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=7205020425431634120
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
match.sharethrough.com/sync/ Frame 21C3
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=97
  • https://match.sharethrough.com/sync/v1?source_id=gBgkxrVErPj9wqivTDd2AmVY&source_user_id=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&gdpr=0&gdpr_consent=
68 B
261 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=gBgkxrVErPj9wqivTDd2AmVY&source_user_id=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&gdpr=0&gdpr_consent=
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol
H2
Server
34.200.159.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-159-147.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:26 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://match.sharethrough.com/sync/v1?source_id=gBgkxrVErPj9wqivTDd2AmVY&source_user_id=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
v1
match.sharethrough.com/sync/ Frame 21C3
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=18694
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=KWSL87CK-1M-EIIR
68 B
261 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=KWSL87CK-1M-EIIR
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol
H2
Server
34.200.159.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-159-147.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
content-length
68
content-type
image/png

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=KWSL87CK-1M-EIIR
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
2dd9fa24169fa04536d533da131679f8
Expires
0
v1
match.sharethrough.com/sync/ Frame 21C3
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
  • https://ssum.casalemedia.com/usermatchredir?s=186046&cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DGM7HYz3VFjuymbiqnJLyjuPy%26source_user_id%3D__UID__
  • https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=Yawa4gBzq4Mi9uUbPgLGCwAA%26020
68 B
261 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=Yawa4gBzq4Mi9uUbPgLGCwAA%26020
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol
H2
Server
34.200.159.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-159-147.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
content-length
68
content-type
image/png

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=Yawa4gBzq4Mi9uUbPgLGCwAA%26020
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
307
Expires
Sun, 05 Dec 2021 01:50:26 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame DD10 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Thu, 02 Dec 2021 09:38:23 GMT
expires
Fri, 02 Dec 2022 09:38:23 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
231123
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
crum
dsum-sec.casalemedia.com/ Frame 29F3
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEv7vNCflkDDFkQXzGixrMs&google_cver=1
43 B
999 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEv7vNCflkDDFkQXzGixrMs&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:26 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:26 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEv7vNCflkDDFkQXzGixrMs&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame 29F3 		43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
EV3D6H1YKVJDNRKG4AQ7
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
usermatchredir
ssum-sec.casalemedia.com/ Frame 29F3
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&gdpr_consent=&us_privacy=&gdpr=
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:26 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:26 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
342
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 29F3
Redirect Chain
  • https://match.adsrvr.org/track/cmf/casale
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=0a060ae1-17dc-465b-b9b3-37e0e67725c6&expiration=1641261026&gdpr=0&gdpr_consent=
43 B
1007 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=0a060ae1-17dc-465b-b9b3-37e0e67725c6&expiration=1641261026&gdpr=0&gdpr_consent=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:26 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:26 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=0a060ae1-17dc-465b-b9b3-37e0e67725c6&expiration=1641261026&gdpr=0&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
323
Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 29F3
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&gdpr_consent=&us_privacy=&gdpr=
  • https://pr-bh.ybp.yahoo.com/sync/casale/Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB
43 B
869 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol
H2
Server
2600:1f18:4e9:5a02:1f9d:78fd:b4f5:2185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff

Redirect headers

location
https://pr-bh.ybp.yahoo.com/sync/casale/Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB
date
Sun, 05 Dec 2021 01:50:26 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
crum
dsum-sec.casalemedia.com/ Frame 29F3
Redirect Chain
  • https://d.adroll.com/cm/index/ssp
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
43 B
972 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:26 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
date
Sun, 05 Dec 2021 01:50:26 GMT
server
nginx/1.20.0
content-length
76
crum
dsum-sec.casalemedia.com/ Frame 29F3
Redirect Chain
  • https://nep.advangelists.com/xp/user-sync?acctid=405&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D195%26external_user_id%3D%7BPARTNER_VISITOR_ID%7D%0A
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-a24e3de0-2028-4cfb-a8c7-c735d7200895
43 B
1010 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-a24e3de0-2028-4cfb-a8c7-c735d7200895
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:26 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-a24e3de0-2028-4cfb-a8c7-c735d7200895
date
Sun, 05 Dec 2021 01:50:26 GMT
server
Apache-Coyote/1.1
content-length
0
crum
dsum-sec.casalemedia.com/ Frame 29F3
Redirect Chain
  • https://sync.adotmob.com/cookie/indexexchange?r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D13%26external_user_id%3D%7bamob_user_id%7d%26expiration%3D%5bEXPIRATION%5d
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=0707220438307035bba052c2&expiration=[EXPIRATION]
43 B
994 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=0707220438307035bba052c2&expiration=[EXPIRATION]
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:26 GMT

Redirect headers

Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=0707220438307035bba052c2&expiration=[EXPIRATION]
Date
Sun, 05 Dec 2021 01:50:26 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Powered-By
Express
Content-Length
0
Vary
Origin
ecm3
s.amazon-adsystem.com/ Frame 29F3 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=index.com&id=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
SSQ7T5DC64TECG3MZWRN
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame A395 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=ym.com&id=g94700eb95166f3fb46c
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
R11GND4CQQJX18Q688TP
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sync
ib.adnxs.com/&https://ads.yieldmo.com/v000/ Frame A395
Redirect Chain
  • https://ib.adnxs.com/getuid?&https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an
  • https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=7205020425431634120&pn_id=an
0
585 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=7205020425431634120&pn_id=an
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
HTTP/1.1
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
c58389c7-c9db-4727-a9c6-e0b2ea8657f4
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
4c5a90a1-797e-4b51-973e-aa61beb65d50
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
&https://ads.yieldmo.com/v000/sync?userid=7205020425431634120&pn_id=an
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
ads.yieldmo.com/ Frame A395
Redirect Chain
  • https://x.bidswitch.net/sync?&ssp=yieldmo
  • https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=yieldmo&ssp_user_id=91fae357-6d96-49d0-85ee-50af585ffd28
  • https://x.bidswitch.net/sync?dsp_id=74&&user_id=171119537&expires=5&ssp=yieldmo
  • https://ads.yieldmo.com/sync?userid=91fae357-6d96-49d0-85ee-50af585ffd28&pn_id=bsw&extinit=0&gdpr=&gdpr_consent=
43 B
639 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/sync?userid=91fae357-6d96-49d0-85ee-50af585ffd28&pn_id=bsw&extinit=0&gdpr=&gdpr_consent=
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
H2
Server
54.226.174.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-226-174-129.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:27 GMT
content-type
image/gif
content-length
43
access-control-allow-methods
GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma

Redirect headers

Location
//ads.yieldmo.com/sync?userid=91fae357-6d96-49d0-85ee-50af585ffd28&pn_id=bsw&extinit=0&gdpr=&gdpr_consent=
Date
Sun, 05 Dec 2021 01:50:27 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
sync
ads.yieldmo.com/v000/ Frame A395
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?&ttd_pid=yieldmo
  • https://ads.yieldmo.com/v000/sync?tdid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
43 B
328 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?tdid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
H2
Server
54.226.174.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-226-174-129.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:26 GMT
content-type
image/gif
content-length
43
access-control-allow-methods
GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:26 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ads.yieldmo.com/v000/sync?tdid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
181
sync
ads.yieldmo.com/ Frame A395
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?&nid=21
  • https://ads.yieldmo.com/sync?pn_id=stk&userid=xswp1o64ToFOAZv37ofaZSV4zbQ
43 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/sync?pn_id=stk&userid=xswp1o64ToFOAZv37ofaZSV4zbQ
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
H2
Server
54.226.174.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-226-174-129.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:26 GMT
content-type
image/gif
content-length
43
access-control-allow-methods
GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma

Redirect headers

Location
https://ads.yieldmo.com/sync?pn_id=stk&userid=xswp1o64ToFOAZv37ofaZSV4zbQ
Date
Sun, 05 Dec 2021 01:50:26 GMT
Connection
keep-alive
Content-Length
100
Content-Type
text/html; charset=utf-8
sync
sync-pp.ads.yieldmo.com/ Frame A395
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?&pid=561118&ev=1&rurl=https://sync-pp.ads.yieldmo.com/sync?userid=%%VGUID%%&pn_id=pp
  • https://sync-pp.ads.yieldmo.com/sync?userid=BtO9pQA2TEDw&ev=1&pn_id=pp&pid=561118
43 B
313 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-pp.ads.yieldmo.com/sync?userid=BtO9pQA2TEDw&ev=1&pn_id=pp&pid=561118
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
H2
Server
34.200.184.86 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-184-86.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:26 GMT
content-type
image/gif
content-length
43
access-control-allow-methods
GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
en-CA
location
https://sync-pp.ads.yieldmo.com/sync?userid=BtO9pQA2TEDw&ev=1&pn_id=pp&pid=561118
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-544c4f9c45-qfzzd
expires
-1
ecm3
s.amazon-adsystem.com/ Frame A0FF 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=1877215a80f219747d186ee2&ex=sovrn.com&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
6R2ZFX0GXGE2RZJYEK4X
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
merge
ce.lijit.com/ Frame A0FF
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=
  • https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1
  • https://ce.lijit.com/merge?pid=86&3pid=ie65HF3Q4cl5eT0MwBbs&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=86&3pid=ie65HF3Q4cl5eT0MwBbs&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
63.251.114.182 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:27 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap7ewr1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
https://ce.lijit.com/merge?pid=86&3pid=ie65HF3Q4cl5eT0MwBbs&pi=sovrn&gdpr_consent=&gdpr=0&tc=1
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:26 GMT, Sun, 05 Dec 2021 01:50:26 GMT
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
merge
ce.lijit.com/ Frame A0FF
Redirect Chain
  • https://sync.1rx.io/usersync2/sovrn?gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005&rndcb=8433274981
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=adconductor&bsw_custom_parameter=91fae357-6d96-49d0-85ee-50af585ffd28
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=adconductor&bsw_custom_parameter=91fae357-6d96-49d0-85ee-50af585ffd28
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=d884b705-ec2e-4c88-bcb6-5002f47980a1&user_group=1&ssp=adconductor&bsw_param=91fae357-6d96-49d0-85ee-50af585ffd28
  • https://sync.1rx.io/usersync/bidswitch/91fae357-6d96-49d0-85ee-50af585ffd28?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D56%263pid%3DRX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005
  • https://ce.lijit.com/merge?pid=56&3pid=RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005
43 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=56&3pid=RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
63.251.114.182 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:28 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap7ewr1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date
Sun, 05 Dec 2021 01:50:28 GMT
Server
Tengine
ETag
RXdcbd78ba409c4a89959fd5740b5432ce005
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location
https://ce.lijit.com/merge?pid=56&3pid=RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005
Connection
keep-alive
Content-Type
text/html
merge
ce.lijit.com/ Frame A0FF
Redirect Chain
  • https://aorta.clickagy.com/pixel.gif?ch=185&cm=1877215a80f219747d186ee2&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=84&3pid=c:260803f49fc670d26b7a8c97ae1c7d30
43 B
854 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=84&3pid=c:260803f49fc670d26b7a8c97ae1c7d30
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
63.251.114.182 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap7ewr1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date
Sun, 5 Dec 2021 01:50:26 GMT
server
Aorta/20211029.2f91d75
access-control-allow-origin
access-control-max-age
31536000
access-control-allow-methods
POST, GET, OPTIONS
content-type
text/plain
Location
https://ce.lijit.com/merge?pid=84&3pid=c:260803f49fc670d26b7a8c97ae1c7d30
access-control-expose-headers
Set-Cookie
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
X-Aorta-Region
us-east-1
Connection
keep-alive
X-Aorta-Host
ip-10-42-22-210.ec2.internal
access-control-allow-headers
Origin,cache-control,content-type,man,messagetype,soapaction
Content-Length
0
merge
ce.lijit.com/ Frame A0FF
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=87&3pid=2c55b0ff-e26e-43d5-94da-2bb3ffc74b65
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=87&3pid=2c55b0ff-e26e-43d5-94da-2bb3ffc74b65
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
63.251.114.182 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap7ewr1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
//ce.lijit.com/merge?pid=87&3pid=2c55b0ff-e26e-43d5-94da-2bb3ffc74b65
date
Sun, 05 Dec 2021 01:50:26 GMT
cache-control
no-cache, no-store, must-revalidate
alt-svc
clear
content-length
0
via
1.1 google
merge
ce.lijit.com/ Frame A0FF
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=0&gdpr_consent=
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&partner_url=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D16%263pid%3Da48c01...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&partner_url=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D16%263pid%3D...
  • https://ce.lijit.com/merge?pid=16&3pid=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&gdpr=0&gdpr_consent=
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=16&3pid=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
63.251.114.182 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ap.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:27 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap7ewr1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
https://ce.lijit.com/merge?pid=16&3pid=a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341&gdpr=0&gdpr_consent=
date
Sun, 05 Dec 2021 01:50:27 GMT
via
1.1 google
alt-svc
clear
content-length
0
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
FEQI3YLXoAgiP_k
pbs.twimg.com/media/ Frame 4BD7 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/FEQI3YLXoAgiP_k?format=jpg&name=small
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:1410:489:141e:20bb:12f6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8094) /
Resource Hash
a21060b05b4e4a70e3f9d26413bd3ee7222944ecb0ea68c3b137c209ff4986b5
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
x-content-type-options
nosniff
age
458358
x-cache
HIT
content-length
37091
x-response-time
20
surrogate-key
media media/bucket/6 media/1460301926650847240
last-modified
Mon, 15 Nov 2021 17:39:25 GMT
server
ECS (cha/8094)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
d9faa5a03141f38823431708ac924b0853bf92befa2b6d0f23892c28db1415ec
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
MZcvnhsY_normal.jpg
pbs.twimg.com/profile_images/901783088908394496/ Frame EF1B 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/profile_images/901783088908394496/MZcvnhsY_normal.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:1410:489:141e:20bb:12f6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81DD) /
Resource Hash
bc740c3112caddaec0203f975f014756ba0aad2b52b76029e0752193bfa2829d
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
x-content-type-options
nosniff
age
451888
x-cache
HIT
content-length
1655
x-response-time
19
surrogate-key
profile_images profile_images/bucket/8 profile_images/901783088908394496
last-modified
Sun, 27 Aug 2017 12:24:57 GMT
server
ECS (cha/81DD)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
4a3c3795c2e2e007210b6802ebc8e51691c0ffa7542247157eb37e64f5520406
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
FEQI3YLXoAgiP_k
pbs.twimg.com/media/ Frame EF1B 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/FEQI3YLXoAgiP_k?format=jpg&name=small
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.vendors~ondemand.TimelineList~ondemand.TimelineProfile~ondemand.Tweet.29715ca2e27538cc4c88.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:1410:489:141e:20bb:12f6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8094) /
Resource Hash
a21060b05b4e4a70e3f9d26413bd3ee7222944ecb0ea68c3b137c209ff4986b5
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
x-content-type-options
nosniff
age
458358
x-cache
HIT
content-length
37091
x-response-time
20
surrogate-key
media media/bucket/6 media/1460301926650847240
last-modified
Mon, 15 Nov 2021 17:39:25 GMT
server
ECS (cha/8094)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
d9faa5a03141f38823431708ac924b0853bf92befa2b6d0f23892c28db1415ec
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
css
fonts.googleapis.com/ Frame 3D96 		3 KB
579 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sun, 05 Dec 2021 01:36:32 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sun, 05 Dec 2021 01:50:26 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 05 Dec 2021 01:50:26 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 3D96 		1 KB
894 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:37:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
803
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
853
x-xss-protection
0
server
cafe
etag
7170004918125193417
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:37:03 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 3D96 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
615050cfd7cd77d6941c6c0b4551d20c4d5ad825bc9fd7acc61a0bdca7783d26
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:40:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
572
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7857
x-xss-protection
0
server
cafe
etag
2255741555227857113
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:40:54 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 3D96 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:47:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
185
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:47:21 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 3D96 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:50:26 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 3D96 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:49:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
73
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6446
x-xss-protection
0
server
cafe
etag
5472324691301332805
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:49:13 GMT
163b3e9c260ab6fd774ac5b5c6fd1d76.js
www.gstatic.com/mysidia/ Frame 3D96 		27 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:48:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
113
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11360
x-xss-protection
0
last-modified
Tue, 16 Nov 2021 04:29:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="mysidia"
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Sat, 05 Mar 2022 01:48:33 GMT
9427dd0d-835c-471c-a5db-ab01ae8a681c
consumer.krxd.net/consent/get/ Frame 96B8 		234 B
316 B 		Script
General
Check archive.org
Download Go to
Full URL
https://consumer.krxd.net/consent/get/9427dd0d-835c-471c-a5db-ab01ae8a681c?idt=device&dt=kxcookie&callback=Krux.ns.investingchannelinc.kxjsonp_consent_get_0
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf13909e69973de02d10a27b45e2822a566a81c5bc681bc209c9083e1b65d4d9

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
via
1.1 varnish
age
0
x-served-by
consumer-a013-ash-prod.krxd.net, cache-yul12823-YUL
vary
Accept-Encoding
x-cache
MISS, MISS
content-type
text/javascript; charset=UTF-8
content-encoding
gzip
cache-control
max-age=1800
x-age
0
accept-ranges
bytes
x-timer
S1638669027.722536,VS0,VE20
content-length
193
x-cache-hits
0, 0
FEQOmmqXoAUOa_b
pbs.twimg.com/media/ Frame EF1B 		67 KB
68 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/media/FEQOmmqXoAUOa_b?format=jpg&name=small
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:1410:489:141e:20bb:12f6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/81BB) /
Resource Hash
2383416635c3508794c060f27958892f5d093d8c58c9484f968fd4e1d0c27857
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
x-content-type-options
nosniff
age
458850
x-cache
HIT
content-length
69062
x-response-time
19
surrogate-key
media media/bucket/8 media/1460308235550957573
last-modified
Mon, 15 Nov 2021 18:04:29 GMT
server
ECS (cha/81BB)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
73b0c8f949c46f3a52b951710c6bc47a626ada97995cfc84f237366530e9cad0
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
SPug
simage4.pubmatic.com/AdServer/ Frame 9BAF 		0
260 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156592&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&SPug=true&p=156592&s=&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3D38868d4c88eb47018e4265d2b8cd3a09%26DemandPartnerName%3DPubmatic%26DemandPartnerUserId%3D&userIdMacro=&gdpr_consent=&gdpr=0&us_privacy=&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
amp4ads-v0.mjs
cdn.ampproject.org/rtv/012111011823000/ Frame 555F 		189 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
98ba8f881333898d751dabe4f8b4cacc4489a9f5b6b4fd1fc67c571dbfec95cf
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250245
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
55592
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:41 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"11dee2040f5fc1d7"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:41 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 555F 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
65f6185cfe1cf88fa7981160dd6fa443e111887215b72953718ea70f8e2ba9f2
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250242
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4992
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"858600ba27ef7413"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:44 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 555F 		89 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-analytics-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e97fc43ecd2f16948c3a8d2de65e0e5483db4ed5ab174058c178ca1c8665d0b
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250236
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28555
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a64e482645fd262b"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:50 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 555F 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-fit-text-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3d76ab4ac854cafef51bbbb5177ea75816df90e3c775294991a016404f2b6bb5
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250242
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1731
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"cb4f0e89d7d37d9b"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:44 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 555F 		40 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-form-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a630b852e94f20cb8140704fd830bf40bfea0a2effaa67d06a0eadafbf3d508
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250242
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12826
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f02165e023e70703"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:44 GMT
3475078732409437776
tpc.googlesyndication.com/daca_images/simgad/ Frame 555F 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/3475078732409437776
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5690b289c02e28c255f52e917dc2ebd80dfbb5cdd3c23b68d20b220a6946f2dd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 16:29:40 GMT
x-content-type-options
nosniff
age
379246
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36120
x-xss-protection
0
last-modified
Wed, 03 Nov 2021 07:08:36 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Wed, 30 Nov 2022 16:29:40 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 555F 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 04 Dec 2021 19:49:59 GMT
x-content-type-options
nosniff
server
cafe
age
21627
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Sun, 05 Dec 2021 19:49:59 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 555F 		295 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 00:17:40 GMT
x-content-type-options
nosniff
server
cafe
age
5566
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Mon, 06 Dec 2021 00:17:40 GMT
l
www.google.com/ads/measurement/ Frame 555F 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRVOU6h6MYJcmDBYY7dTJfNw6wMm7aQ2yrTa3lVC5eYx-m3a8gsCL2NWJ8pZE6MGLPAdi1pD7iHCgxOBKejMJ6i4wSPJg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
adview
securepubads.g.doubleclick.net/pagead/ Frame 555F 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=Ck0y04RqsYa37DdD5hQah2rGwCtalrZdmpsHJu_sO-9X0_QgQASDHg_wBYP3oooHwA6ABj7OOvwPIAQLgAgCoAwHIAwiqBLwCT9AUk6BKm0KrcqVOYpJvdSBSIDpCwKJQ9-LwYfG5-8pEuu8TwONTvonfe0P_uUoNO5NR4mSDCr5a8LJ6p5ZFSab7PDhHm6m7NGOfPO4dwq6XTB377Qi4fs3Oo0mf94oJZ9kiZ3DPf4GzgPDdq0r-TtySeXqjCaQemmhrL8nWrt65Guh0gJY7PmRfNsxxFVFmTX0drXkndrd3JkldyCvkpb3obgWINZ_6KeAC_F1Ylmt2v4cNPEHPo1gbEMxojZT1u9zBGFQd4t7n1WCnOBcJotV4vRAWRieobS3LaOqi8nUaL2IInA9EaktT8wv-u6V18Gi_SdQ8GgF-3i5Wtq08q2LZnmyWl5j8vBgbjYtzASjRvXXHFjmv1nAvHAcBJe5coL8ExZ2DMVfRCPpDWhbniW_tLmaaV4YxkIK5PsAEyZmY8uYD4AQBoAYCgAetpL20AagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEMq9NNIIBwiAYRABGB2ACgHICwHYEwPQFQGAFwGyFx4KHAgAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxi6yBc&sigh=cxbcBJ5I29Q&uach_m=[UACH]&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
truncated
/ Frame 555F 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
de13411ecb248055399e449614ccd4dec1917b3b2ddde23abc86cf2e0f02cc5f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
ecm3
s.amazon-adsystem.com/ Frame E081
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us
  • https://s.amazon-adsystem.com/ecm3?id=KWSL87CK-1M-EIIR&ex=d-rubiconproject.com&status=ok
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=KWSL87CK-1M-EIIR&ex=d-rubiconproject.com&status=ok
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol
HTTP/1.1
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
R6MD7R6YPAFNXV82NW5R
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://s.amazon-adsystem.com/ecm3?id=KWSL87CK-1M-EIIR&ex=d-rubiconproject.com&status=ok
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
2dd9fa24169fa04536d533da131679f8
Expires
0
5itnu6hP_mini.jpg
pbs.twimg.com/profile_images/1062794957721821184/ Frame EF1B 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/profile_images/1062794957721821184/5itnu6hP_mini.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:220:1410:489:141e:20bb:12f6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (cha/8093) /
Resource Hash
1bf67ddd4ac63675d2dd65b5a3e619a158ce5defdca73301641a8db052b8e4f4
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:26 GMT
x-content-type-options
nosniff
age
37607
x-cache
HIT
content-length
1451
x-response-time
13
surrogate-key
profile_images profile_images/bucket/4 profile_images/1062794957721821184
last-modified
Wed, 14 Nov 2018 19:48:38 GMT
server
ECS (cha/8093)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
97a924e3e5e7e337cfa3ebcafeeda0e79583ff683363cd2a28cb955bb025d736
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
ad-engine-response.gif
trk.vidible.tv/trk/ Frame 38B2 		0
0
bc2
bc-ssb-cle.springserve.com/ Frame 5207 		20 B
214 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bc-ssb-cle.springserve.com/bc2?r=877481a9-cccb-441a-82f8-d681acb33b87-s.514171-d.528021-dc.132380&aid=962&det_d=www.bleepingcomputer.com&det_w=834
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.16.251.19 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-16-251-19.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:27 GMT
access-control-allow-credentials
true
server
nginx
content-length
20
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
truncated
/ Frame 1CBD 		210 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
159d540f536547514b9d4f47cd80b9deed921a73dcf11b0512a2acab501cf20d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
s
googleads.g.doubleclick.net/pagead/drt/ Frame 6DDB 		143 B
163 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Sun, 05 Dec 2021 01:06:43 GMT
server
cafe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
2624
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
usermatch.gif
beacon.krxd.net/ Frame 96B8
Redirect Chain
  • https://usermatch.krxd.net/um/v2?partner=google
  • https://cm.g.doubleclick.net/pixel?google_cm&google_nid=krux_digital&google_hm=T2hZc0MtM0k
  • https://beacon.krxd.net/usermatch.gif?google_gid=CAESENlb1Fb-8SqRc2a3MPiWNd4&google_cver=1
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?google_gid=CAESENlb1Fb-8SqRc2a3MPiWNd4&google_cver=1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
18.213.185.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-185-73.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
cache-control
private, no-cache, no-store
x-request-time
D=28 t=1638669027
x-served-by
beacon-n031-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:27 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://beacon.krxd.net/usermatch.gif?google_gid=CAESENlb1Fb-8SqRc2a3MPiWNd4&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
291
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usermatch.gif
beacon.krxd.net/ Frame 96B8
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=krux_digital&google_cm&google_hm=T2hZc0MtM0k
  • https://beacon.krxd.net/usermatch.gif?google_gid=CAESENlb1Fb-8SqRc2a3MPiWNd4&google_cver=1
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?google_gid=CAESENlb1Fb-8SqRc2a3MPiWNd4&google_cver=1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
18.213.185.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-185-73.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
cache-control
private, no-cache, no-store
x-request-time
D=30 t=1638669027
x-served-by
beacon-n012-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:27 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://beacon.krxd.net/usermatch.gif?google_gid=CAESENlb1Fb-8SqRc2a3MPiWNd4&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
291
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usermatch.gif
beacon.krxd.net/ Frame 96B8
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=krux&ttd_tpi=1&ttd_puid=OhYsC-3I&gdpr=0
  • https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
18.213.185.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-185-73.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
cache-control
private, no-cache, no-store
x-request-time
D=54 t=1638669027
x-served-by
beacon-n024-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:27 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://beacon.krxd.net/usermatch.gif?partner=ttd&partner_uid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
227
379708.gif
idsync.rlcdn.com/ Frame 96B8 		42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/379708.gif?partner_uid=OhYsC-3I
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:27 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
jot
syndication.twitter.com/i/ Frame 4BD7 		43 B
165 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1638669027077%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22FCP%22%2C%22component%22%3A%22performance%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%229fd78d5%3A1638479056965%22%2C%22dnt%22%3Afalse%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22BleepinComputer%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22BleepinComputer%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22320980a%3A1637165373563%22%2C%22item_ids%22%3A%5B%221460302706954981385%22%5D%2C%22item_details%22%3A%7B%221460302706954981385%22%3A%7B%22item_type%22%3A0%7D%7D%2C%22duration_ms%22%3A2768.8999996185303%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
11
pragma
no-cache
last-modified
Sun, 05 Dec 2021 01:50:27 GMT
server
tsa_b
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
a4f736c600a14401d9ff31c2261c0d6df3cbac33d47e1b17cfb86291c13cb494
x-transaction
e7d7fc1a1d2189e1
expires
Tue, 31 Mar 1981 05:00:00 GMT
usermatch.gif
beacon.krxd.net/ Frame 96B8
Redirect Chain
  • https://stags.bluekai.com/site/26357?id=OhYsC-3I&redir=https://beacon.krxd.net/usermatch.gif?_kuid%3DOhYsC-3I%26partner%3Dbluekai%26bk_uuid%3D%24_BK_UUID
  • https://beacon.krxd.net/usermatch.gif?_kuid=OhYsC-3I&partner=bluekai&bk_uuid=$_BK_UUID
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?_kuid=OhYsC-3I&partner=bluekai&bk_uuid=$_BK_UUID
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
18.213.185.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-185-73.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
cache-control
private, no-cache, no-store
x-request-time
D=20 t=1638669027
x-served-by
beacon-n022-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location
https://beacon.krxd.net/usermatch.gif?_kuid=OhYsC-3I&partner=bluekai&bk_uuid=$_BK_UUID
Date
Sun, 05 Dec 2021 01:50:27 GMT
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
p
sb.scorecardresearch.com/ Frame 96B8 		64 B
443 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/p?c1=9&c2=8188709&cs_xi=OhYsC-3I&rn=1638669027
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.37.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-37-62.ewr53.r.cloudfront.net
Software
/
Resource Hash
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
via
1.1 8e7c396366d89944c10dfabcfcb15b3d.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-C2
etag
W/"40-jHLN3x5dWpBzaQm4lkBmDWvrjrg"
x-cache
Miss from cloudfront
content-type
image/gif; charset=utf-8
content-length
64
x-amz-cf-id
b8oEGznobZEjTu7kyjnXuLaHi4j74Mb-K6mxEYb3J501QH5vVTwiQg==
match
ps.eyeota.net/ Frame 96B8 		0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ps.eyeota.net/match?bid=i0r4o4v&uid=OhYsC-3I
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-231-251-31.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:27 GMT
Content-Length
0
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
usermatch.gif
beacon.krxd.net/ Frame 96B8
Redirect Chain
  • https://ib.adnxs.com/getuid?https://beacon.krxd.net/usermatch.gif?adnxs_uid=$UID
  • https://beacon.krxd.net/usermatch.gif?adnxs_uid=7205020425431634120
0
338 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?adnxs_uid=7205020425431634120
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
18.213.185.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-185-73.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
cache-control
private, no-cache, no-store
x-request-time
D=28 t=1638669027
x-served-by
beacon-n009-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:27 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
5169ec1c-e3cc-417f-803b-9d01a3862b34
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://beacon.krxd.net/usermatch.gif?adnxs_uid=7205020425431634120
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
image.sbxx
ib.mookie1.com/ Frame 96B8
Redirect Chain
  • https://global.ib-ibi.com/image.sbxx?go=247532&pid=314&xid=OhYsC-3I
  • https://ib.mookie1.com/image.sbxx?go=247532&pid=314&xid=OhYsC-3I
120 B
982 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.mookie1.com/image.sbxx?go=247532&pid=314&xid=OhYsC-3I
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
64.58.232.177 , United States, ASN13649 (ASN-VINS, US),
Reverse DNS
be31-199.crrt01.las04.flexential.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
42b601bc0d93dfca6e350b46d113bf8e7ff9e40a87a0c57ab9b3c9c219062423

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:26 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
p3p
CP=\"DSP COR ADM DEV PSA PSD OUR\", CP="DSP COR ADM DEV PSA PSD OUR"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
X-Server
LAS09
Content-Type
image/png
Content-Length
120
Expires
-1

Redirect headers

Date
Sun, 05 Dec 2021 01:50:26 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Location
https://ib.mookie1.com:443/image.sbxx?go=247532&pid=314&xid=OhYsC-3I
p3p
CP="DSP COR ADM DEV PSA PSD OUR"
Access-Control-Allow-Origin
*
Cache-Control
private
X-Server
LAS07
Content-Type
text/html; charset=utf-8
Content-Length
193
usermatch.gif
beacon.krxd.net/ Frame 96B8
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dpubmatic%26partner_uid%3D%23PM_USER_ID
  • https://beacon.krxd.net/usermatch.gif?partner=pubmatic&partner_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?partner=pubmatic&partner_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
18.213.185.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-185-73.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
cache-control
private, no-cache, no-store
x-request-time
D=30 t=1638669027
x-served-by
beacon-n021-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://beacon.krxd.net/usermatch.gif?partner=pubmatic&partner_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
date
Sun, 05 Dec 2021 01:50:27 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
398696.gif
idsync.rlcdn.com/ Frame 96B8
Redirect Chain
  • https://fei.pro-market.net/engine?mimetype=img&du=88&csync=OhYsC-3I
  • https://idsync.rlcdn.com/398696.gif?partner_uid=8886311284053265284
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/398696.gif?partner_uid=8886311284053265284
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.krxd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:27 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:26 GMT
via
1.1 google
server
Apache-Coyote/1.1
access-control-allow-origin
*
anserver
gapp4.c.datonics-gcp-01.internal
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location
https://idsync.rlcdn.com/398696.gif?partner_uid=8886311284053265284
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
clear
content-length
0
expires
Mon, 1 Jan 1990 0:0:0 GMT
container.html
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CAA3 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Sun, 05 Dec 2021 01:50:25 GMT
expires
Mon, 05 Dec 2022 01:50:25 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
container.html
05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3FAD 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Sun, 05 Dec 2021 01:50:25 GMT
expires
Mon, 05 Dec 2022 01:50:25 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
jot
syndication.twitter.com/i/ Frame EF1B 		43 B
119 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1638669027205%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22FCP%22%2C%22component%22%3A%22performance%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%229fd78d5%3A1638479056965%22%2C%22dnt%22%3Afalse%2C%22widget_id%22%3A%22twitter-widget-1%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22BleepinComputer%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22BleepinComputer%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22320980a%3A1637165373563%22%2C%22item_ids%22%3A%5B%221460308766767915013%22%5D%2C%22item_details%22%3A%7B%221460308766767915013%22%3A%7B%22item_type%22%3A0%7D%7D%2C%22duration_ms%22%3A2801.5%7D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
11
pragma
no-cache
last-modified
Sun, 05 Dec 2021 01:50:27 GMT
server
tsa_b
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
a4f736c600a14401d9ff31c2261c0d6df3cbac33d47e1b17cfb86291c13cb494
x-transaction
d82f9e2afdb36ff9
expires
Tue, 31 Mar 1981 05:00:00 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame 555F
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Redirect headers

date
Sun, 05 Dec 2021 01:50:27 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
pagead2.googlesyndication.com/bg/ Frame DD10 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6610f6e5ebf811f47e5c53f5f536df0e8f431dc31af4618cd5c0e53ef5443374
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 18:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
113699
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13522
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 18:15:28 GMT
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame D170 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102984
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
9Za3gPbkKx712asWRXoW89pPjmpBC150Q_56NpIe9zo2C0XUypysrg==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame D170 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1445066
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
LO--R9fZpxn928rmG5qJuNy8Sbd5VNl-GazVV-FlxGFbQqZ-1kpFig==
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame D37A 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102984
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
QMvM5cEfbm-ooPBIyTtDzFUsSaqHs5rL6q43o4mXpnHNmlapGfGBGg==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame D37A 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1445066
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
w1mhTE6iOBweVd4yd3P5bAMnR5pPc4r37r9wDngHuYsh9RLTrCI6rg==
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame F076 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102984
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
HnIWuceYig2NRoHJjJgAYCmy6aaPXyA9EKXn49bzkC8npGI0hH7_Ig==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame F076 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1445066
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
scYR8LCtqAtSj_zyuqBo5VcKbfR1lQy0y1VVQ4BteOshHD-pA9HS2g==
prebid-universal-creative.js
a.pub.network/core/ Frame F076 		26 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/prebid-universal-creative.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9642f5fbeff6a11fd1e8d29f62481cc23514472fb51d0d1e4ee4f257dbc8af3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-goog-hash
crc32c=Mv5J2Q==, md5=qhZ9KavhQaYEZZQvkPC+nQ==
date
Sun, 05 Dec 2021 01:50:27 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
17911
x-guploader-uploadid
ADPycdsekqr_XRLaJHWG_rCg_D2pScsUPeqoeAM_N2cnjtR_Bc1P6OK0aSlVtjMxLNFFviiiA6nxI7e_5Gzxgamy595TKPuepQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Tue, 28 Sep 2021 15:52:36 GMT
server
cloudflare
etag
W/"aa167d29abe141a60465942f90f0be9d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WFhdCeIzF3gqVw%2BNCPduryJwLB%2FgdQ27onh9PFuUES7MB5y6siJC1%2Ftjsr1MFf1ShiT7oNR7bi%2F2zHhvuB8bPauDHrxL%2FwAmi%2FtytiMXaJc4OC9HXyOn6HgfYKI3K0YsKUTQKZOW5mFFIqA%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1632844356805025
access-control-expose-headers
*
cache-control
public, max-age=86400
x-goog-stored-content-length
26661
cf-ray
6b899fad99057138-YUL
expires
Sat, 04 Dec 2021 21:51:56 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame F076 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:50:27 GMT
3475078732409437776
tpc.googlesyndication.com/daca_images/simgad/ Frame 555F 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/3475078732409437776
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5690b289c02e28c255f52e917dc2ebd80dfbb5cdd3c23b68d20b220a6946f2dd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 16:29:40 GMT
x-content-type-options
nosniff
age
379247
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36120
x-xss-protection
0
last-modified
Wed, 03 Nov 2021 07:08:36 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Wed, 30 Nov 2022 16:29:40 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 555F 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 04 Dec 2021 19:49:59 GMT
x-content-type-options
nosniff
server
cafe
age
21628
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Sun, 05 Dec 2021 19:49:59 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 555F 		295 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 00:17:40 GMT
x-content-type-options
nosniff
server
cafe
age
5567
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Mon, 06 Dec 2021 00:17:40 GMT
i
vid-io-cle.springserve.com/vd/ Frame 5207 		0
123 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid-io-cle.springserve.com/vd/i?suuid=877481a9&ps_id=514171&batch=1
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.19.190.206 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-19-190-206.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:27 GMT
access-control-allow-credentials
true
server
nginx
content-length
0
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
830b8ca5f78f00f8a0d79813f2ba95b0a7efd1ee7536567b5c25219323f3209b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:50:27 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame CAA3 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102984
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
EmncHfeaRG78IESP8fkjmFQIXyrHlLRi313YzA6bMcx8ImuZYe5UtA==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame CAA3 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1445066
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
alaIqfGEg0o51EaD_na3dNxoZ0g3xMidthbqgjrdUSiLrLMag7sj_Q==
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame 3FAD 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
102984
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
h9QHm41Xl-GKCH-bSQ8qG5qyvFij1IogAeBTsQrJQzdhblW6wQIaCA==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame 3FAD 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1445066
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
UMC_-mP5elH1tBPmdLSk-PPCDEP2tSxA5EJU_XH1GZ_qtMJDx9B5Ag==
gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FAD 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BqgofZLaPd5n1dC8OYdfXbj93u2F1n4J__6x8LU1LiEHR81up3YbdMNMBR656MRr5hnoNJGaTCo24HAZpLEOih-jk6evEcvNYCi1yvYdUiouaTlP4
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 3FAD 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:47:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
188
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:47:21 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 3FAD 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:50:28 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 3FAD 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:49:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6446
x-xss-protection
0
server
cafe
etag
5472324691301332805
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:49:13 GMT
l
www.google.com/ads/measurement/ Frame 3FAD 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRg6b0fww302XiaeBH0mDtY8q2tjYb1vzQoz6uiY5sUmLgBei3CpDIRvkTjIR1Ux42jykBoZjjq5mtfz-jMXv4kLWB8FA
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
amp4ads-v0.mjs
cdn.ampproject.org/rtv/012111011823000/ Frame D170 		189 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
98ba8f881333898d751dabe4f8b4cacc4489a9f5b6b4fd1fc67c571dbfec95cf
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250246
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
55592
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:41 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"11dee2040f5fc1d7"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:41 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame D170 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
65f6185cfe1cf88fa7981160dd6fa443e111887215b72953718ea70f8e2ba9f2
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250243
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4992
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"858600ba27ef7413"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:44 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame D170 		89 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-analytics-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e97fc43ecd2f16948c3a8d2de65e0e5483db4ed5ab174058c178ca1c8665d0b
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250237
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28555
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a64e482645fd262b"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:50 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame D170 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-fit-text-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3d76ab4ac854cafef51bbbb5177ea75816df90e3c775294991a016404f2b6bb5
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250243
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1731
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"cb4f0e89d7d37d9b"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:44 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame D170 		40 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-form-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a630b852e94f20cb8140704fd830bf40bfea0a2effaa67d06a0eadafbf3d508
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250243
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12826
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f02165e023e70703"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:44 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D170 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 04 Dec 2021 19:49:59 GMT
x-content-type-options
nosniff
server
cafe
age
21628
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Sun, 05 Dec 2021 19:49:59 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D170 		295 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 00:17:40 GMT
x-content-type-options
nosniff
server
cafe
age
5567
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Mon, 06 Dec 2021 00:17:40 GMT
16671416518648662386
tpc.googlesyndication.com/simgad/ Frame D170 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/16671416518648662386?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4ql7u5ijPUp3V4_z0HR5qjE1SURNeA
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08253d87a709e4edc03a486de4e4c50c343bcc88d87e6e6aa06473b41f274586
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 04:36:18 GMT
x-content-type-options
nosniff
age
76449
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6536
x-xss-protection
0
last-modified
Mon, 01 Nov 2021 12:21:12 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sun, 04 Dec 2022 04:36:18 GMT
l
www.google.com/ads/measurement/ Frame D170 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSWNMjRYrZbgucRNsqsGiWd4zXMCbUwWzfKEcnRpy19pvZL7hfRe4WfQrhFeCESYnTvWB0J3lergH-HjPtvJB_km_9nRw
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
adview
securepubads.g.doubleclick.net/pagead/ Frame D170 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CV79F4hqsYZ-ZAYCCrr4PqtO8wAXWpa2XZo6bg6bpDvvV9P0IEAEgx4P8AWD96KKB8AOgAY-zjr8DyAEC4AIAqAMByAMIqgTDAk_QDP6niafrH-t4LP4zcNedL9WoMYa_6UPd2Y_r9hcxKisqniyNw7y-PW8ACWj98Bd68_DRqas-p-ebsoplCmZwopp4s142K1ZIdz9MH4eWQw1a2nCHlIyk21mWzetLs-WYrbrQGtBOvma3flkZx4GUZWl6TWCI4VjmEmkJG3XiXHXORJZaw4_XbH8D9TdIfojaTL3b6vzA51_H1fF08IM60jpl45puvJUrqimHENso3wv1K9nIaUao52_GVtzpEfKQulGWvPA33UyH-SHiNf-6_cWhJX7Ifd3c5FraIbFl07KsEKFtwXX6R8f067f1st3ZjKpKUDRBniTdDniDR93tqAed-bKhpGHpoXrG78Lb3PMeh81cv1l3fxkklR4fqtIGj50fZVNCgM7TtNu0N4OfUr62gN2ZpH3c1u-UO5yhfQncwATJmZjy5gPgBAGgBgKAB62kvbQBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQpqkj0ggHCIBhEAEYHYAKAcgLAdgTA9AVAYAXAbIXHgocCAASFHB1Yi0wOTIwODk5MzAwMzk3ODIzGLrIFw&sigh=FAfm_k-yq10&uach_m=[UACH]&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
truncated
/ Frame D170 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9b13f85dfc7be258d7cd95879c88b3938d3f507a2202b3239f641f8f49538fc3

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame F076 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstkPz4YF-2OgFy0XgQHe7oNO5kvMCH97wE1NTbjDENuG2iUuIPCjNgsyF3nwoBgiaD8EEZMRVE0kTWwLs383fuC2m-JjTrRgYud1aOx1vT_wDCeAXPmE5LsvWzMRyE-LavBMtK_jZCSSq6ZFS8OzNnSn0TaE8e8bfQ3OJuiaBlItfMwmVz4UBjdAYisY7EAm8l9QyQPo19lwPnWxvSDoYew_vDSipY09XcZMTHelcVPTpPy9bxOTY99zS38HgdIQpliQ6AjczIUZLlSech-L76FQgHT6f740Aw2G4fhH2KURYR76d11HuHA7qohKwmHDXZGnNCVWaw9F1508dd7F9yqLDPpLkZCrG-uFtwayxTUjwGwy877rzo&sig=Cg0ArKJSzFMMFdR_lrMSEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:27 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
pixel
googleads.g.doubleclick.net/xbbe/ Frame 5BA3 		663 B
313 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNVn6b8kjre-WFWj1Q8gmuqvv9JDEEwLMYhLL6I0Uinnq_41P6MglyxdCtTJRakeTxEM4TUbviutxSNoIfDgwM1GSE1PkQ
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
962d6dea088b031cd44d33f937adb5ba241a9435aa32a8be667d57482b8bbe1a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Sun, 05 Dec 2021 01:50:28 GMT
server
cafe
cache-control
private
content-length
292
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ad
googleads.g.doubleclick.net/dbm/ Frame F076 		59 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BKt9czCf7l7u1Y1iF0xvfZQkZQsyC4OmxEjy_HSsOKsljSQuKnl1Jj9ygcF_5FaChDdm_rkWK3nINJNm-b9vYQvjie2r3f2D93XicoTupY1kT5WEVyJdKbvCZ2QIVclM-qa3VGoeLsIQKt54jmMFr6hcSlxQ&dbm_d=AKAmf-BDZ2w-24OatvdznlW0anudT_WAEFFkt5thlsDg6OlOuXoX72AEZEjTdvDRP7q1sMEjLHD9GSG6rPMrqwS5Bn0wxc2fkX0HJiBXBp93t4f5pe9icfeYu7Y6cwmYHTnwlCKd1kFhY9xTN_Ndz6gR-GFeswprK2yDaFoYBmTnlyCa20rJU_TJZLZjW1tHylmMctvZ6KI1DKaGLONLZNKdvj_hPg5_MMPG4qO75KsXYb5bexHvcsxPA3jI9SUEdpZFU9cUddVbhXUgusQynT8S5TcfKCIOpnBNC6QmWbN3cMgNcu_b5NrRYCxOjHPo3bHFNI5vpSatWXmOPdEoppFVSW3E5DtWxKIA2jI8jOtdwaryBTdTYmCK4l8nFiLv382a5uimAh3qHHXgq11_qEgFfSUs7dSoXz58dm-ndTPLzeaN-9wKpTSZtjz48o3rmFJlFdULlwpY_34TM4FCejzZIuMF9AY2D7NCPcwA8lRRzzayqw2zE0VGSO4eHil8kehoWTgD-r4Yygt8UUGgted10vq3BYWFu8iUigsh8NvaK6DBN9P8xejMyv7DrsPIOeXCvS6KG1wS9j_v9JbZVY46O-NzIe2vvI5mvr5huaWnQwAm3svKTNyEVNlLQVZ504hgbz3YBCllfGpfrt3azHRQB1l2gmSBmdb2LPZ-7t3XB0bKLKEyvjW33x3c4Lsb-YU6ysv5NnZW2cjaCPQaBldeEERc_0vNu9qBVNKOxXPpqCbrMcMa0JF9EafWV2wI-zhzsp1amHHT6Xwbv-nNAjBxr6fFncC1T95Jzi5Q6GFJHe9eMmQGatpeIiPgqqcPA5jR61J1CI3ccrVtpuymBICEfpBKdzq30_HL6du9xjwYyYav8vn5FM9N5Av7k95ZY55KuhKgoP9FYKuLitOnTnkT9-TemrYtJ3kMWvEVJFS4LwJ6yEw8KPS6Vb_89mf48wITj-lKloyxIlQ1MvomdpGeSjTn94-i01et7cFbC1NE9HvubKnfGCLrTlmUEzuCYjweq8fKQiXpd7GQ3v2nxkQTkjU4Wm3ucXX6qkVd22heGuJehwkZD50iNmfg1eHlLq6zTTmBp14HRXbn6obPDKKFVyGWBPFgW2UtmNNiw4pxX6SRBHOBvizjQuxMuVuKJH9MOA2Dpbd_laBq_kYj1c1vI7pHfrhnMjeiv09V_WuzIQXKldUNAPRgPW6odTVIh2wt3CilTs2ef9S-ChWJ1bKwGYlkYZLCqLDlUmDZcSidkkld32Ka_6mHmRkC-DGbFFVV-BbUp4l7zOPpZaSOhL-flQ-Efp_Kdx7hO4B4A3Hu89sTdNnpg1I_OsplsMFbjjg3-0LL4K-ERn4xKq7Rd-Jt5akOtyyV22mRgcmKm9pbTPDkcYWWgCvzBHEO1At96p7dWvE26jyK1VMHZETSUmb6TyOOnUID4qKb9Z8HMo1rHDBJb-NxZP8ZgHvAhKwt5PglBp7zV-4vaTdzkYVEELDZwG7Qq3PJxohYNMP_u_7743OoV0tQoTT5mfblUE8V-izfgeXaWSHH_nZLywNC5PlC_Q_9HWUjVzptrcNfyod3b_sFurMVl37tGXasB5Wtb1Inv8KLtubK7w6NbA3MANLsXFA6Se4lP4NrllsynvSpsOtdooPozp-SGsUiEC17fvwsoFnjT-FtvuJKOEzr9uFS3TbdVXpn2dt_zj4rnxY9BPuhOIpkuNZnxv6Ou29LfmAHn0HV1PauxveqGFdcR0liG04D3U-KSSr-kOHo5GSk74BYrVE3czgMxuhDuRfUe9NxCgsmOFiDM38TjiIFkKCe1VVlMnRZMSsm7ECBFtSf1OJG_GS3azhCJr_8bEv1VfLhrR-a1K8ajxB0wFPxe8zj3qVhfXhiY_CkkAcsk3mY2A4Bkm0j7zdVMIxK7dKp6j0YtO-IugK5BKY-cUO9xpVgxk3ogrIQgLNTGtlafiewxLvUhxXlrhXvdWhSIsQiXuW2gbs_rJVDF3a4gNFp4yRm3h89U1f_zaXWlx8TvKFB91X0N7AFcQjiB9EDqMyxKcEMf2xiUG4URoI00kc7iNVW_4FzTCyobc2a_DjFC5oTh-joxJ5kdxfwLnpCKGOgegtXAIuuYz9sB7_cY8a38f6-IWkqb8wL2tHkF0AY9Nvl20L84wnANT9m83ATGVH3TDe-IrGS2s-phDbbfII3KPTtTn62qKETmiWp6CeqN946uJmKaJJwjrm2VALo7vWjZf03Ixjl17NKvXXKRNeivikck7AGQ6YRKTDwzUT151YtOf7TQVq_60MEwbbWyt5mTVKXd99bO_XWnxY4OLpq33yqDkcUyZtkOD3lnyiiRBSh05KQhYbFnTfLYR0Jo4Bl_IMWCkZMNnn5IIjRkedGhOF0pfUWGHxf8v40zalOVN-9WZQ11jZgI8f0Bz56bqUK8bIE8zpf5BYpBz8SijEkt85PeGkwxfnf0A2bcx_uELnb7bzzSdJfTXLn-JmmuNvLL5qbfGOfAqGzirg3mdG0_fY1EfcfQYQbxhtJ1zdNbH94Vq5rtBpXb5bh8ST1nQ6cnJrhYyThZA9m4pkYHgY2CnhqRGZoHUZRmJ1W-XxQt9MUgDN0egVg3z4IznKCgvs-Jl18EmyEUgeIGwFYWGjtdYCSvTCNEyLa4ct3d3FBtF0sBx2a9gqsS9Y1bGl_cVxlj80XoITn-ZrTWxlJFWlmJtrjcPPhRrftqJ5nsnWE11UuYd20_Yu_oZNxoOYSlsB9rqI4uAoqQMC62-D5vWydhAxE77Nt15gW0j6t5_y5NWjQ5l_8RM_78TpSsOM0ees6d5w-PmNlsJmFnIb7c7SREO6gZGWkva5YqIIRGZHghAPLndLJBWWo650b53LCB-c603VxH1b-pMWEW6HxgmKXTx25u87Gds-FZqG1i_33Pcfm9Y0LG5l-jYZtCQgvrGS_UUUfA6KLu80L-olQvSvl_6hQqiebD1485wQwIVfO-yXhKlH2c-eNMLeuZFd56BKfd8FJZ2kRpS0fBrI-IUlOlRCdaOYh-g3AQi1IEROTSQYb5n-gxf0Kc6MfDUFhX7fPTe9Ni9abXpGuII4yw7lKoJWwrXpRo-5QLcVS9m51vDSNUsz4bUH4TCbjd9tMTqImXvavIKgbDJlITBBIPfmKxHDyPysq1_rYAR0f07iEho0z-tJQ4umgdhg&pr=6:0.820620&cid=CAASEuRor-cyknJYxMG18BjeoalMXw&xfc=https%3A%2F%2Fclicktrack.pubmatic.com%2FAdServer%2FAdDisplayTrackerServlet%3FclickData%3DJnB1YklkPTE1NjY5NiZzaXRlSWQ9MjY5ODg1JmFkSWQ9MTMyNTE4MSZrYWRzaXplaWQ9MzImdGxkSWQ9NTk2NzMzODYmY2FtcGFpZ25JZD0yMjk4NyZjcmVhdGl2ZUlkPTAmdWNyaWQ9ODkwNjc5MzU0ODE2MTEyMDU2NSZhZFNlcnZlcklkPTI0MyZpbXBpZD0xNEFFMzBCQy0yNDA5LTQ5NkYtOTI0Qy0wNjJBMzA5MUEyMkUmcGFzc2JhY2s9MA%3D%3D_url%3D&rfl=1%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%240
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a0d7bcd34dfaa69f178ae55434f3657ca7ecd1dad47195056050fda980b6b7a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:28 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29441
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame F076 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D53WG5-KRTWPPtDma0JkXaKJwu7tR4HOCWaTwRUPZBE-haHplZsEiKmlQeYwoIDXP7LP7wt-UUtaHhvwjD6iL3Z5rpzfxRqObwtFx7sGoxtzRtQ8E
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:28 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
amp4ads-v0.mjs
cdn.ampproject.org/rtv/012111011823000/ Frame D37A 		189 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
98ba8f881333898d751dabe4f8b4cacc4489a9f5b6b4fd1fc67c571dbfec95cf
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250247
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
55592
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:41 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"11dee2040f5fc1d7"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:41 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame D37A 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
65f6185cfe1cf88fa7981160dd6fa443e111887215b72953718ea70f8e2ba9f2
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250244
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4992
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"858600ba27ef7413"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:44 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame D37A 		89 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-analytics-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e97fc43ecd2f16948c3a8d2de65e0e5483db4ed5ab174058c178ca1c8665d0b
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250238
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28555
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a64e482645fd262b"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:50 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame D37A 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-fit-text-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3d76ab4ac854cafef51bbbb5177ea75816df90e3c775294991a016404f2b6bb5
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250244
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1731
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"cb4f0e89d7d37d9b"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:44 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame D37A 		40 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-form-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a630b852e94f20cb8140704fd830bf40bfea0a2effaa67d06a0eadafbf3d508
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250244
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12826
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f02165e023e70703"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:44 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D37A 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 04 Dec 2021 19:49:59 GMT
x-content-type-options
nosniff
server
cafe
age
21629
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Sun, 05 Dec 2021 19:49:59 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D37A 		295 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 00:17:40 GMT
x-content-type-options
nosniff
server
cafe
age
5568
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Mon, 06 Dec 2021 00:17:40 GMT
11525031014867439381
tpc.googlesyndication.com/simgad/ Frame D37A 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/11525031014867439381?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qlhubT2vdaD6voQM8QbhV7ogQ10qw
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
20d4862129ad5615afc5b29dd246b14835eb2cd4fe745c8685a2c54fb0449d75
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 03:48:53 GMT
x-content-type-options
nosniff
age
79295
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
44652
x-xss-protection
0
last-modified
Mon, 01 Nov 2021 12:21:12 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sun, 04 Dec 2022 03:48:53 GMT
l
www.google.com/ads/measurement/ Frame D37A 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRXJMy--ZDmKPj6chC_AIn3J4GFihuUvaVkrZKQbLrW-V5wAqYGOmguWnlM065DfD3lbHVxLpDHRUsm6QjeG4zIvd1sqA
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
adview
securepubads.g.doubleclick.net/pagead/ Frame D37A 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=Cxukn4hqsYfWaAYCCrr4PqtO8wAXWpa2XZvaBs-LiDvvV9P0IEAEg2tfFOWD96KKB8AOgAY-zjr8DyAEC4AIAqAMByAMIqgTGAk_Qoe8kL1oLag-Y6ZYi49Oo72cZexuboWQiwJ1eRFG2EVm2UhtIv_JBO1iSArpiX6ju5xVgxviDDaYmMdlAXdPc95_w2pPYckTGH-aA9QaDX51q76ID6UPM5wNs1CIx4icz256Om-LG8plJSDNklCJLJMxuoFA6YRbwaGadjWWmAs_UWDW1oGqlDozhz_enHJKPkbjZiNCXeJhlS_AM0aLYHdV6K3sz2Ai3potdPwK3AFovdKR_0EQip4K7WA9_7y7sAMshSYfYFYZsYFc9Ouzr9fkIZEi2oPI7uztyXmYGBDhtSmSgtKniui7jNgMLeuxK3MLwaQ-y2h-urKV2TR6npyiOtKKWtd41-qiLtY_J_QqvH8RRLZUyt0MwmkBDgxv4UDb_4Gwvyl3zVz2sMzfyN56MESAliXTwmtdO5qcdy3Ie3M5zwATJmZjy5gPgBAGgBgKAB62kvbQBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQ1rsu0ggHCIBhEAEYHfIIG2FkeC1zdWJzeW4tMTc0MjI0OTYwMzI4OTA4M4AKA8gLAdgTA9AVAYAXAbIXHgocCAASFHB1Yi0zNjA1MjU3MzYwODUzMTg1GLrIFw&sigh=aB0O0aNyrLY&uach_m=[UACH]&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
truncated
/ Frame D37A 		210 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8049032115cf969bbac7204a640f9319e59809cc73ef88e307c6e4df27158404

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
si
googleads.g.doubleclick.net/pagead/drt/ Frame 6DDB
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
16 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211201/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Sun, 05 Dec 2021 01:50:28 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Sun, 05 Dec 2021 01:50:28 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Sun, 05 Dec 2021 01:50:28 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
pagead2.googlesyndication.com/bg/ Frame 374E 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6610f6e5ebf811f47e5c53f5f536df0e8f431dc31af4618cd5c0e53ef5443374
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 18:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
113700
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13522
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 18:15:28 GMT
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
830b8ca5f78f00f8a0d79813f2ba95b0a7efd1ee7536567b5c25219323f3209b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:50:28 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
activeview
pagead2.googlesyndication.com/pcs/ Frame 1CBD 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvHkIh7_kDp94xaLJ-owWDCW0ZQ0JVF0T7D7_78omphe7ifIMGRNACirP_IJgnSyeh0X7YqLL40lBEIQQojjwo5nQ8yNk6ysS-KHx1PoE6jsXWU_kK3P342UxTe2VLMu-cTWO6x89O3IXoasB_nQ0pS_tVhQLA1898u-bysOP4&sai=AMfl-YQpNMcFOC4f2KLSDFsUwN6kggHjKegTrh1Z4maI7ccXzUwRhLHD1pI3nq6YoLqjs2uvb3tX_aFLHa6Z&sig=Cg0ArKJSzElTxM1wGjttEAE&id=lidar2&mcvt=1404&p=0,1,124.25,1006&mtos=0,1404,1404,1404,1404&tos=0,1404,0,0,0&v=20211202&bin=7&avms=nio&bs=0,0&mc=0.97&if=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638669025844&rpt=1081&met=ie&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:28 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame F076 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2b2d2472f310f3a4c880947f473b8de3e58662291206e24a5426ee2bd64684ca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:49:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
73
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9494
x-xss-protection
0
server
cafe
etag
6798282995721486617
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:49:15 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame F076 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/omrhp.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:46:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
242
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3140
x-xss-protection
0
server
cafe
etag
17163059639670574047
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:46:26 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame F076 		0
24 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuCryt80Y28SiOjItDUDq24_Xt-MiVkEpdumprL-8hEzLRyo8Trp1hirc2R-biWh0QnuV-y1Qw3UbLmrO9bvl8-JXkbzzjeJk4H1pqNlV35RthBz28ZXwZrYr1CBMHDlloexlJaD_z5oZ34I5dk-PUe-VbvUcsmQme0_W-IyokunN7TbJsYl-K0gMFGStq6eJQiHiyqCVmoVCZiSUaTUclLxf6pNGoMl4ICkxXkLBpxoSAP5webcGTYI04nhkOoLizvauLypEfBm9-7BW_iBqH01t5i8zRBHq5PNM8ktPyTd7Wej-gKoPcKiHJB-_OJ7IVGY5hEAwaIClhNYeb8sSVtTci33S2enhn2ywbMZ1wkYQ8qIDLloF1x6mZbshYMv0eJCyzwaKj-l_xXmYmUXoqvhgDlVhw67QiN9sA_cFDfbxjyyHR8FYWVtLie-hJAgtEgjdr5yGczaML6wGCRxyGLC_KLpbgmde_D2zqhpZOV-ZCDE2_qq1h3UiHvPB5PRnWm3ipqy_xKUUrcDOEn3Lqax2TWmTRW7-MVpEuJxJtyY-482szvgIXQhRAsNXgdxFfGKe0WfexLgsILMDMV2MgvD7PDdu2r1Me1MzgAZQfO-YFXlyjPe7Bscs0aTXNCV7ZZ2d5l-e5wIjt_61ZBAkgSxxm__D4UhGFk5FtGLov0Pv-2ok63qfwnspsTVa-0XMYfCnuG-xrqGn1UB0oukQamc9XeGbQ-ueWSLXqIrd5oTvhB5GuhS9_mjt2ykWTuxutLblfjkaB_Jw8rbMxljYiOCOzFRwPTr5TSXzQ7NhD-OIjR6rKC5v5xOJgXiSV0DjS3QVzSsQw92T6012_H_kRo4WqY8ht4O1_NqOZV7GVnHnSeCWTn2H1RA4jaq8MzBi3Cc_Um66TbTL1h4L3JCHcJBKlHRLjD-1lBVJoHtDCULeKE1MXy-F3gWR-svv22oYzPnfTJeD0t2wNX44jOyEX4BsWMUviokeVvg0O9X1B1N1md2H26ZsD6Zt8EkG7FDuEBwFrVcWK61RzRePnGirzmd3yjjIpYnGUwlx8jceIduCwuD0sKyUS1bk4A15erH3pX6dBThHKZoEkYIIbRA6QsXymkrojViz5TyHc1wTXOhVVJIZS4ukeX2S-ffe9jOkyKQVbjKFQQnOP4-mS3FafWQ-kiAR-8yaarLI8ggcgHFj0ez4zrt2yeXw3UGDiPbKU1sshpsAh81jUwPuiR_zcNAigJVfs&sai=AMfl-YRHuWr-vqVrCB52MwvES5sfN99wZrBGFXCyzpGv7x0k5C0r0mvvtO4BhkJrIWVhi3IvFT5mw422nXvQUB_7kw2AArFFLUkHSsFWkDBuzjswYJt5o4k9au2wtZvBYhIaY5DKg7jzTIjzGQI1kHzXICqf1bSgyQ&sig=Cg0ArKJSzBKTnTyFVoNREAE&uach_m=[UACH]&pr=6:0.820620&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211201.70908&adurl=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BKt9czCf7l7u1Y1iF0xvfZQkZQsyC4OmxEjy_HSsOKsljSQuKnl1Jj9ygcF_5FaChDdm_rkWK3nINJNm-b9vYQvjie2r3f2D93XicoTupY1kT5WEVyJdKbvCZ2QIVclM-qa3VGoeLsIQKt54jmMFr6hcSlxQ&dbm_d=AKAmf-BDZ2w-24OatvdznlW0anudT_WAEFFkt5thlsDg6OlOuXoX72AEZEjTdvDRP7q1sMEjLHD9GSG6rPMrqwS5Bn0wxc2fkX0HJiBXBp93t4f5pe9icfeYu7Y6cwmYHTnwlCKd1kFhY9xTN_Ndz6gR-GFeswprK2yDaFoYBmTnlyCa20rJU_TJZLZjW1tHylmMctvZ6KI1DKaGLONLZNKdvj_hPg5_MMPG4qO75KsXYb5bexHvcsxPA3jI9SUEdpZFU9cUddVbhXUgusQynT8S5TcfKCIOpnBNC6QmWbN3cMgNcu_b5NrRYCxOjHPo3bHFNI5vpSatWXmOPdEoppFVSW3E5DtWxKIA2jI8jOtdwaryBTdTYmCK4l8nFiLv382a5uimAh3qHHXgq11_qEgFfSUs7dSoXz58dm-ndTPLzeaN-9wKpTSZtjz48o3rmFJlFdULlwpY_34TM4FCejzZIuMF9AY2D7NCPcwA8lRRzzayqw2zE0VGSO4eHil8kehoWTgD-r4Yygt8UUGgted10vq3BYWFu8iUigsh8NvaK6DBN9P8xejMyv7DrsPIOeXCvS6KG1wS9j_v9JbZVY46O-NzIe2vvI5mvr5huaWnQwAm3svKTNyEVNlLQVZ504hgbz3YBCllfGpfrt3azHRQB1l2gmSBmdb2LPZ-7t3XB0bKLKEyvjW33x3c4Lsb-YU6ysv5NnZW2cjaCPQaBldeEERc_0vNu9qBVNKOxXPpqCbrMcMa0JF9EafWV2wI-zhzsp1amHHT6Xwbv-nNAjBxr6fFncC1T95Jzi5Q6GFJHe9eMmQGatpeIiPgqqcPA5jR61J1CI3ccrVtpuymBICEfpBKdzq30_HL6du9xjwYyYav8vn5FM9N5Av7k95ZY55KuhKgoP9FYKuLitOnTnkT9-TemrYtJ3kMWvEVJFS4LwJ6yEw8KPS6Vb_89mf48wITj-lKloyxIlQ1MvomdpGeSjTn94-i01et7cFbC1NE9HvubKnfGCLrTlmUEzuCYjweq8fKQiXpd7GQ3v2nxkQTkjU4Wm3ucXX6qkVd22heGuJehwkZD50iNmfg1eHlLq6zTTmBp14HRXbn6obPDKKFVyGWBPFgW2UtmNNiw4pxX6SRBHOBvizjQuxMuVuKJH9MOA2Dpbd_laBq_kYj1c1vI7pHfrhnMjeiv09V_WuzIQXKldUNAPRgPW6odTVIh2wt3CilTs2ef9S-ChWJ1bKwGYlkYZLCqLDlUmDZcSidkkld32Ka_6mHmRkC-DGbFFVV-BbUp4l7zOPpZaSOhL-flQ-Efp_Kdx7hO4B4A3Hu89sTdNnpg1I_OsplsMFbjjg3-0LL4K-ERn4xKq7Rd-Jt5akOtyyV22mRgcmKm9pbTPDkcYWWgCvzBHEO1At96p7dWvE26jyK1VMHZETSUmb6TyOOnUID4qKb9Z8HMo1rHDBJb-NxZP8ZgHvAhKwt5PglBp7zV-4vaTdzkYVEELDZwG7Qq3PJxohYNMP_u_7743OoV0tQoTT5mfblUE8V-izfgeXaWSHH_nZLywNC5PlC_Q_9HWUjVzptrcNfyod3b_sFurMVl37tGXasB5Wtb1Inv8KLtubK7w6NbA3MANLsXFA6Se4lP4NrllsynvSpsOtdooPozp-SGsUiEC17fvwsoFnjT-FtvuJKOEzr9uFS3TbdVXpn2dt_zj4rnxY9BPuhOIpkuNZnxv6Ou29LfmAHn0HV1PauxveqGFdcR0liG04D3U-KSSr-kOHo5GSk74BYrVE3czgMxuhDuRfUe9NxCgsmOFiDM38TjiIFkKCe1VVlMnRZMSsm7ECBFtSf1OJG_GS3azhCJr_8bEv1VfLhrR-a1K8ajxB0wFPxe8zj3qVhfXhiY_CkkAcsk3mY2A4Bkm0j7zdVMIxK7dKp6j0YtO-IugK5BKY-cUO9xpVgxk3ogrIQgLNTGtlafiewxLvUhxXlrhXvdWhSIsQiXuW2gbs_rJVDF3a4gNFp4yRm3h89U1f_zaXWlx8TvKFB91X0N7AFcQjiB9EDqMyxKcEMf2xiUG4URoI00kc7iNVW_4FzTCyobc2a_DjFC5oTh-joxJ5kdxfwLnpCKGOgegtXAIuuYz9sB7_cY8a38f6-IWkqb8wL2tHkF0AY9Nvl20L84wnANT9m83ATGVH3TDe-IrGS2s-phDbbfII3KPTtTn62qKETmiWp6CeqN946uJmKaJJwjrm2VALo7vWjZf03Ixjl17NKvXXKRNeivikck7AGQ6YRKTDwzUT151YtOf7TQVq_60MEwbbWyt5mTVKXd99bO_XWnxY4OLpq33yqDkcUyZtkOD3lnyiiRBSh05KQhYbFnTfLYR0Jo4Bl_IMWCkZMNnn5IIjRkedGhOF0pfUWGHxf8v40zalOVN-9WZQ11jZgI8f0Bz56bqUK8bIE8zpf5BYpBz8SijEkt85PeGkwxfnf0A2bcx_uELnb7bzzSdJfTXLn-JmmuNvLL5qbfGOfAqGzirg3mdG0_fY1EfcfQYQbxhtJ1zdNbH94Vq5rtBpXb5bh8ST1nQ6cnJrhYyThZA9m4pkYHgY2CnhqRGZoHUZRmJ1W-XxQt9MUgDN0egVg3z4IznKCgvs-Jl18EmyEUgeIGwFYWGjtdYCSvTCNEyLa4ct3d3FBtF0sBx2a9gqsS9Y1bGl_cVxlj80XoITn-ZrTWxlJFWlmJtrjcPPhRrftqJ5nsnWE11UuYd20_Yu_oZNxoOYSlsB9rqI4uAoqQMC62-D5vWydhAxE77Nt15gW0j6t5_y5NWjQ5l_8RM_78TpSsOM0ees6d5w-PmNlsJmFnIb7c7SREO6gZGWkva5YqIIRGZHghAPLndLJBWWo650b53LCB-c603VxH1b-pMWEW6HxgmKXTx25u87Gds-FZqG1i_33Pcfm9Y0LG5l-jYZtCQgvrGS_UUUfA6KLu80L-olQvSvl_6hQqiebD1485wQwIVfO-yXhKlH2c-eNMLeuZFd56BKfd8FJZ2kRpS0fBrI-IUlOlRCdaOYh-g3AQi1IEROTSQYb5n-gxf0Kc6MfDUFhX7fPTe9Ni9abXpGuII4yw7lKoJWwrXpRo-5QLcVS9m51vDSNUsz4bUH4TCbjd9tMTqImXvavIKgbDJlITBBIPfmKxHDyPysq1_rYAR0f07iEho0z-tJQ4umgdhg&pr=6:0.820620&cid=CAASEuRor-cyknJYxMG18BjeoalMXw&xfc=https%3A%2F%2Fclicktrack.pubmatic.com%2FAdServer%2FAdDisplayTrackerServlet%3FclickData%3DJnB1YklkPTE1NjY5NiZzaXRlSWQ9MjY5ODg1JmFkSWQ9MTMyNTE4MSZrYWRzaXplaWQ9MzImdGxkSWQ9NTk2NzMzODYmY2FtcGFpZ25JZD0yMjk4NyZjcmVhdGl2ZUlkPTAmdWNyaWQ9ODkwNjc5MzU0ODE2MTEyMDU2NSZhZFNlcnZlcklkPTI0MyZpbXBpZD0xNEFFMzBCQy0yNDA5LTQ5NkYtOTI0Qy0wNjJBMzA5MUEyMkUmcGFzc2JhY2s9MA%3D%3D_url%3D&rfl=1%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date
Sun, 05 Dec 2021 01:50:28 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
attribution.js
storage.googleapis.com/session-hub/ Frame F076 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/session-hub/attribution.js?action=viewPlacement&aid=513043972
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::2010 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
0f43d6dfd24b62e95baf46356acc669f8a0d75f10daea9778d1798410b84dd62

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:58:08 GMT
age
3140
x-guploader-uploadid
ADPycdtpByNFGKtkn-eL4ADyZUf8gjgI1fArzvvtiCceCcXM3NdNuBPJ-xUVSE54ZatDN87_Jrtnkjc2-EdMVIFHhe0YTSrHVg
x-goog-storage-class
REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2827
last-modified
Wed, 28 Aug 2019 19:06:32 GMT
server
UploadServer
etag
"0fa34f86fbf088bfba14359ffb4ba82b"
x-goog-hash
crc32c=1TZ2bg==, md5=D6NPhvvwiL+6FDWf+0uoKw==
content-language
en
x-goog-generation
1567019192385890
cache-control
public, max-age=3600
x-goog-stored-content-length
2827
accept-ranges
bytes
content-type
application/javascript
expires
Sun, 05 Dec 2021 01:58:08 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame F076 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 04:11:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77917
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Sun, 04 Dec 2022 04:11:51 GMT
9130_IPTV_ALWAYSON_INTa50_970x250_2111_en.jpeg
s0.2mdn.net/9579671/ Frame F076 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/9579671/9130_IPTV_ALWAYSON_INTa50_970x250_2111_en.jpeg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2006 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
695d75b731572abe5163400f749ae449ac550488b1b0bf946c592244470e5db3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 21:16:24 GMT
x-content-type-options
nosniff
age
16444
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
44940
x-xss-protection
0
last-modified
Mon, 15 Nov 2021 19:39:36 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 05 Dec 2021 21:16:24 GMT
pixel
googleads.g.doubleclick.net/xbbe/ Frame D3CA 		611 B
316 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEPTNpIoCGNjdmrkBMAE&v=APEucNWwCfkgOM84e9OBgV0bldca4T7Ws1rWeB23zdrLIk7es8Jb8WQ-OuAN4sT1UpzHeh9sMciyRY2B3p19rzLoy56CI-z51Q
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
55b198b5ed1bd02e77f84c6971a69d5c2160c0c32fd770ce33405e194750f5fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Sun, 05 Dec 2021 01:50:28 GMT
server
cafe
cache-control
private
content-length
295
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ad
googleads.g.doubleclick.net/dbm/ Frame 627A 		58 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2PvkdA-LN-2aabo-3PaukGxF5xmn6yt5JQlDNoxMbgP5JmAi5KGcbReLsSR9niP6AJ5gT4bXrubGGgkYIzuVE2IBjvZ_JcHBvIvj0kGMrc5FNbPuBHj3s6XilmkqemntL-VgN5bQywFTaueS8QsdBVaGyEA&dbm_d=AKAmf-BiQrEPJsMuQVcyWsiQ5yEHPY_d4DuOAG7YMwql2jE-RnVBKZC3TEhkf6TZ5pOUlxDzW3zyUQZZyc6qADw4ja30EYSX4VF6CQ6ylOEAS3LAoYusBsiu3tz2tBJil817tRLmjkILcpdYDDHxijKjZGhPbNSi_dXTLhkL4MNwYpG0wPchbgW0xudUd4hQkzIY4D-jLVh1vmI8fuFi5CxbqslEewk3Hm9K7YEpd01JY4N-jVc5fasC48WcwIZzrYXNDx1c49pwnttOn8MrOuz2jQXZ7T9ZokLGtqXK_0KVNgHy2HohWVXHTN5mnFGoS8UEzMRGgxt1V3CuetbVhgYJJuwCWCvCoVIMo98t4KMaWDl57ZLtf-kYOJxQwAMQkZHq9SIYY49UR9jIw8-LhKWXJUW749A6AvYqrE6ZR0aCxGA4ygZDHcRr5cCs2SF7_1IDTpPgOVJIf0rFhghUQcCBhkgXlME70me3uG4wm5TVbhZ1g1adyBTXo-Qxc1rkv88PvNm1NnBi9rJW1P3nVlS4TWk1Bo7nKYv0a0GHj4drZjkY18cks9NWGh_qyu9HY66kW6YW3P1QQyah_pQPfMTGuHy4zQHxe-tIbDz0yoD0PhMBB22TJTBv3dRK3GAs1UdqTisvamhbKF7tLgmfrquLXHDbsJJMPwV8ZqJGMeaGXJpPAlH7Pzj2JozRlD078wHiyHHGzzstFsjBBUTD-xYilkYZyxuVgaYgsbU96YZQ0503DmnO7S95O45yER82QcKapymESC3EUWN6erpWCfjDZSFjnONn59nXzZqJ4wQKAlmNy-UjRHqPPT1y3uBQ3lF8HDiiEWDpg4ceuTfsV55s2bNGHNjy-ibxNuL0tWeDfohtruZz9EmlqZhz0fbPcFhYtPSLiX7Y-A_S48X_jRFwYqYezSj_uKXdk9TanP3efukSfqibQpABEqfUwnX0T7F8TQ3IDpxcafkHhbyDWeBIjZRfFNz0b28_-Mq4w-k75W6HFPS3JWJ0ARUV0Uq1M-ukzYLW810lm0dtfTrgy7bPo-gBxIENe2Jz1rGv8ggvxuMgtmZRJ1SPmYSZq7LDoC42S5m3vGQJpz3hkY6kIYoHWekg90QONh6HEPiaG63fYL3MGWQ8RnG5tZoo8dyyovNOL0qhqINk4qtbvG7ydXW8jwN7B8x6fsWXerqQntN24WAHsOD7R9GKIvrhinbF2zQ9_Xfpo45XIvJlaMgElG5Ls3Ckq3G27qDoG3FXlXbrjF8Skd2aO3dMI7lOmjldFI7lBLx44DK1RT8A2Iq8yW9x6qqAeArWG-krmX2dy7kwvLBlQocRSGTVk_KUSAaYGHrAoR46_hdvXQRwBJL3Z_QBJOed80JCYfW29RANjY87buYWzd68dkLYwUV_HW8LVemTTD9RIhcZnPCMz6MSqwjhmOO8Gd9pMnKfk9RCqwGt2qvQN9z3YMqkcVBPJFDVqDYrxMtu3ni_nLh34NRlemQE2OcZRB1X-_xbUyt2SNZqxYERQnCeepzEJnehLdB9pNwxiLhBVGpfF5TSlfrNL80ClvvmcL-wrq3RM1ht_DXbDLrwvxSoiKVekeGPPLHGs0jrCAARkJBUbOYoZ10ev_TvPoKaQhsdBNPRBJFm1TqUidX51iOCoEEMTxs-KST8pRKfgqnQp7fgMvFordyDGNaReXsOG_LA5YlTj9iapI_5fLUcYUygQyJXA-Qnvz3KIE-WPDf2dxovn23TXUGvT1RbdgRmckau1xRNZH3zCBayns-mzffJOZ23-dfY-Y3VgM9AYZUxeqb9U2OCu5dIHmUugtRh1O5cJrftkokknXSIZn3pUu_PWaOH6g3FLHDxpW-K6400Mxq4xXikVEIq8bF9UC4Bjc5y0eWfzyEyuhR5o_u1dnzo1kRAZSD5eJiylSMAdxKe9DhSbTAA9faRcKQpA17qL5mpgt7ZfC662d6nc6mcIm67w3X7HDc6Uv7hc4vUog-fkcDvoWDTiuMSB0KFGdk900Dyi-RN4XyKq2ZKBd-QNKfoWTKGYejnDRyKWrGKjg7bP88dLvFm8SctSJZKFja22AjCCj-4ys5yWIPOV8jlXWNvfW9u5BPWF2ccN0ibkqJxY1GwIebABR-F_yySmNJx8axwCVpmG3Pi28JHLhIm-bHFta28VSQkkkCucFX0b1F2Tn-WQ4qz3WWz63Gvxbv0nG7LjwE73qmXhosBTCP92BXfjmNy0NVE_G_q6Ri1q3APbs-2Wh6tClSgKp1CKJRo03ZKhAKvkAYBdppj0eJqW0JHiPbcPMOBvUFjz_tecWPlVqEn9TRh_TGeVncwGZyMWvbF03c4r4CcN6bqcufzjBD_8vnMg9mstoaZ24NEsjKBZ3d6iUA6s4r-lHjqNJfPdMcYFGc1MwoTc66hR3Lc5-0JH3b_3PweyZCbaHHUnva5-gPGIRcRww6fDHngs_RECEcezkNeCWd5ddoM0dU58McpZxga2aCavIaiffCJo5U68m4xFkneDZjK2aEvPENFsbQjzcFRCd1C6dx1J_Qu_n1cGvZ2duT90a1LqmL6Ym0Stm_T0IvcCsge3lfq_U5YPuiHYjQyhu69sWHgBKE49j1cJNzXVF4pN2-tKd2tf31rPhONj3aIO4OtGRSC2pky5eRNituIhPLrvFiLHktLK5oAMK7b5VutvQ6INTgLAhclUn1syaX7bVY8-0ilF1HJHS36brBH3IV-GGCf9hE2UtbfadiMw1smQGPbQdCDm_Ehlc1YqUnaoZV8p8r73k2qnORbZVVO_TBUqL7Tuq2zGleJbsS2ufXTyGUdsJ6JIjGlwZTmxJfdbSAQnHklxJOUePhYQ0U0-9MS5iggXzfiCgPKYl_GfLCIl4OpE8XCsYlkutndvz34bULPNh2RpFuf0WWp-QJWIbbiQU5HiEeaJeHtUu8MHs6a33asAOmF4hff8qpUcDi_ia--7qLyStc3BXUreQBJFKN_c0mbtg7-WLobE09KBsVOvBxb3ctOhRdo6Aqm2l93Jtv7ttVncPdo699OwA&cid=CAASEuRobyLsy9JZbvD-Sbvy21XX7A&rfl=2%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f725e4cdf64877ee7b8e5b87b811889661a5417fd791c814faebdd8e0d1a05e6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:28 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28959
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 627A 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/window_focus_fy2019.js
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:47:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
187
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1332
x-xss-protection
0
server
cafe
etag
3351516697335751560
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:47:21 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 627A 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:50:28 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/ Frame 627A 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211201/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:49:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
75
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6446
x-xss-protection
0
server
cafe
etag
5472324691301332805
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:49:13 GMT
l
www.google.com/ads/measurement/ Frame 627A 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRCqLNBrYH-YK8a3pIzwTgFnDwilNz6pj1g-69gtgl7xh1Zw9WdSppgrncIB0Wc3aj2Syppo5qDjTQMifaINIW4Dbi2fw
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
gen_204
pagead2.googlesyndication.com/pagead/ Frame 627A 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BBNcT7XzpUkwYgc8mO-pWt0v0PFD3LLLgrxdznUM8FFe6Topkux7t2cWmrRjHeCr7gYADfaodVaX5Fg2SCkkxbKH9D0_Z5iDfE1m1m4iQNn3QRRo8
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:28 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cs
cs.lkqd.net/ Frame 5BA3
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_cm
  • https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEDkk0VHuxKqsJbB1tPVEyMg&google_cver=1
43 B
398 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEDkk0VHuxKqsJbB1tPVEyMg&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNVn6b8kjre-WFWj1Q8gmuqvv9JDEEwLMYhLL6I0Uinnq_41P6MglyxdCtTJRakeTxEM4TUbviutxSNoIfDgwM1GSE1PkQ
Protocol
H2
Server
146.20.128.205 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:29 GMT
server
nginx
access-control-max-age
0
access-control-allow-methods
GET
content-type
image/gif
access-control-allow-origin
*
access-control-expose-headers
Content-Type, Content-Disposition
cache-control
max-age=0
access-control-allow-credentials
true
access-control-allow-headers
Content-Type
content-length
43

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:28 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEDkk0VHuxKqsJbB1tPVEyMg&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
296
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 5BA3
Redirect Chain
  • https://cs.lkqd.net/cs?partnerId=59&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dlkqd_dbm%26google_hm%3D%24%24rawlkqduserid%7Cbase64%24%24
  • https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_hm=ZWJiVEdqa1RiYXc
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_hm=ZWJiVEdqa1RiYXc
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNVn6b8kjre-WFWj1Q8gmuqvv9JDEEwLMYhLL6I0Uinnq_41P6MglyxdCtTJRakeTxEM4TUbviutxSNoIfDgwM1GSE1PkQ
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Sun, 05 Dec 2021 01:50:28 GMT
server
nginx
location
https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_hm=ZWJiVEdqa1RiYXc
access-control-max-age
0
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-expose-headers
Content-Type, Content-Disposition
cache-control
max-age=0
access-control-allow-credentials
true
access-control-allow-headers
Content-Type
content-length
0
rum
dsum-sec.casalemedia.com/ Frame 5BA3
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEv7vNCflkDDFkQXzGixrMs&google_cver=1
43 B
999 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEv7vNCflkDDFkQXzGixrMs&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNVn6b8kjre-WFWj1Q8gmuqvv9JDEEwLMYhLL6I0Uinnq_41P6MglyxdCtTJRakeTxEM4TUbviutxSNoIfDgwM1GSE1PkQ
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:29 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:29 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEv7vNCflkDDFkQXzGixrMs&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 5BA3
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEv7vNCflkDDFkQXzGixrMs&google_cver=1
43 B
999 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEv7vNCflkDDFkQXzGixrMs&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNVn6b8kjre-WFWj1Q8gmuqvv9JDEEwLMYhLL6I0Uinnq_41P6MglyxdCtTJRakeTxEM4TUbviutxSNoIfDgwM1GSE1PkQ
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:29 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:29 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEv7vNCflkDDFkQXzGixrMs&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
googleads.g.doubleclick.net/xbbe/ Frame 6BED 		441 B
248 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNVnEnM3ezPVnMxk4r4PfOJTKt5P5Um3ij7HzebVuE2-43ex2knsc8y7p2TicDAIQcw1kTbK97ghlwbqtV1pq2hhHotiUg
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bf051f3ee7aa85b70fbdb5a9c4dbe61dc57372814f700b1b23ecb4f7dfb9ce63
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Sun, 05 Dec 2021 01:50:29 GMT
server
cafe
cache-control
private
content-length
227
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ad
googleads.g.doubleclick.net/dbm/ Frame 3FAD 		57 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DKCo6qNLcqYmHfFJd3J_etw0MvPxlhXBeV6Kc2dN_6zgypZGD78QmQqBaZOX-xBi8tTZJKUPeE3DaOoOuSAF9zI-fk11fDiDn3xlr2sfg2Wki57yEJVWjiZmLvmoGBQQjQla0saa0d_capWJeJDHOkULxu0Q&dbm_d=AKAmf-BRDFAizPqMnKvYkt3xOnS-6QVu3ppvF_qvmqjdAYUBCY-9dCbjNfoL1J8U-ZcRGNsDqPBT6pkXWPft91WlhxmJtCWCUapwcKmSaEYeup-5rTTAn-tocevy46kPlNUs4hAN0dw76sOpF-chjfgXSccdR0vXc_ivO3tRczk7xYETkRAP7Xi4yjtrvTjQqR4xYjEUz3XVUh1JEJ90j-yD6mL6hbFt-o086AO2c2kI_s-nuWR1qrP5Wk3fxIHiRfw1-5wx8gy7wdsaJBZ6jgz1GtT1YVPtLFRdhb_3ONMUV76maJLpseBdfSFnOjb8Orfx5NlF5gJpT4BDfpKJ0hyPOVMdHMk-TRaoP1hz0gF6b6mcDzX3V1LXCUKYuqAUWHw3NQij2TIXZWb6DfZBGvYnnLBFxx_sbituD72vwaRO-sIM4QZb8mqY0C_xLU9TsW803OL_Gd2ZgR5g_p3DeERk0MLeEHHb3J2yx5l9RkymXW1wN4lHxFICPrj4PQmQpmrewTiWXK66VLEWprihgQbaSksfCujqtb4sEf1WMIH-o58OaeCTy4lWHH0BEto-jl8f5eatIdr6MLPJgq-qEaTqTNgUHh4XttXUlCNSHowykY6xVNaMN2cG0i2YImA0xj8BJ8PnQ8kde3lp60CI0WeE5V_j_Q7bxVXGjS1uB3fRX9REhDfDg-au6Zs8-nEukD8DTHaz3TWGJIzdpw-bM5LcTRU6DsYTS4A2Kxmi_7WeZJleSBFeExk1RdpPGEEJYZgD6E6ICVVDBa8QuqtwVzSceb1jwPDC0mCX2-D7KzCd-VXARJX_hXRveKREH7Zzl7glzjO1Vo0Kik33leDvQP6yA1ad1uCFddkf9hQKxOZVoJKe3uIUom2JnvsKPphIZHNhOp1KlYZZvK4BNrNwLHPK9OVvfBZxVeQ_F40Czjt81132uoUI7heXtQsDZ-DOJ9BJpYngFJrEa-_jC0waXCadtBmlVShSQBe_BSa0vMYu6DCU36rGp3vQt3ixydZp-ekfs0Ysx7281NB0JqtXs6VPpydsFa20aAjj0sqxiA6UQw93_Fs6tM7dVMFwpwmEW5T6yf9xuh9emJuayC2lGeWljIqo9cHvIGca30oaswaNkJPD58Uz5sgg_DUPoT89x8cD5LuKDdaqnvR6pfkEHIwVGiLehE4on_X6JZE0fmjRvw8AOAIu5uDMMVA2u2Ar1Z77uRR24lnphPuGYypJmp734GzMzX3cp7ZQZsCawPFiTIyn-8YyTfEjPmsQM40TZiYX2ps25w_5l0oFbke9lAxx7J9kVXf3uOcsArtjVZGvURDR7gcSEsNvl-ZVP6ArxLMT8-IxQ7Kgwlgrer7EhdTBZnpAvCP9FvOBe1MfTztfDasyQmDR3gDEceBw2CS-J6a0rws5nobV6isNSRum0D_0i1ZZ-XLllEiGBOSktWLvdXZJx-c9rvRlKfhHkq8KKlCEsarJaUFFXrMcalcu-DaG9k_Wjq28uQbkAZuEOhck0DbUkdFOphMLUYlqxp_5_My_edB5lB_oV8mBgAb2oHxOdcnqGHrSnmZGsY1205Cs0lXgc-St84DDSwUx5f917GjuYi5RUaF2cSiUv2zAfFj5oxGRNUCq1JmukGupIhmCG5Za_nq-AD3W5kZjIa7M3dYNMSHjRNTtajyUOh6htU1vvWPG0ZwuJIhKALcU9c5MxhTW2E1rijNacs25GxuuxoB8OF-Vn8oUTIE1B9WL94Y3oNK5cagTnOExjHdmRE0bseQsEWL1t3T7bFYt-ASTbaMCXtjV_tix3Wna39XBIrxC0cZ4N6qzQkYxJ8euyPFthzN5q7esFIgLF0C_s8TVPOhPnk1cdzlDuKGkfW5mV7W3paRoYtcp9MObXQ62Vz4zpV_1kKG9wKVEr45FTGro7n2WZb6h6qnrvyqnOPaXtOXsW1oo3tU5XQA0VgelrHgHDIhHIDfkB0nrMcn_ytEkg2UznhGHwxGp150imW0As7wyRwJVaeHWQCzA8xGzAAj8WYPAndwRqe2WMG-itB792VZ8NZWyUFKpMEnNyJAkTe3-dqPAgnTp5fSyuE1ubHRn8h08zRF0V1LdpH_HZXHCeE79CQpDMqqMJUjEMTUlcKTCeU8X6PmqVQSoATT81vqVu-f8R0-m-fPlJz-K8ZrCVJB5g0lGRCo7SJjYdKnzUKmkolhYNtOxRCdoM7uZzvhD0xnvCcTiirAedQjyn_SjGVV9g6wnhztr6MB3udUy078NKWh7uTlG-Ic6pinisXYeoxm0TXZzbZSJwUsxGd0hxa2hwQ1c0OBnMXd8FWPjWQgyetgrVpYjz5vt8uUzEmYt-QsiTzYllgSxGb_m7HNouHijnx_FiD-NICrJBh8Itd3w_dk736rDYxFyCmW-KGVvR72Eia7sZP6_sYHo-Klf9CKIkqsAoMZJQf8fPozV7B5bO9npLhOgQsMIVqkORu0E9j1TWH5HfmssqwQ8kjLKqpXskIH24cPVgJbxWW49YWjUuuVxUZBZWjOhD5ITUAZIfNGFR0sKimD6I9wDmhTHQtlSH3RVDO7bFEoHr3sm5cXAwQpW7sh5FRi8I-lt7Pm3XW9kVjwEL0yfr01IyaC-iFr7WPhvlgwXrFqvzmJ0ld4zrBSrxk0U6HRfkBXFy3JezKjtLtJgYNJRQj3oQavbHlEWXclRd_c4S6PG1J_FTWzVbUSBNlovW1Za89snlPqN2xXnm2kzmTjPhlSuIo_Hda_SNCWx_44HDuniw4XCDRGeXkoIuzPxGLdObGRTLMpmfHh8UFhdo-fs7gu7zy6TGNYZ5wl7mmnqTcknknjfghy0oqGeciUxITqhW470xlGLBr-llmY_hxxHEY-8RNflQaJxD0KIwbiOI4YOxHmi3JJfvnss8-2syYLmxWjzxwUBrgHwK8YJMns0zlLHeUfMv-Co2HUHqjiZ6xJ9SQYBXSuxVrWfjFA3T_tXMJmt8k-jURAZZaRK4JtzMunMHU04Eo01aCXXIfirXCZoVzkqxJs1a9t5QQT3xwP_a40xhzF8zVde9BMDazPzWEC8tn42loQbraEWy8mkvFyKqSH-WhVbfTT7qH-FXot9IYgWUXzmpFdD7a7m0p37b3tC74GioM3v8nxRpDMIbhyMOGvpo6hsprtw1aEO1A&cid=CAASEuRoGakV0I-cDD8tzm8IpiUG-g&rfl=1%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8f49abba729d1077d395402cb30bb187260cb200d5331ae85efa2e430552bcf6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28469
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
optout_check
beacon.krxd.net/ 		92 B
251 B 		Script
General
Check archive.org
Download Go to
Full URL
https://beacon.krxd.net/optout_check?callback=Krux.ns.investingchannelinc.kxjsonp_optOutCheck
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.213.185.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-185-73.compute-1.amazonaws.com
Software
/
Resource Hash
b401c214e29350159ceee10376ab42ec7b44b4db5962a07eeb01cc54843859fc

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:29 GMT
cache-control
private, max-age=0, s-max-age=0
x-request-time
D=33 t=1638669029
x-served-by
beacon-n013-ash-prod.krxd.net
content-type
text/javascript
get
cdn.krxd.net/userdata/ 		374 B
517 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.krxd.net/userdata/get?pub=9427dd0d-835c-471c-a5db-ab01ae8a681c&technographics=1&callback=Krux.ns.investingchannelinc.kxjsonp_userdata
Requested by
Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0e245aedb39f92ab38edf92e964ca45d847aca318c79758080622a1c8a652129

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-cdn-backend
4FrRTvEr9h480D4BywjehZ--F_userdata_ash_prod_krxd_net___UserData_Service_V2
date
Sun, 05 Dec 2021 01:50:29 GMT
content-encoding
gzip
age
0
x-served-by
userdata-a003-ash-prod.krxd.net, cache-yul12829-YUL
vary
Accept-Encoding
x-cache
MISS, MISS
content-type
text/javascript
via
1.1 varnish
cache-control
private, max-age=1800
x-age
0
accept-ranges
bytes
x-timer
S1638669029.334868,VS0,VE20
content-length
289
x-cache-hits
0, 0
abt
capi.connatix.com/tr/ Frame 3CCD 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/abt?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:28 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
si
googleads.g.doubleclick.net/pagead/drt/ Frame D170
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Redirect headers

date
Sun, 05 Dec 2021 01:50:29 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
830b8ca5f78f00f8a0d79813f2ba95b0a7efd1ee7536567b5c25219323f3209b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:50:29 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
si
googleads.g.doubleclick.net/pagead/drt/ Frame D37A
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Redirect headers

date
Sun, 05 Dec 2021 01:50:29 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
view
googleads4.g.doubleclick.net/pcs/ Frame F076 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuCryt80Y28SiOjItDUDq24_Xt-MiVkEpdumprL-8hEzLRyo8Trp1hirc2R-biWh0QnuV-y1Qw3UbLmrO9bvl8-JXkbzzjeJk4H1pqNlV35RthBz28ZXwZrYr1CBMHDlloexlJaD_z5oZ34I5dk-PUe-VbvUcsmQme0_W-IyokunN7TbJsYl-K0gMFGStq6eJQiHiyqCVmoVCZiSUaTUclLxf6pNGoMl4ICkxXkLBpxoSAP5webcGTYI04nhkOoLizvauLypEfBm9-7BW_iBqH01t5i8zRBHq5PNM8ktPyTd7Wej-gKoPcKiHJB-_OJ7IVGY5hEAwaIClhNYeb8sSVtTci33S2enhn2ywbMZ1wkYQ8qIDLloF1x6mZbshYMv0eJCyzwaKj-l_xXmYmUXoqvhgDlVhw67QiN9sA_cFDfbxjyyHR8FYWVtLie-hJAgtEgjdr5yGczaML6wGCRxyGLC_KLpbgmde_D2zqhpZOV-ZCDE2_qq1h3UiHvPB5PRnWm3ipqy_xKUUrcDOEn3Lqax2TWmTRW7-MVpEuJxJtyY-482szvgIXQhRAsNXgdxFfGKe0WfexLgsILMDMV2MgvD7PDdu2r1Me1MzgAZQfO-YFXlyjPe7Bscs0aTXNCV7ZZ2d5l-e5wIjt_61ZBAkgSxxm__D4UhGFk5FtGLov0Pv-2ok63qfwnspsTVa-0XMYfCnuG-xrqGn1UB0oukQamc9XeGbQ-ueWSLXqIrd5oTvhB5GuhS9_mjt2ykWTuxutLblfjkaB_Jw8rbMxljYiOCOzFRwPTr5TSXzQ7NhD-OIjR6rKC5v5xOJgXiSV0DjS3QVzSsQw92T6012_H_kRo4WqY8ht4O1_NqOZV7GVnHnSeCWTn2H1RA4jaq8MzBi3Cc_Um66TbTL1h4L3JCHcJBKlHRLjD-1lBVJoHtDCULeKE1MXy-F3gWR-svv22oYzPnfTJeD0t2wNX44jOyEX4BsWMUviokeVvg0O9X1B1N1md2H26ZsD6Zt8EkG7FDuEBwFrVcWK61RzRePnGirzmd3yjjIpYnGUwlx8jceIduCwuD0sKyUS1bk4A15erH3pX6dBThHKZoEkYIIbRA6QsXymkrojViz5TyHc1wTXOhVVJIZS4ukeX2S-ffe9jOkyKQVbjKFQQnOP4-mS3FafWQ-kiAR-8yaarLI8ggcgHFj0ez4zrt2yeXw3UGDiPbKU1sshpsAh81jUwPuiR_zcNAigJVfs&sai=AMfl-YRHuWr-vqVrCB52MwvES5sfN99wZrBGFXCyzpGv7x0k5C0r0mvvtO4BhkJrIWVhi3IvFT5mw422nXvQUB_7kw2AArFFLUkHSsFWkDBuzjswYJt5o4k9au2wtZvBYhIaY5DKg7jzTIjzGQI1kHzXICqf1bSgyQ&sig=Cg0ArKJSzBKTnTyFVoNREAE&uach_m=[UACH]&pr=6:0.820620&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=846&vt=11&dtpt=845&dett=2&cstd=0&cisv=r20211201.70908&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BKt9czCf7l7u1Y1iF0xvfZQkZQsyC4OmxEjy_HSsOKsljSQuKnl1Jj9ygcF_5FaChDdm_rkWK3nINJNm-b9vYQvjie2r3f2D93XicoTupY1kT5WEVyJdKbvCZ2QIVclM-qa3VGoeLsIQKt54jmMFr6hcSlxQ&dbm_d=AKAmf-BDZ2w-24OatvdznlW0anudT_WAEFFkt5thlsDg6OlOuXoX72AEZEjTdvDRP7q1sMEjLHD9GSG6rPMrqwS5Bn0wxc2fkX0HJiBXBp93t4f5pe9icfeYu7Y6cwmYHTnwlCKd1kFhY9xTN_Ndz6gR-GFeswprK2yDaFoYBmTnlyCa20rJU_TJZLZjW1tHylmMctvZ6KI1DKaGLONLZNKdvj_hPg5_MMPG4qO75KsXYb5bexHvcsxPA3jI9SUEdpZFU9cUddVbhXUgusQynT8S5TcfKCIOpnBNC6QmWbN3cMgNcu_b5NrRYCxOjHPo3bHFNI5vpSatWXmOPdEoppFVSW3E5DtWxKIA2jI8jOtdwaryBTdTYmCK4l8nFiLv382a5uimAh3qHHXgq11_qEgFfSUs7dSoXz58dm-ndTPLzeaN-9wKpTSZtjz48o3rmFJlFdULlwpY_34TM4FCejzZIuMF9AY2D7NCPcwA8lRRzzayqw2zE0VGSO4eHil8kehoWTgD-r4Yygt8UUGgted10vq3BYWFu8iUigsh8NvaK6DBN9P8xejMyv7DrsPIOeXCvS6KG1wS9j_v9JbZVY46O-NzIe2vvI5mvr5huaWnQwAm3svKTNyEVNlLQVZ504hgbz3YBCllfGpfrt3azHRQB1l2gmSBmdb2LPZ-7t3XB0bKLKEyvjW33x3c4Lsb-YU6ysv5NnZW2cjaCPQaBldeEERc_0vNu9qBVNKOxXPpqCbrMcMa0JF9EafWV2wI-zhzsp1amHHT6Xwbv-nNAjBxr6fFncC1T95Jzi5Q6GFJHe9eMmQGatpeIiPgqqcPA5jR61J1CI3ccrVtpuymBICEfpBKdzq30_HL6du9xjwYyYav8vn5FM9N5Av7k95ZY55KuhKgoP9FYKuLitOnTnkT9-TemrYtJ3kMWvEVJFS4LwJ6yEw8KPS6Vb_89mf48wITj-lKloyxIlQ1MvomdpGeSjTn94-i01et7cFbC1NE9HvubKnfGCLrTlmUEzuCYjweq8fKQiXpd7GQ3v2nxkQTkjU4Wm3ucXX6qkVd22heGuJehwkZD50iNmfg1eHlLq6zTTmBp14HRXbn6obPDKKFVyGWBPFgW2UtmNNiw4pxX6SRBHOBvizjQuxMuVuKJH9MOA2Dpbd_laBq_kYj1c1vI7pHfrhnMjeiv09V_WuzIQXKldUNAPRgPW6odTVIh2wt3CilTs2ef9S-ChWJ1bKwGYlkYZLCqLDlUmDZcSidkkld32Ka_6mHmRkC-DGbFFVV-BbUp4l7zOPpZaSOhL-flQ-Efp_Kdx7hO4B4A3Hu89sTdNnpg1I_OsplsMFbjjg3-0LL4K-ERn4xKq7Rd-Jt5akOtyyV22mRgcmKm9pbTPDkcYWWgCvzBHEO1At96p7dWvE26jyK1VMHZETSUmb6TyOOnUID4qKb9Z8HMo1rHDBJb-NxZP8ZgHvAhKwt5PglBp7zV-4vaTdzkYVEELDZwG7Qq3PJxohYNMP_u_7743OoV0tQoTT5mfblUE8V-izfgeXaWSHH_nZLywNC5PlC_Q_9HWUjVzptrcNfyod3b_sFurMVl37tGXasB5Wtb1Inv8KLtubK7w6NbA3MANLsXFA6Se4lP4NrllsynvSpsOtdooPozp-SGsUiEC17fvwsoFnjT-FtvuJKOEzr9uFS3TbdVXpn2dt_zj4rnxY9BPuhOIpkuNZnxv6Ou29LfmAHn0HV1PauxveqGFdcR0liG04D3U-KSSr-kOHo5GSk74BYrVE3czgMxuhDuRfUe9NxCgsmOFiDM38TjiIFkKCe1VVlMnRZMSsm7ECBFtSf1OJG_GS3azhCJr_8bEv1VfLhrR-a1K8ajxB0wFPxe8zj3qVhfXhiY_CkkAcsk3mY2A4Bkm0j7zdVMIxK7dKp6j0YtO-IugK5BKY-cUO9xpVgxk3ogrIQgLNTGtlafiewxLvUhxXlrhXvdWhSIsQiXuW2gbs_rJVDF3a4gNFp4yRm3h89U1f_zaXWlx8TvKFB91X0N7AFcQjiB9EDqMyxKcEMf2xiUG4URoI00kc7iNVW_4FzTCyobc2a_DjFC5oTh-joxJ5kdxfwLnpCKGOgegtXAIuuYz9sB7_cY8a38f6-IWkqb8wL2tHkF0AY9Nvl20L84wnANT9m83ATGVH3TDe-IrGS2s-phDbbfII3KPTtTn62qKETmiWp6CeqN946uJmKaJJwjrm2VALo7vWjZf03Ixjl17NKvXXKRNeivikck7AGQ6YRKTDwzUT151YtOf7TQVq_60MEwbbWyt5mTVKXd99bO_XWnxY4OLpq33yqDkcUyZtkOD3lnyiiRBSh05KQhYbFnTfLYR0Jo4Bl_IMWCkZMNnn5IIjRkedGhOF0pfUWGHxf8v40zalOVN-9WZQ11jZgI8f0Bz56bqUK8bIE8zpf5BYpBz8SijEkt85PeGkwxfnf0A2bcx_uELnb7bzzSdJfTXLn-JmmuNvLL5qbfGOfAqGzirg3mdG0_fY1EfcfQYQbxhtJ1zdNbH94Vq5rtBpXb5bh8ST1nQ6cnJrhYyThZA9m4pkYHgY2CnhqRGZoHUZRmJ1W-XxQt9MUgDN0egVg3z4IznKCgvs-Jl18EmyEUgeIGwFYWGjtdYCSvTCNEyLa4ct3d3FBtF0sBx2a9gqsS9Y1bGl_cVxlj80XoITn-ZrTWxlJFWlmJtrjcPPhRrftqJ5nsnWE11UuYd20_Yu_oZNxoOYSlsB9rqI4uAoqQMC62-D5vWydhAxE77Nt15gW0j6t5_y5NWjQ5l_8RM_78TpSsOM0ees6d5w-PmNlsJmFnIb7c7SREO6gZGWkva5YqIIRGZHghAPLndLJBWWo650b53LCB-c603VxH1b-pMWEW6HxgmKXTx25u87Gds-FZqG1i_33Pcfm9Y0LG5l-jYZtCQgvrGS_UUUfA6KLu80L-olQvSvl_6hQqiebD1485wQwIVfO-yXhKlH2c-eNMLeuZFd56BKfd8FJZ2kRpS0fBrI-IUlOlRCdaOYh-g3AQi1IEROTSQYb5n-gxf0Kc6MfDUFhX7fPTe9Ni9abXpGuII4yw7lKoJWwrXpRo-5QLcVS9m51vDSNUsz4bUH4TCbjd9tMTqImXvavIKgbDJlITBBIPfmKxHDyPysq1_rYAR0f07iEho0z-tJQ4umgdhg&pr=6:0.820620&cid=CAASEuRor-cyknJYxMG18BjeoalMXw&xfc=https%3A%2F%2Fclicktrack.pubmatic.com%2FAdServer%2FAdDisplayTrackerServlet%3FclickData%3DJnB1YklkPTE1NjY5NiZzaXRlSWQ9MjY5ODg1JmFkSWQ9MTMyNTE4MSZrYWRzaXplaWQ9MzImdGxkSWQ9NTk2NzMzODYmY2FtcGFpZ25JZD0yMjk4NyZjcmVhdGl2ZUlkPTAmdWNyaWQ9ODkwNjc5MzU0ODE2MTEyMDU2NSZhZFNlcnZlcklkPTI0MyZpbXBpZD0xNEFFMzBCQy0yNDA5LTQ5NkYtOTI0Qy0wNjJBMzA5MUEyMkUmcGFzc2JhY2s9MA%3D%3D_url%3D&rfl=1%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:29 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
view
securepubads.g.doubleclick.net/pcs/ Frame F076 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsumE4mXIeLAx9pZnj4nCaNkjiXost_6awtPGO3dl9aCswDFe1UsirpKtnHVUT_-iYktXsMF4oXcqTFhibRHZUl2vYHw454daR1Nfdv_45HaNuZvu473EJIRJj5zI1LDfOFSehYBSe4s6b3s01TwkzVfFjhUtBBKDS140uIeZyIJcxpY0-mIKL92Ij-6N3UrtgMDWDSNRIlyTst_5aXK76DmvoQe-gzEAZMaBXPjtmdOPVgEo7s4glJ2q_-0bvtw7JO03zgKpXVQhVwanBZL6fOEzHpp1nLCUZlIxCSCKk0nAqUCI5n7Aq6ZoxWDTQgOC2FRCV8jsTqp9O-yXAd8jlMPBo9UG_79mI4t_Ga4J4x4M2qZ7HWZUpHmPA&sig=Cg0ArKJSzPLkCEIav8bQEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:29 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Sun, 05 Dec 2021 01:50:29 GMT
demand-source
d.pub.network/ 		61 B
270 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.23.6.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
933ac6a55f4c6ec598583c0679f1c1780ae730dd3e8366eb914148061d995c8c

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 05 Dec 2021 01:50:29 GMT
content-encoding
gzip
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
demand-source
d.pub.network/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:50:29 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers Accept-Encoding, User-Agent
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-methods
POST
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-max-age
1800
allow
GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
content-length
0
via
1.1 google
alt-svc
clear
showad.js
ads.pubmatic.com/AdServer/js/ Frame 9D8D 		38 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e2cdec10db9a0a224e9f5e49b6f004c5426564fb8d857ad3df480e9c916bafe6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

last-modified
Tue, 19 Oct 2021 10:00:01 GMT
etag
"1302647-96ae-5ceb1b98ba7c4"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
13882
content-type
text/html; charset=UTF-8
cache-control
public, max-age=62811
expires
Sun, 05 Dec 2021 19:17:20 GMT
date
Sun, 05 Dec 2021 01:50:29 GMT
vary
Accept-Encoding
AdDisplayTrackerServlet
aktrack.pubmatic.com/AdServer/ Frame 571F 		0
61 B 		Document
General
Check archive.org
Download Go to
Full URL
https://aktrack.pubmatic.com/AdServer/AdDisplayTrackerServlet?operId=1&pubId=156696&siteId=269885&adId=1325181&adType=10&adServerId=243&kefact=0.779589&kaxefact=0.779589&kadNetFrequecy=0&kadwidth=970&kadheight=250&kadsizeid=32&kltstamp=1638669025&indirectAdId=0&adServerOptimizerId=2&ranreq=0.1&kpbmtpfact=0.820620&dcId=2&tldId=59673386&passback=0&svr=BID88828U&adsver=_2318678144&adsabzcid=0&cls=BID&ekefact=4RqsYVeZAwBucBssu1Y-V7n0QbAeOb8EbRh_b02g11y878Ig&ekaxefact=4RqsYWWZAwC18AeWWlKUm02N9kV5g9x3d0Ycq03m3QU_geRB&ekpbmtpfact=4RqsYXOZAwCZrO4nyKvF0qtuMwlu6PJGjkmZ_p9j_NOVf08s&enpp=4RqsYYCZAwDBU2TAMDsrx1UKRb4qJRA9FC8GRGnZbM-642AW&pfi=1&domId=7543222089094626466&dc=NYC3&pubBuyId=11104&crID=314665729&lpu=videotron.com&ucrid=8906793548161120565&campaignId=22987&creativeId=0&pctr=0.000000&wDSPByrId=429238&wDspId=80&wbId=2&wrId=0&wAdvID=73116&wDspCampId=43998566&isRTB=1&rtbId=8BFFE37A-2423-4776-8E97-C856E29D3321&imprId=14AE30BC-2409-496F-924C-062A3091A22E&oid=14AE30BC-2409-496F-924C-062A3091A22E&cntryId=40&domain=bleepingcomputer.com&sec=1&pAuSt=3&wops=0&sURL=bleepingcomputer.com&BrID=5
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.29.128.213 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-29-128-213.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

content-type
text/html
content-length
0
date
Sun, 05 Dec 2021 01:50:29 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame F076 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37305
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1638461285297402"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Sun, 05 Dec 2021 01:50:29 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 555F 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=C78w34RqsYa37DdD5hQah2rGwCtalrZdmpsHJu_sO-9X0_QgQASDHg_wBYP3oooHwA6ABj7OOvwPIAQLgAgCoAwGqBLwCT9AUk6BKm0KrcqVOYpJvdSBSIDpCwKJQ9-LwYfG5-8pEuu8TwONTvonfe0P_uUoNO5NR4mSDCr5a8LJ6p5ZFSab7PDhHm6m7NGOfPO4dwq6XTB377Qi4fs3Oo0mf94oJZ9kiZ3DPf4GzgPDdq0r-TtySeXqjCaQemmhrL8nWrt65Guh0gJY7PmRfNsxxFVFmTX0drXkndrd3JkldyCvkpb3obgWINZ_6KeAC_F1Ylmt2v4cNPEHPo1gbEMxojZT1u9zBGFQd4t7n1WCnOBcJotV4vRAWRieobS3LaOqi8nUaL2IInA9EaktT8wv-u6V18Gi_SdQ8GgF-3i5Wtq08q2LZnmyWl5j8vBgbjYtzASjRvXXHFjmv1nAvHAcBJe5coL8ExZ2DMVfRCPpDWhbniW_tLmaaV4YxkIK5PsAEyZmY8uYD4AQBoAYCgAetpL20AagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEMq9NNIIBwiAYRABGB2ACgHICwHYEwPQFQGAFwGyFx4KHAgAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxi6yBc&sigh=FpGIRZELQAg&vt=1&uach_m=[]
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
activeview
pagead2.googlesyndication.com/pcs/ Frame 555F 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvoAsOewmJv2nsCen0xXthrNp3v_3KEBClS9GLiu57CdqrHilcR_9yBN4xlqeXYpKTE7V83VIsmu0o_9gVKepz3CWpDmnzrX6vllmEUmeZbUiUd0l4&sai=AMfl-YSHdHvRt_7uGPSHIsFUjDUzAgs4aWNlcz4yTEc7KbhphbZDKSiFs5t6zDBjul6HRKb8xkUnjODm_mVLN8W5ox1nZIoXtXpdlvKqSXmL6sA-lqklcvEFsu2vRwGE&sig=Cg0ArKJSzIK7RaVfhTKOEAE&cid=CAASFeRoptRZ5qrG_FCx9CnjYw7I4XC4fw&id=ampim&o=315,1110&d=970,90&ss=1600,1200&bs=1600,1200&mcvt=1617&mtos=0,0,1617,1617,1617&tos=0,0,1617,0,0&tfs=684&tls=2301&g=100&h=100&tt=2301&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&adk=3056404191
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 627A 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2PvkdA-LN-2aabo-3PaukGxF5xmn6yt5JQlDNoxMbgP5JmAi5KGcbReLsSR9niP6AJ5gT4bXrubGGgkYIzuVE2IBjvZ_JcHBvIvj0kGMrc5FNbPuBHj3s6XilmkqemntL-VgN5bQywFTaueS8QsdBVaGyEA&dbm_d=AKAmf-BiQrEPJsMuQVcyWsiQ5yEHPY_d4DuOAG7YMwql2jE-RnVBKZC3TEhkf6TZ5pOUlxDzW3zyUQZZyc6qADw4ja30EYSX4VF6CQ6ylOEAS3LAoYusBsiu3tz2tBJil817tRLmjkILcpdYDDHxijKjZGhPbNSi_dXTLhkL4MNwYpG0wPchbgW0xudUd4hQkzIY4D-jLVh1vmI8fuFi5CxbqslEewk3Hm9K7YEpd01JY4N-jVc5fasC48WcwIZzrYXNDx1c49pwnttOn8MrOuz2jQXZ7T9ZokLGtqXK_0KVNgHy2HohWVXHTN5mnFGoS8UEzMRGgxt1V3CuetbVhgYJJuwCWCvCoVIMo98t4KMaWDl57ZLtf-kYOJxQwAMQkZHq9SIYY49UR9jIw8-LhKWXJUW749A6AvYqrE6ZR0aCxGA4ygZDHcRr5cCs2SF7_1IDTpPgOVJIf0rFhghUQcCBhkgXlME70me3uG4wm5TVbhZ1g1adyBTXo-Qxc1rkv88PvNm1NnBi9rJW1P3nVlS4TWk1Bo7nKYv0a0GHj4drZjkY18cks9NWGh_qyu9HY66kW6YW3P1QQyah_pQPfMTGuHy4zQHxe-tIbDz0yoD0PhMBB22TJTBv3dRK3GAs1UdqTisvamhbKF7tLgmfrquLXHDbsJJMPwV8ZqJGMeaGXJpPAlH7Pzj2JozRlD078wHiyHHGzzstFsjBBUTD-xYilkYZyxuVgaYgsbU96YZQ0503DmnO7S95O45yER82QcKapymESC3EUWN6erpWCfjDZSFjnONn59nXzZqJ4wQKAlmNy-UjRHqPPT1y3uBQ3lF8HDiiEWDpg4ceuTfsV55s2bNGHNjy-ibxNuL0tWeDfohtruZz9EmlqZhz0fbPcFhYtPSLiX7Y-A_S48X_jRFwYqYezSj_uKXdk9TanP3efukSfqibQpABEqfUwnX0T7F8TQ3IDpxcafkHhbyDWeBIjZRfFNz0b28_-Mq4w-k75W6HFPS3JWJ0ARUV0Uq1M-ukzYLW810lm0dtfTrgy7bPo-gBxIENe2Jz1rGv8ggvxuMgtmZRJ1SPmYSZq7LDoC42S5m3vGQJpz3hkY6kIYoHWekg90QONh6HEPiaG63fYL3MGWQ8RnG5tZoo8dyyovNOL0qhqINk4qtbvG7ydXW8jwN7B8x6fsWXerqQntN24WAHsOD7R9GKIvrhinbF2zQ9_Xfpo45XIvJlaMgElG5Ls3Ckq3G27qDoG3FXlXbrjF8Skd2aO3dMI7lOmjldFI7lBLx44DK1RT8A2Iq8yW9x6qqAeArWG-krmX2dy7kwvLBlQocRSGTVk_KUSAaYGHrAoR46_hdvXQRwBJL3Z_QBJOed80JCYfW29RANjY87buYWzd68dkLYwUV_HW8LVemTTD9RIhcZnPCMz6MSqwjhmOO8Gd9pMnKfk9RCqwGt2qvQN9z3YMqkcVBPJFDVqDYrxMtu3ni_nLh34NRlemQE2OcZRB1X-_xbUyt2SNZqxYERQnCeepzEJnehLdB9pNwxiLhBVGpfF5TSlfrNL80ClvvmcL-wrq3RM1ht_DXbDLrwvxSoiKVekeGPPLHGs0jrCAARkJBUbOYoZ10ev_TvPoKaQhsdBNPRBJFm1TqUidX51iOCoEEMTxs-KST8pRKfgqnQp7fgMvFordyDGNaReXsOG_LA5YlTj9iapI_5fLUcYUygQyJXA-Qnvz3KIE-WPDf2dxovn23TXUGvT1RbdgRmckau1xRNZH3zCBayns-mzffJOZ23-dfY-Y3VgM9AYZUxeqb9U2OCu5dIHmUugtRh1O5cJrftkokknXSIZn3pUu_PWaOH6g3FLHDxpW-K6400Mxq4xXikVEIq8bF9UC4Bjc5y0eWfzyEyuhR5o_u1dnzo1kRAZSD5eJiylSMAdxKe9DhSbTAA9faRcKQpA17qL5mpgt7ZfC662d6nc6mcIm67w3X7HDc6Uv7hc4vUog-fkcDvoWDTiuMSB0KFGdk900Dyi-RN4XyKq2ZKBd-QNKfoWTKGYejnDRyKWrGKjg7bP88dLvFm8SctSJZKFja22AjCCj-4ys5yWIPOV8jlXWNvfW9u5BPWF2ccN0ibkqJxY1GwIebABR-F_yySmNJx8axwCVpmG3Pi28JHLhIm-bHFta28VSQkkkCucFX0b1F2Tn-WQ4qz3WWz63Gvxbv0nG7LjwE73qmXhosBTCP92BXfjmNy0NVE_G_q6Ri1q3APbs-2Wh6tClSgKp1CKJRo03ZKhAKvkAYBdppj0eJqW0JHiPbcPMOBvUFjz_tecWPlVqEn9TRh_TGeVncwGZyMWvbF03c4r4CcN6bqcufzjBD_8vnMg9mstoaZ24NEsjKBZ3d6iUA6s4r-lHjqNJfPdMcYFGc1MwoTc66hR3Lc5-0JH3b_3PweyZCbaHHUnva5-gPGIRcRww6fDHngs_RECEcezkNeCWd5ddoM0dU58McpZxga2aCavIaiffCJo5U68m4xFkneDZjK2aEvPENFsbQjzcFRCd1C6dx1J_Qu_n1cGvZ2duT90a1LqmL6Ym0Stm_T0IvcCsge3lfq_U5YPuiHYjQyhu69sWHgBKE49j1cJNzXVF4pN2-tKd2tf31rPhONj3aIO4OtGRSC2pky5eRNituIhPLrvFiLHktLK5oAMK7b5VutvQ6INTgLAhclUn1syaX7bVY8-0ilF1HJHS36brBH3IV-GGCf9hE2UtbfadiMw1smQGPbQdCDm_Ehlc1YqUnaoZV8p8r73k2qnORbZVVO_TBUqL7Tuq2zGleJbsS2ufXTyGUdsJ6JIjGlwZTmxJfdbSAQnHklxJOUePhYQ0U0-9MS5iggXzfiCgPKYl_GfLCIl4OpE8XCsYlkutndvz34bULPNh2RpFuf0WWp-QJWIbbiQU5HiEeaJeHtUu8MHs6a33asAOmF4hff8qpUcDi_ia--7qLyStc3BXUreQBJFKN_c0mbtg7-WLobE09KBsVOvBxb3ctOhRdo6Aqm2l93Jtv7ttVncPdo699OwA&cid=CAASEuRobyLsy9JZbvD-Sbvy21XX7A&rfl=2%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2b2d2472f310f3a4c880947f473b8de3e58662291206e24a5426ee2bd64684ca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:49:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
74
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9494
x-xss-protection
0
server
cafe
etag
6798282995721486617
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:49:15 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame 627A 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/omrhp.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2PvkdA-LN-2aabo-3PaukGxF5xmn6yt5JQlDNoxMbgP5JmAi5KGcbReLsSR9niP6AJ5gT4bXrubGGgkYIzuVE2IBjvZ_JcHBvIvj0kGMrc5FNbPuBHj3s6XilmkqemntL-VgN5bQywFTaueS8QsdBVaGyEA&dbm_d=AKAmf-BiQrEPJsMuQVcyWsiQ5yEHPY_d4DuOAG7YMwql2jE-RnVBKZC3TEhkf6TZ5pOUlxDzW3zyUQZZyc6qADw4ja30EYSX4VF6CQ6ylOEAS3LAoYusBsiu3tz2tBJil817tRLmjkILcpdYDDHxijKjZGhPbNSi_dXTLhkL4MNwYpG0wPchbgW0xudUd4hQkzIY4D-jLVh1vmI8fuFi5CxbqslEewk3Hm9K7YEpd01JY4N-jVc5fasC48WcwIZzrYXNDx1c49pwnttOn8MrOuz2jQXZ7T9ZokLGtqXK_0KVNgHy2HohWVXHTN5mnFGoS8UEzMRGgxt1V3CuetbVhgYJJuwCWCvCoVIMo98t4KMaWDl57ZLtf-kYOJxQwAMQkZHq9SIYY49UR9jIw8-LhKWXJUW749A6AvYqrE6ZR0aCxGA4ygZDHcRr5cCs2SF7_1IDTpPgOVJIf0rFhghUQcCBhkgXlME70me3uG4wm5TVbhZ1g1adyBTXo-Qxc1rkv88PvNm1NnBi9rJW1P3nVlS4TWk1Bo7nKYv0a0GHj4drZjkY18cks9NWGh_qyu9HY66kW6YW3P1QQyah_pQPfMTGuHy4zQHxe-tIbDz0yoD0PhMBB22TJTBv3dRK3GAs1UdqTisvamhbKF7tLgmfrquLXHDbsJJMPwV8ZqJGMeaGXJpPAlH7Pzj2JozRlD078wHiyHHGzzstFsjBBUTD-xYilkYZyxuVgaYgsbU96YZQ0503DmnO7S95O45yER82QcKapymESC3EUWN6erpWCfjDZSFjnONn59nXzZqJ4wQKAlmNy-UjRHqPPT1y3uBQ3lF8HDiiEWDpg4ceuTfsV55s2bNGHNjy-ibxNuL0tWeDfohtruZz9EmlqZhz0fbPcFhYtPSLiX7Y-A_S48X_jRFwYqYezSj_uKXdk9TanP3efukSfqibQpABEqfUwnX0T7F8TQ3IDpxcafkHhbyDWeBIjZRfFNz0b28_-Mq4w-k75W6HFPS3JWJ0ARUV0Uq1M-ukzYLW810lm0dtfTrgy7bPo-gBxIENe2Jz1rGv8ggvxuMgtmZRJ1SPmYSZq7LDoC42S5m3vGQJpz3hkY6kIYoHWekg90QONh6HEPiaG63fYL3MGWQ8RnG5tZoo8dyyovNOL0qhqINk4qtbvG7ydXW8jwN7B8x6fsWXerqQntN24WAHsOD7R9GKIvrhinbF2zQ9_Xfpo45XIvJlaMgElG5Ls3Ckq3G27qDoG3FXlXbrjF8Skd2aO3dMI7lOmjldFI7lBLx44DK1RT8A2Iq8yW9x6qqAeArWG-krmX2dy7kwvLBlQocRSGTVk_KUSAaYGHrAoR46_hdvXQRwBJL3Z_QBJOed80JCYfW29RANjY87buYWzd68dkLYwUV_HW8LVemTTD9RIhcZnPCMz6MSqwjhmOO8Gd9pMnKfk9RCqwGt2qvQN9z3YMqkcVBPJFDVqDYrxMtu3ni_nLh34NRlemQE2OcZRB1X-_xbUyt2SNZqxYERQnCeepzEJnehLdB9pNwxiLhBVGpfF5TSlfrNL80ClvvmcL-wrq3RM1ht_DXbDLrwvxSoiKVekeGPPLHGs0jrCAARkJBUbOYoZ10ev_TvPoKaQhsdBNPRBJFm1TqUidX51iOCoEEMTxs-KST8pRKfgqnQp7fgMvFordyDGNaReXsOG_LA5YlTj9iapI_5fLUcYUygQyJXA-Qnvz3KIE-WPDf2dxovn23TXUGvT1RbdgRmckau1xRNZH3zCBayns-mzffJOZ23-dfY-Y3VgM9AYZUxeqb9U2OCu5dIHmUugtRh1O5cJrftkokknXSIZn3pUu_PWaOH6g3FLHDxpW-K6400Mxq4xXikVEIq8bF9UC4Bjc5y0eWfzyEyuhR5o_u1dnzo1kRAZSD5eJiylSMAdxKe9DhSbTAA9faRcKQpA17qL5mpgt7ZfC662d6nc6mcIm67w3X7HDc6Uv7hc4vUog-fkcDvoWDTiuMSB0KFGdk900Dyi-RN4XyKq2ZKBd-QNKfoWTKGYejnDRyKWrGKjg7bP88dLvFm8SctSJZKFja22AjCCj-4ys5yWIPOV8jlXWNvfW9u5BPWF2ccN0ibkqJxY1GwIebABR-F_yySmNJx8axwCVpmG3Pi28JHLhIm-bHFta28VSQkkkCucFX0b1F2Tn-WQ4qz3WWz63Gvxbv0nG7LjwE73qmXhosBTCP92BXfjmNy0NVE_G_q6Ri1q3APbs-2Wh6tClSgKp1CKJRo03ZKhAKvkAYBdppj0eJqW0JHiPbcPMOBvUFjz_tecWPlVqEn9TRh_TGeVncwGZyMWvbF03c4r4CcN6bqcufzjBD_8vnMg9mstoaZ24NEsjKBZ3d6iUA6s4r-lHjqNJfPdMcYFGc1MwoTc66hR3Lc5-0JH3b_3PweyZCbaHHUnva5-gPGIRcRww6fDHngs_RECEcezkNeCWd5ddoM0dU58McpZxga2aCavIaiffCJo5U68m4xFkneDZjK2aEvPENFsbQjzcFRCd1C6dx1J_Qu_n1cGvZ2duT90a1LqmL6Ym0Stm_T0IvcCsge3lfq_U5YPuiHYjQyhu69sWHgBKE49j1cJNzXVF4pN2-tKd2tf31rPhONj3aIO4OtGRSC2pky5eRNituIhPLrvFiLHktLK5oAMK7b5VutvQ6INTgLAhclUn1syaX7bVY8-0ilF1HJHS36brBH3IV-GGCf9hE2UtbfadiMw1smQGPbQdCDm_Ehlc1YqUnaoZV8p8r73k2qnORbZVVO_TBUqL7Tuq2zGleJbsS2ufXTyGUdsJ6JIjGlwZTmxJfdbSAQnHklxJOUePhYQ0U0-9MS5iggXzfiCgPKYl_GfLCIl4OpE8XCsYlkutndvz34bULPNh2RpFuf0WWp-QJWIbbiQU5HiEeaJeHtUu8MHs6a33asAOmF4hff8qpUcDi_ia--7qLyStc3BXUreQBJFKN_c0mbtg7-WLobE09KBsVOvBxb3ctOhRdo6Aqm2l93Jtv7ttVncPdo699OwA&cid=CAASEuRobyLsy9JZbvD-Sbvy21XX7A&rfl=2%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:46:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
243
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3140
x-xss-protection
0
server
cafe
etag
17163059639670574047
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:46:26 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 627A 		0
24 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssVm2p5gHxd4VbOioXH2F8IN89YaTIiwyTBhyRypgt3glFzJlqU0n1A0o7yINilh26sxZpaaD4gerrzSK5saBLdXwaWDRmMo0buFvmJhhc9Wh3mXRZ9RgAeQf-XmsQ9F7dnR1trBrYXUIz9il7b4fJg_IhYvSqldFAAefEmZeSlRYnhDie7a7f-J8AwBnAD4gFbKXZgGtzqR7t_mdJuEnW9PCZwLfDFeXBPNzdPrBKB1HidwGbA9_soypKllZXMywWBcc4Zz9qEHAMEI9P8csvpPVJm5LMg8_gR47G8O_vJqVvskdlAg2VBPVYGMw456P1D-3dZxFLjofq28pPa6_ReW_tqR7eS04nEbHVTfy5EhbOY5sd-szewVGfzZ-PqCKyM_KR8zcaa7iovDc5kIk7FLZVwhcmV95iCtMlqMTyahNRDM6LQo6X7Zuu72yMP0XOaMLtAjQO0hcB8OYc8AFo6fahI6N1OCeZkB1hULY9ADjIVwaJMhp-g8Yn3TdcybgfSNtUinHtMiC-C_JvY6USzLQSJ5AHTVSPrJiBedo0_dheSAJqOj9ELhH3PlieAM5zDE_qeW_K_SF8tiqel1GyBz653LzEa00MH-OJG2tHE068Y-FtTkqbez6V3HAT7X2cIJVT1hEGFEbAaicVN2Q3GzTXw89ckO5_HKApJAI1dHUtsP9G-nApO7175ggc8eLF_F8nGDNAM3h_3OBPDSV6E0W_upa7z77IVECY_LciMkmt7oi3Pna4n0rJbW969BxoDFl99ugyRwnR4Z5yP8hnNTW1na1s8QvIqqIUkN4r4EGHDDjfWmbLTm3FDZjF5uoHMoa_f864V4wbT0XqiOTG5tcNrq9Mbc0b1VUUQVa_XdRSDdlJ2yD1t0xdZP7Fpf3LiUe9invbE7EBg4FIX-jykwJxi2tlB0IUt6mAgsdR7_qSuUdvMHTgdf6SWeFPCyRuMPpyFmMrcOuQuPkf41x03hU1liOPBOxB9E9gRzdK5K-JclCHT6Gub0edqOHPt5Lo1RHfyDykPea3c3twK2l4S6V3ILRVCh_xoQmld_fmvkNPZZC98yvvv9Yxxfn9LvYufCAaBKCRR9jceeNjD3MSgdN5lghuxD4Va9CBeFak&sai=AMfl-YSd14zrqicMwLS2umNEXwbxZv3oL6Qa4Ui0ZNTA_8X4nB9UL5i2HVn7y6AsVpQeoc2ZjR3iLfqEW3-wd9MzAVlscBNFkSswOrMKz8KotP7_7aRGiY3EyoPGd-Aq9DrcYDc95Ep0MgeYp_H1HOrGdHKY8HUq1w&sig=Cg0ArKJSzD39n0Mvm73AEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211201.85747&adurl=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2PvkdA-LN-2aabo-3PaukGxF5xmn6yt5JQlDNoxMbgP5JmAi5KGcbReLsSR9niP6AJ5gT4bXrubGGgkYIzuVE2IBjvZ_JcHBvIvj0kGMrc5FNbPuBHj3s6XilmkqemntL-VgN5bQywFTaueS8QsdBVaGyEA&dbm_d=AKAmf-BiQrEPJsMuQVcyWsiQ5yEHPY_d4DuOAG7YMwql2jE-RnVBKZC3TEhkf6TZ5pOUlxDzW3zyUQZZyc6qADw4ja30EYSX4VF6CQ6ylOEAS3LAoYusBsiu3tz2tBJil817tRLmjkILcpdYDDHxijKjZGhPbNSi_dXTLhkL4MNwYpG0wPchbgW0xudUd4hQkzIY4D-jLVh1vmI8fuFi5CxbqslEewk3Hm9K7YEpd01JY4N-jVc5fasC48WcwIZzrYXNDx1c49pwnttOn8MrOuz2jQXZ7T9ZokLGtqXK_0KVNgHy2HohWVXHTN5mnFGoS8UEzMRGgxt1V3CuetbVhgYJJuwCWCvCoVIMo98t4KMaWDl57ZLtf-kYOJxQwAMQkZHq9SIYY49UR9jIw8-LhKWXJUW749A6AvYqrE6ZR0aCxGA4ygZDHcRr5cCs2SF7_1IDTpPgOVJIf0rFhghUQcCBhkgXlME70me3uG4wm5TVbhZ1g1adyBTXo-Qxc1rkv88PvNm1NnBi9rJW1P3nVlS4TWk1Bo7nKYv0a0GHj4drZjkY18cks9NWGh_qyu9HY66kW6YW3P1QQyah_pQPfMTGuHy4zQHxe-tIbDz0yoD0PhMBB22TJTBv3dRK3GAs1UdqTisvamhbKF7tLgmfrquLXHDbsJJMPwV8ZqJGMeaGXJpPAlH7Pzj2JozRlD078wHiyHHGzzstFsjBBUTD-xYilkYZyxuVgaYgsbU96YZQ0503DmnO7S95O45yER82QcKapymESC3EUWN6erpWCfjDZSFjnONn59nXzZqJ4wQKAlmNy-UjRHqPPT1y3uBQ3lF8HDiiEWDpg4ceuTfsV55s2bNGHNjy-ibxNuL0tWeDfohtruZz9EmlqZhz0fbPcFhYtPSLiX7Y-A_S48X_jRFwYqYezSj_uKXdk9TanP3efukSfqibQpABEqfUwnX0T7F8TQ3IDpxcafkHhbyDWeBIjZRfFNz0b28_-Mq4w-k75W6HFPS3JWJ0ARUV0Uq1M-ukzYLW810lm0dtfTrgy7bPo-gBxIENe2Jz1rGv8ggvxuMgtmZRJ1SPmYSZq7LDoC42S5m3vGQJpz3hkY6kIYoHWekg90QONh6HEPiaG63fYL3MGWQ8RnG5tZoo8dyyovNOL0qhqINk4qtbvG7ydXW8jwN7B8x6fsWXerqQntN24WAHsOD7R9GKIvrhinbF2zQ9_Xfpo45XIvJlaMgElG5Ls3Ckq3G27qDoG3FXlXbrjF8Skd2aO3dMI7lOmjldFI7lBLx44DK1RT8A2Iq8yW9x6qqAeArWG-krmX2dy7kwvLBlQocRSGTVk_KUSAaYGHrAoR46_hdvXQRwBJL3Z_QBJOed80JCYfW29RANjY87buYWzd68dkLYwUV_HW8LVemTTD9RIhcZnPCMz6MSqwjhmOO8Gd9pMnKfk9RCqwGt2qvQN9z3YMqkcVBPJFDVqDYrxMtu3ni_nLh34NRlemQE2OcZRB1X-_xbUyt2SNZqxYERQnCeepzEJnehLdB9pNwxiLhBVGpfF5TSlfrNL80ClvvmcL-wrq3RM1ht_DXbDLrwvxSoiKVekeGPPLHGs0jrCAARkJBUbOYoZ10ev_TvPoKaQhsdBNPRBJFm1TqUidX51iOCoEEMTxs-KST8pRKfgqnQp7fgMvFordyDGNaReXsOG_LA5YlTj9iapI_5fLUcYUygQyJXA-Qnvz3KIE-WPDf2dxovn23TXUGvT1RbdgRmckau1xRNZH3zCBayns-mzffJOZ23-dfY-Y3VgM9AYZUxeqb9U2OCu5dIHmUugtRh1O5cJrftkokknXSIZn3pUu_PWaOH6g3FLHDxpW-K6400Mxq4xXikVEIq8bF9UC4Bjc5y0eWfzyEyuhR5o_u1dnzo1kRAZSD5eJiylSMAdxKe9DhSbTAA9faRcKQpA17qL5mpgt7ZfC662d6nc6mcIm67w3X7HDc6Uv7hc4vUog-fkcDvoWDTiuMSB0KFGdk900Dyi-RN4XyKq2ZKBd-QNKfoWTKGYejnDRyKWrGKjg7bP88dLvFm8SctSJZKFja22AjCCj-4ys5yWIPOV8jlXWNvfW9u5BPWF2ccN0ibkqJxY1GwIebABR-F_yySmNJx8axwCVpmG3Pi28JHLhIm-bHFta28VSQkkkCucFX0b1F2Tn-WQ4qz3WWz63Gvxbv0nG7LjwE73qmXhosBTCP92BXfjmNy0NVE_G_q6Ri1q3APbs-2Wh6tClSgKp1CKJRo03ZKhAKvkAYBdppj0eJqW0JHiPbcPMOBvUFjz_tecWPlVqEn9TRh_TGeVncwGZyMWvbF03c4r4CcN6bqcufzjBD_8vnMg9mstoaZ24NEsjKBZ3d6iUA6s4r-lHjqNJfPdMcYFGc1MwoTc66hR3Lc5-0JH3b_3PweyZCbaHHUnva5-gPGIRcRww6fDHngs_RECEcezkNeCWd5ddoM0dU58McpZxga2aCavIaiffCJo5U68m4xFkneDZjK2aEvPENFsbQjzcFRCd1C6dx1J_Qu_n1cGvZ2duT90a1LqmL6Ym0Stm_T0IvcCsge3lfq_U5YPuiHYjQyhu69sWHgBKE49j1cJNzXVF4pN2-tKd2tf31rPhONj3aIO4OtGRSC2pky5eRNituIhPLrvFiLHktLK5oAMK7b5VutvQ6INTgLAhclUn1syaX7bVY8-0ilF1HJHS36brBH3IV-GGCf9hE2UtbfadiMw1smQGPbQdCDm_Ehlc1YqUnaoZV8p8r73k2qnORbZVVO_TBUqL7Tuq2zGleJbsS2ufXTyGUdsJ6JIjGlwZTmxJfdbSAQnHklxJOUePhYQ0U0-9MS5iggXzfiCgPKYl_GfLCIl4OpE8XCsYlkutndvz34bULPNh2RpFuf0WWp-QJWIbbiQU5HiEeaJeHtUu8MHs6a33asAOmF4hff8qpUcDi_ia--7qLyStc3BXUreQBJFKN_c0mbtg7-WLobE09KBsVOvBxb3ctOhRdo6Aqm2l93Jtv7ttVncPdo699OwA&cid=CAASEuRobyLsy9JZbvD-Sbvy21XX7A&rfl=2%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date
Sun, 05 Dec 2021 01:50:29 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 627A 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2PvkdA-LN-2aabo-3PaukGxF5xmn6yt5JQlDNoxMbgP5JmAi5KGcbReLsSR9niP6AJ5gT4bXrubGGgkYIzuVE2IBjvZ_JcHBvIvj0kGMrc5FNbPuBHj3s6XilmkqemntL-VgN5bQywFTaueS8QsdBVaGyEA&dbm_d=AKAmf-BiQrEPJsMuQVcyWsiQ5yEHPY_d4DuOAG7YMwql2jE-RnVBKZC3TEhkf6TZ5pOUlxDzW3zyUQZZyc6qADw4ja30EYSX4VF6CQ6ylOEAS3LAoYusBsiu3tz2tBJil817tRLmjkILcpdYDDHxijKjZGhPbNSi_dXTLhkL4MNwYpG0wPchbgW0xudUd4hQkzIY4D-jLVh1vmI8fuFi5CxbqslEewk3Hm9K7YEpd01JY4N-jVc5fasC48WcwIZzrYXNDx1c49pwnttOn8MrOuz2jQXZ7T9ZokLGtqXK_0KVNgHy2HohWVXHTN5mnFGoS8UEzMRGgxt1V3CuetbVhgYJJuwCWCvCoVIMo98t4KMaWDl57ZLtf-kYOJxQwAMQkZHq9SIYY49UR9jIw8-LhKWXJUW749A6AvYqrE6ZR0aCxGA4ygZDHcRr5cCs2SF7_1IDTpPgOVJIf0rFhghUQcCBhkgXlME70me3uG4wm5TVbhZ1g1adyBTXo-Qxc1rkv88PvNm1NnBi9rJW1P3nVlS4TWk1Bo7nKYv0a0GHj4drZjkY18cks9NWGh_qyu9HY66kW6YW3P1QQyah_pQPfMTGuHy4zQHxe-tIbDz0yoD0PhMBB22TJTBv3dRK3GAs1UdqTisvamhbKF7tLgmfrquLXHDbsJJMPwV8ZqJGMeaGXJpPAlH7Pzj2JozRlD078wHiyHHGzzstFsjBBUTD-xYilkYZyxuVgaYgsbU96YZQ0503DmnO7S95O45yER82QcKapymESC3EUWN6erpWCfjDZSFjnONn59nXzZqJ4wQKAlmNy-UjRHqPPT1y3uBQ3lF8HDiiEWDpg4ceuTfsV55s2bNGHNjy-ibxNuL0tWeDfohtruZz9EmlqZhz0fbPcFhYtPSLiX7Y-A_S48X_jRFwYqYezSj_uKXdk9TanP3efukSfqibQpABEqfUwnX0T7F8TQ3IDpxcafkHhbyDWeBIjZRfFNz0b28_-Mq4w-k75W6HFPS3JWJ0ARUV0Uq1M-ukzYLW810lm0dtfTrgy7bPo-gBxIENe2Jz1rGv8ggvxuMgtmZRJ1SPmYSZq7LDoC42S5m3vGQJpz3hkY6kIYoHWekg90QONh6HEPiaG63fYL3MGWQ8RnG5tZoo8dyyovNOL0qhqINk4qtbvG7ydXW8jwN7B8x6fsWXerqQntN24WAHsOD7R9GKIvrhinbF2zQ9_Xfpo45XIvJlaMgElG5Ls3Ckq3G27qDoG3FXlXbrjF8Skd2aO3dMI7lOmjldFI7lBLx44DK1RT8A2Iq8yW9x6qqAeArWG-krmX2dy7kwvLBlQocRSGTVk_KUSAaYGHrAoR46_hdvXQRwBJL3Z_QBJOed80JCYfW29RANjY87buYWzd68dkLYwUV_HW8LVemTTD9RIhcZnPCMz6MSqwjhmOO8Gd9pMnKfk9RCqwGt2qvQN9z3YMqkcVBPJFDVqDYrxMtu3ni_nLh34NRlemQE2OcZRB1X-_xbUyt2SNZqxYERQnCeepzEJnehLdB9pNwxiLhBVGpfF5TSlfrNL80ClvvmcL-wrq3RM1ht_DXbDLrwvxSoiKVekeGPPLHGs0jrCAARkJBUbOYoZ10ev_TvPoKaQhsdBNPRBJFm1TqUidX51iOCoEEMTxs-KST8pRKfgqnQp7fgMvFordyDGNaReXsOG_LA5YlTj9iapI_5fLUcYUygQyJXA-Qnvz3KIE-WPDf2dxovn23TXUGvT1RbdgRmckau1xRNZH3zCBayns-mzffJOZ23-dfY-Y3VgM9AYZUxeqb9U2OCu5dIHmUugtRh1O5cJrftkokknXSIZn3pUu_PWaOH6g3FLHDxpW-K6400Mxq4xXikVEIq8bF9UC4Bjc5y0eWfzyEyuhR5o_u1dnzo1kRAZSD5eJiylSMAdxKe9DhSbTAA9faRcKQpA17qL5mpgt7ZfC662d6nc6mcIm67w3X7HDc6Uv7hc4vUog-fkcDvoWDTiuMSB0KFGdk900Dyi-RN4XyKq2ZKBd-QNKfoWTKGYejnDRyKWrGKjg7bP88dLvFm8SctSJZKFja22AjCCj-4ys5yWIPOV8jlXWNvfW9u5BPWF2ccN0ibkqJxY1GwIebABR-F_yySmNJx8axwCVpmG3Pi28JHLhIm-bHFta28VSQkkkCucFX0b1F2Tn-WQ4qz3WWz63Gvxbv0nG7LjwE73qmXhosBTCP92BXfjmNy0NVE_G_q6Ri1q3APbs-2Wh6tClSgKp1CKJRo03ZKhAKvkAYBdppj0eJqW0JHiPbcPMOBvUFjz_tecWPlVqEn9TRh_TGeVncwGZyMWvbF03c4r4CcN6bqcufzjBD_8vnMg9mstoaZ24NEsjKBZ3d6iUA6s4r-lHjqNJfPdMcYFGc1MwoTc66hR3Lc5-0JH3b_3PweyZCbaHHUnva5-gPGIRcRww6fDHngs_RECEcezkNeCWd5ddoM0dU58McpZxga2aCavIaiffCJo5U68m4xFkneDZjK2aEvPENFsbQjzcFRCd1C6dx1J_Qu_n1cGvZ2duT90a1LqmL6Ym0Stm_T0IvcCsge3lfq_U5YPuiHYjQyhu69sWHgBKE49j1cJNzXVF4pN2-tKd2tf31rPhONj3aIO4OtGRSC2pky5eRNituIhPLrvFiLHktLK5oAMK7b5VutvQ6INTgLAhclUn1syaX7bVY8-0ilF1HJHS36brBH3IV-GGCf9hE2UtbfadiMw1smQGPbQdCDm_Ehlc1YqUnaoZV8p8r73k2qnORbZVVO_TBUqL7Tuq2zGleJbsS2ufXTyGUdsJ6JIjGlwZTmxJfdbSAQnHklxJOUePhYQ0U0-9MS5iggXzfiCgPKYl_GfLCIl4OpE8XCsYlkutndvz34bULPNh2RpFuf0WWp-QJWIbbiQU5HiEeaJeHtUu8MHs6a33asAOmF4hff8qpUcDi_ia--7qLyStc3BXUreQBJFKN_c0mbtg7-WLobE09KBsVOvBxb3ctOhRdo6Aqm2l93Jtv7ttVncPdo699OwA&cid=CAASEuRobyLsy9JZbvD-Sbvy21XX7A&rfl=2%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 04:11:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77918
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Sun, 04 Dec 2022 04:11:51 GMT
5508646444554028832
s0.2mdn.net/simgad/ Frame 627A 		83 KB
83 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/5508646444554028832
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2006 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c37cdb0d5fdb474353422b0fd5bdbc9ab271aaaf490087badbedad29facfdcd9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 28 Nov 2021 07:35:50 GMT
x-content-type-options
nosniff
age
584079
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
84983
x-xss-protection
0
last-modified
Fri, 17 Sep 2021 15:02:13 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Mon, 28 Nov 2022 07:35:50 GMT
iu3
s.amazon-adsystem.com/ Frame 627A 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/iu3?d=forester-did&ex-fch=4167913&ex-fargs=1JDhLkbwBT0wZjkbLf-NDvLgGuA64DZPlNgkd532tIzQ1rDfakRXjM41VJI51HH74a94nMNO1jg3JbsCMu9c5dL3i5KZFHBZ9_Tcm&cb=
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame 627A 		35 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=9307021&siteID=N720476.1972103DOUBLECLICKBIDMA0&creativeID=158079870&placementID=318615188&rnd=2197179983&gdpr=&gdpr_consent=&redir=https://secure.insightexpressai.com/adserver/1pixel.gif
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:d:593::1ec4 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOWALL
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Security-Policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
P3P
CP="NOI DSP COR NID CUR ADMa OUR STP STA"
Connection
keep-alive
Content-Length
35
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:5b4dbfaf-2d3f-4217-81a4-dbc3623f316f
Pragma
no-cache
Referrer-Policy
unsafe-url
X-Frame-Options
ALLOWALL
Date
Sun, 05 Dec 2021 01:50:29 GMT
Vary
Accept-Encoding
Content-Type
image/gif
Access-Control-Expose-Headers
Request-Context
Cache-Control
max-age=0, no-cache
Feature-Policy
accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
Expires
Sun, 05 Dec 2021 01:50:29 GMT
setuid
ib.adnxs.com/ Frame D3CA
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEOVuQ49DnayG3uN7Bt9fa7g&google_cver=1
43 B
1006 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/setuid?entity=101&code=CAESEOVuQ49DnayG3uN7Bt9fa7g&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEPTNpIoCGNjdmrkBMAE&v=APEucNWwCfkgOM84e9OBgV0bldca4T7Ws1rWeB23zdrLIk7es8Jb8WQ-OuAN4sT1UpzHeh9sMciyRY2B3p19rzLoy56CI-z51Q
Protocol
HTTP/1.1
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:29 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
9eda6d04-2f29-418c-b325-142c00fdd447
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ib.adnxs.com/setuid?entity=101&code=CAESEOVuQ49DnayG3uN7Bt9fa7g&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
290
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame D3CA
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIwNTAyMDQyNTQzMTYzNDEyMA%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIwNTAyMDQyNTQzMTYzNDEyMA%3D%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEPTNpIoCGNjdmrkBMAE&v=APEucNWwCfkgOM84e9OBgV0bldca4T7Ws1rWeB23zdrLIk7es8Jb8WQ-OuAN4sT1UpzHeh9sMciyRY2B3p19rzLoy56CI-z51Q
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:29 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
4c8d9884-4339-4e6b-88ed-5a129794dbd7
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzIwNTAyMDQyNTQzMTYzNDEyMA%3D%3D
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame D3CA
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHeILPWdmbEHivdcTPUW7as&google_cver=1
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHeILPWdmbEHivdcTPUW7as&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEPTNpIoCGNjdmrkBMAE&v=APEucNWwCfkgOM84e9OBgV0bldca4T7Ws1rWeB23zdrLIk7es8Jb8WQ-OuAN4sT1UpzHeh9sMciyRY2B3p19rzLoy56CI-z51Q
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHeILPWdmbEHivdcTPUW7as&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame D3CA
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZGM2OGQ3OTMtZWRkNC0yMTFiLWYwMDEtMmFkMzU1NmNmNzEy
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZGM2OGQ3OTMtZWRkNC0yMTFiLWYwMDEtMmFkMzU1NmNmNzEy
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN8DEPTNpIoCGNjdmrkBMAE&v=APEucNWwCfkgOM84e9OBgV0bldca4T7Ws1rWeB23zdrLIk7es8Jb8WQ-OuAN4sT1UpzHeh9sMciyRY2B3p19rzLoy56CI-z51Q
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Sun, 05 Dec 2021 01:50:29 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZGM2OGQ3OTMtZWRkNC0yMTFiLWYwMDEtMmFkMzU1NmNmNzEy
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
um
sync.teads.tv/ Frame 6BED
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
  • https://sync.teads.tv/um?eid=3&uid=CAESENrrdhM8Ke8FKQYeXB2RuHY&google_cver=1
23 B
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=3&uid=CAESENrrdhM8Ke8FKQYeXB2RuHY&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNVnEnM3ezPVnMxk4r4PfOJTKt5P5Um3ij7HzebVuE2-43ex2knsc8y7p2TicDAIQcw1kTbK97ghlwbqtV1pq2hhHotiUg
Protocol
H2
Server
184.29.129.73 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-29-129-73.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.6 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
cache-control
max-age=0, no-cache, no-store
expires
Sun, 05 Dec 2021 01:50:29 GMT
server
akka-http/10.2.6
content-length
23
content-type
image/gif

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://sync.teads.tv/um?eid=3&uid=CAESENrrdhM8Ke8FKQYeXB2RuHY&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
281
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 6BED
Redirect Chain
  • https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MTkzYzE2NTMtYTJiOS00Mjg2LWExYTktM2E1ZDNmYTdiMmUz
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MTkzYzE2NTMtYTJiOS00Mjg2LWExYTktM2E1ZDNmYTdiMmUz
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNVnEnM3ezPVnMxk4r4PfOJTKt5P5Um3ij7HzebVuE2-43ex2knsc8y7p2TicDAIQcw1kTbK97ghlwbqtV1pq2hhHotiUg
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
server
akka-http/10.2.6
content-type
text/html; charset=UTF-8
location
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=MTkzYzE2NTMtYTJiOS00Mjg2LWExYTktM2E1ZDNmYTdiMmUz
cache-control
max-age=0, no-cache, no-store
content-length
189
expires
Sun, 05 Dec 2021 01:50:29 GMT
sync
partners.tremorhub.com/ Frame 6BED
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm
  • https://partners.tremorhub.com/sync?UIGL=CAESEEntuj9c_4CQ5cWuUz1Ij9o&google_cver=1
43 B
183 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partners.tremorhub.com/sync?UIGL=CAESEEntuj9c_4CQ5cWuUz1Ij9o&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLaZGhCq47ECGIHWhZYBMAE&v=APEucNVnEnM3ezPVnMxk4r4PfOJTKt5P5Um3ij7HzebVuE2-43ex2knsc8y7p2TicDAIQcw1kTbK97ghlwbqtV1pq2hhHotiUg
Protocol
H2
Server
2600:1f18:612b:4200:787a:99c3:22c2:11ca Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:29 GMT
server
Apache-Coyote/1.1
p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type
image/gif

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://partners.tremorhub.com/sync?UIGL=CAESEEntuj9c_4CQ5cWuUz1Ij9o&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
283
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ Frame F076 		216 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5d1a890763a9c7419d6e9b5c45c114a36ec8ac3c8742173ba89d9610c4492d5b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 434F 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Thu, 02 Dec 2021 09:38:23 GMT
expires
Fri, 02 Dec 2022 09:38:23 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
231126
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/ Frame 3FAD 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/abg_lite.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2b2d2472f310f3a4c880947f473b8de3e58662291206e24a5426ee2bd64684ca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:49:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
74
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9494
x-xss-protection
0
server
cafe
etag
6798282995721486617
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:49:15 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/ Frame 3FAD 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211201/r20110914/elements/html/omrhp.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:46:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
243
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3140
x-xss-protection
0
server
cafe
etag
17163059639670574047
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 19 Dec 2021 01:46:26 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 3FAD 		0
24 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssooW-EMW-2vqj9X6MxJ_A40Jynl-SlOLqirFREHh7zAnESnO419NxXPTOfYdQAttstnFnfAHBFMVp7ABe8FjJZ9dFNiK9dUdZtqEFIu_JV1Cgdm53UsnLDuufSu-fIJDhFeW233XOdEgu-98jzcxAJxftDFz7XrlfvQySElZvIr273LZ7QjL61MtujHbAdkLefn-brnRCgKKVa1xgVkr-ztAxNtFGPai8MSp4PLYtbWbnrRoMx7SYVw3fTQZsvzSAbBcIQwlgxWBcEXNx8Xu7FBrngsCJq9RNcbyg-luIZvO_mn1Cp11mHtL36Z-IgDgztFOpnoFCsOxPhCyYCxOKBo1Wo9ziw1QLyN-XBiZbn398JyAqDZ7vQjLXDauLqDO4mT43Yghfu4CF-XSMmHf0DESYMZnk_JqkqDopKwvJQJhKwmb-r5VJ3FTMuImOrPon1LzJG2yk4_uQsuZlgb7cf1BpVw-HRFNv5ojZSGHjbY8DfnkfAYJeysoYrUoIvDBepdKmTBgyJwArO_-2Db1Wqc2nKfLDkRFFo_jqTJUbxKI5l-S2VIJfFnU5deM2EbuL20El91pxmO6NSL70mV2MYdLy9zDqNza-69ZARVauNh9GdUNS0zdNrGPfMVcJSzhfF7b2Avfor6DPhmUBljbMGMWXJ7U754wj-mbYkilLZgHL69Y--swqSOt1Y-WODCkQWJOwGb2O6MwoTERccTEGUd4cSbsZoNlBDJLYozipgchfsJ7NUG0hNed6RsRQ_SayZnmqQq4SPWbuIeg5tUpw5fpTaUWdjwnVxxzl16hL1RAW_NBiNW1qYgH2bt9ww16gHvnTp2P9A0e7yJAxGfe7NBAomtwxLx5ZDW_D5sniKDiRiaC7oiQhdQw2IIq8dDSsMDwVRLK3poRAbmFKFV8CdzhBd4s0Fb9KJ65xOVsRKo_eRMu6aRsLTHtH_CZ1Kb6wGLuEjNcsdzp0F5D6MZ-xc0ivYotWeamqcKq0kMMUWuiyvQbQ2D0JUr2aqconeMuN8YJymo81ndEd-jHqLn9UTurZuqOX_81mpVz5Q0bbqiRSaSadh7UkETK2LlC72nEY6ELRpRFLXeBdof0uML2You-bhiQNqVX85zvykh0Rl60m51TSEzhz7CxGoVWfHDVavQwQHvdYn3ZyY37LMYcRsy4L8t0YS2xTckAmqG0eaVZWVFOpsrK9DR39OnMyZNyH3ZKQ3EYjayZeoEALcK7m0-sJ63yTQZAa9&sai=AMfl-YSQypoiEy3BCkbDbKDACKPEYPz9MwJ8AWulSxSWu1Lr_-YcMfuyhhK3IgA86uuFo-455dusCvOyKTataZnT0V-v9qeYE5KCYKK7VHNQW9SECxoca5pLUq16qjhDkXGDsqIea-41ROSdcGgiojKKOF7J3qlNbg&sig=Cg0ArKJSzJhGP4h7sz9mEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20211201.03411&adurl=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DKCo6qNLcqYmHfFJd3J_etw0MvPxlhXBeV6Kc2dN_6zgypZGD78QmQqBaZOX-xBi8tTZJKUPeE3DaOoOuSAF9zI-fk11fDiDn3xlr2sfg2Wki57yEJVWjiZmLvmoGBQQjQla0saa0d_capWJeJDHOkULxu0Q&dbm_d=AKAmf-BRDFAizPqMnKvYkt3xOnS-6QVu3ppvF_qvmqjdAYUBCY-9dCbjNfoL1J8U-ZcRGNsDqPBT6pkXWPft91WlhxmJtCWCUapwcKmSaEYeup-5rTTAn-tocevy46kPlNUs4hAN0dw76sOpF-chjfgXSccdR0vXc_ivO3tRczk7xYETkRAP7Xi4yjtrvTjQqR4xYjEUz3XVUh1JEJ90j-yD6mL6hbFt-o086AO2c2kI_s-nuWR1qrP5Wk3fxIHiRfw1-5wx8gy7wdsaJBZ6jgz1GtT1YVPtLFRdhb_3ONMUV76maJLpseBdfSFnOjb8Orfx5NlF5gJpT4BDfpKJ0hyPOVMdHMk-TRaoP1hz0gF6b6mcDzX3V1LXCUKYuqAUWHw3NQij2TIXZWb6DfZBGvYnnLBFxx_sbituD72vwaRO-sIM4QZb8mqY0C_xLU9TsW803OL_Gd2ZgR5g_p3DeERk0MLeEHHb3J2yx5l9RkymXW1wN4lHxFICPrj4PQmQpmrewTiWXK66VLEWprihgQbaSksfCujqtb4sEf1WMIH-o58OaeCTy4lWHH0BEto-jl8f5eatIdr6MLPJgq-qEaTqTNgUHh4XttXUlCNSHowykY6xVNaMN2cG0i2YImA0xj8BJ8PnQ8kde3lp60CI0WeE5V_j_Q7bxVXGjS1uB3fRX9REhDfDg-au6Zs8-nEukD8DTHaz3TWGJIzdpw-bM5LcTRU6DsYTS4A2Kxmi_7WeZJleSBFeExk1RdpPGEEJYZgD6E6ICVVDBa8QuqtwVzSceb1jwPDC0mCX2-D7KzCd-VXARJX_hXRveKREH7Zzl7glzjO1Vo0Kik33leDvQP6yA1ad1uCFddkf9hQKxOZVoJKe3uIUom2JnvsKPphIZHNhOp1KlYZZvK4BNrNwLHPK9OVvfBZxVeQ_F40Czjt81132uoUI7heXtQsDZ-DOJ9BJpYngFJrEa-_jC0waXCadtBmlVShSQBe_BSa0vMYu6DCU36rGp3vQt3ixydZp-ekfs0Ysx7281NB0JqtXs6VPpydsFa20aAjj0sqxiA6UQw93_Fs6tM7dVMFwpwmEW5T6yf9xuh9emJuayC2lGeWljIqo9cHvIGca30oaswaNkJPD58Uz5sgg_DUPoT89x8cD5LuKDdaqnvR6pfkEHIwVGiLehE4on_X6JZE0fmjRvw8AOAIu5uDMMVA2u2Ar1Z77uRR24lnphPuGYypJmp734GzMzX3cp7ZQZsCawPFiTIyn-8YyTfEjPmsQM40TZiYX2ps25w_5l0oFbke9lAxx7J9kVXf3uOcsArtjVZGvURDR7gcSEsNvl-ZVP6ArxLMT8-IxQ7Kgwlgrer7EhdTBZnpAvCP9FvOBe1MfTztfDasyQmDR3gDEceBw2CS-J6a0rws5nobV6isNSRum0D_0i1ZZ-XLllEiGBOSktWLvdXZJx-c9rvRlKfhHkq8KKlCEsarJaUFFXrMcalcu-DaG9k_Wjq28uQbkAZuEOhck0DbUkdFOphMLUYlqxp_5_My_edB5lB_oV8mBgAb2oHxOdcnqGHrSnmZGsY1205Cs0lXgc-St84DDSwUx5f917GjuYi5RUaF2cSiUv2zAfFj5oxGRNUCq1JmukGupIhmCG5Za_nq-AD3W5kZjIa7M3dYNMSHjRNTtajyUOh6htU1vvWPG0ZwuJIhKALcU9c5MxhTW2E1rijNacs25GxuuxoB8OF-Vn8oUTIE1B9WL94Y3oNK5cagTnOExjHdmRE0bseQsEWL1t3T7bFYt-ASTbaMCXtjV_tix3Wna39XBIrxC0cZ4N6qzQkYxJ8euyPFthzN5q7esFIgLF0C_s8TVPOhPnk1cdzlDuKGkfW5mV7W3paRoYtcp9MObXQ62Vz4zpV_1kKG9wKVEr45FTGro7n2WZb6h6qnrvyqnOPaXtOXsW1oo3tU5XQA0VgelrHgHDIhHIDfkB0nrMcn_ytEkg2UznhGHwxGp150imW0As7wyRwJVaeHWQCzA8xGzAAj8WYPAndwRqe2WMG-itB792VZ8NZWyUFKpMEnNyJAkTe3-dqPAgnTp5fSyuE1ubHRn8h08zRF0V1LdpH_HZXHCeE79CQpDMqqMJUjEMTUlcKTCeU8X6PmqVQSoATT81vqVu-f8R0-m-fPlJz-K8ZrCVJB5g0lGRCo7SJjYdKnzUKmkolhYNtOxRCdoM7uZzvhD0xnvCcTiirAedQjyn_SjGVV9g6wnhztr6MB3udUy078NKWh7uTlG-Ic6pinisXYeoxm0TXZzbZSJwUsxGd0hxa2hwQ1c0OBnMXd8FWPjWQgyetgrVpYjz5vt8uUzEmYt-QsiTzYllgSxGb_m7HNouHijnx_FiD-NICrJBh8Itd3w_dk736rDYxFyCmW-KGVvR72Eia7sZP6_sYHo-Klf9CKIkqsAoMZJQf8fPozV7B5bO9npLhOgQsMIVqkORu0E9j1TWH5HfmssqwQ8kjLKqpXskIH24cPVgJbxWW49YWjUuuVxUZBZWjOhD5ITUAZIfNGFR0sKimD6I9wDmhTHQtlSH3RVDO7bFEoHr3sm5cXAwQpW7sh5FRi8I-lt7Pm3XW9kVjwEL0yfr01IyaC-iFr7WPhvlgwXrFqvzmJ0ld4zrBSrxk0U6HRfkBXFy3JezKjtLtJgYNJRQj3oQavbHlEWXclRd_c4S6PG1J_FTWzVbUSBNlovW1Za89snlPqN2xXnm2kzmTjPhlSuIo_Hda_SNCWx_44HDuniw4XCDRGeXkoIuzPxGLdObGRTLMpmfHh8UFhdo-fs7gu7zy6TGNYZ5wl7mmnqTcknknjfghy0oqGeciUxITqhW470xlGLBr-llmY_hxxHEY-8RNflQaJxD0KIwbiOI4YOxHmi3JJfvnss8-2syYLmxWjzxwUBrgHwK8YJMns0zlLHeUfMv-Co2HUHqjiZ6xJ9SQYBXSuxVrWfjFA3T_tXMJmt8k-jURAZZaRK4JtzMunMHU04Eo01aCXXIfirXCZoVzkqxJs1a9t5QQT3xwP_a40xhzF8zVde9BMDazPzWEC8tn42loQbraEWy8mkvFyKqSH-WhVbfTT7qH-FXot9IYgWUXzmpFdD7a7m0p37b3tC74GioM3v8nxRpDMIbhyMOGvpo6hsprtw1aEO1A&cid=CAASEuRoGakV0I-cDD8tzm8IpiUG-g&rfl=1%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date
Sun, 05 Dec 2021 01:50:29 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
attribution.js
storage.googleapis.com/session-hub/ Frame 3FAD 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/session-hub/attribution.js?action=viewPlacement&aid=514676249
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2010 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
0f43d6dfd24b62e95baf46356acc669f8a0d75f10daea9778d1798410b84dd62

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:13:53 GMT
age
2196
x-guploader-uploadid
ADPycduKuNHo3838SLqLHHKfgklFIRW64PvanEBChqn9m2zfZc65S3fdlc2zlGU7WK2F6XvDwM17ykCSoh7NimmENCJDiabyGg
x-goog-storage-class
REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2827
last-modified
Wed, 28 Aug 2019 19:06:32 GMT
server
UploadServer
etag
"0fa34f86fbf088bfba14359ffb4ba82b"
x-goog-hash
crc32c=1TZ2bg==, md5=D6NPhvvwiL+6FDWf+0uoKw==
content-language
en
x-goog-generation
1567019192385890
cache-control
public, max-age=3600
x-goog-stored-content-length
2827
accept-ranges
bytes
content-type
application/javascript
expires
Sun, 05 Dec 2021 02:13:53 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 3FAD 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 04:11:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
77918
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Sun, 04 Dec 2022 04:11:51 GMT
0646-iptv-ban-noel-solo-728x90-2112-en.jpg
s0.2mdn.net/9579671/ Frame 3FAD 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/9579671/0646-iptv-ban-noel-solo-728x90-2112-en.jpg
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2006 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c399981a6bcd319b139bdce81ba6ff1f34528c7026c147d70edc6e560ef45d6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 04 Dec 2021 19:14:22 GMT
x-content-type-options
nosniff
age
23767
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23765
x-xss-protection
0
last-modified
Thu, 02 Dec 2021 18:52:21 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 05 Dec 2021 19:14:22 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 3646 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Sat, 04 Dec 2021 19:21:13 GMT
expires
Sun, 05 Dec 2021 19:21:13 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
23356
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 627A 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1def4b0cf51bb00e842332a76640b8f7449d724fa5ee8e5ae1a80dfbc5dc392f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
view
googleads4.g.doubleclick.net/pcs/ Frame 627A 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssVm2p5gHxd4VbOioXH2F8IN89YaTIiwyTBhyRypgt3glFzJlqU0n1A0o7yINilh26sxZpaaD4gerrzSK5saBLdXwaWDRmMo0buFvmJhhc9Wh3mXRZ9RgAeQf-XmsQ9F7dnR1trBrYXUIz9il7b4fJg_IhYvSqldFAAefEmZeSlRYnhDie7a7f-J8AwBnAD4gFbKXZgGtzqR7t_mdJuEnW9PCZwLfDFeXBPNzdPrBKB1HidwGbA9_soypKllZXMywWBcc4Zz9qEHAMEI9P8csvpPVJm5LMg8_gR47G8O_vJqVvskdlAg2VBPVYGMw456P1D-3dZxFLjofq28pPa6_ReW_tqR7eS04nEbHVTfy5EhbOY5sd-szewVGfzZ-PqCKyM_KR8zcaa7iovDc5kIk7FLZVwhcmV95iCtMlqMTyahNRDM6LQo6X7Zuu72yMP0XOaMLtAjQO0hcB8OYc8AFo6fahI6N1OCeZkB1hULY9ADjIVwaJMhp-g8Yn3TdcybgfSNtUinHtMiC-C_JvY6USzLQSJ5AHTVSPrJiBedo0_dheSAJqOj9ELhH3PlieAM5zDE_qeW_K_SF8tiqel1GyBz653LzEa00MH-OJG2tHE068Y-FtTkqbez6V3HAT7X2cIJVT1hEGFEbAaicVN2Q3GzTXw89ckO5_HKApJAI1dHUtsP9G-nApO7175ggc8eLF_F8nGDNAM3h_3OBPDSV6E0W_upa7z77IVECY_LciMkmt7oi3Pna4n0rJbW969BxoDFl99ugyRwnR4Z5yP8hnNTW1na1s8QvIqqIUkN4r4EGHDDjfWmbLTm3FDZjF5uoHMoa_f864V4wbT0XqiOTG5tcNrq9Mbc0b1VUUQVa_XdRSDdlJ2yD1t0xdZP7Fpf3LiUe9invbE7EBg4FIX-jykwJxi2tlB0IUt6mAgsdR7_qSuUdvMHTgdf6SWeFPCyRuMPpyFmMrcOuQuPkf41x03hU1liOPBOxB9E9gRzdK5K-JclCHT6Gub0edqOHPt5Lo1RHfyDykPea3c3twK2l4S6V3ILRVCh_xoQmld_fmvkNPZZC98yvvv9Yxxfn9LvYufCAaBKCRR9jceeNjD3MSgdN5lghuxD4Va9CBeFak&sai=AMfl-YSd14zrqicMwLS2umNEXwbxZv3oL6Qa4Ui0ZNTA_8X4nB9UL5i2HVn7y6AsVpQeoc2ZjR3iLfqEW3-wd9MzAVlscBNFkSswOrMKz8KotP7_7aRGiY3EyoPGd-Aq9DrcYDc95Ep0MgeYp_H1HOrGdHKY8HUq1w&sig=Cg0ArKJSzD39n0Mvm73AEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=242&vt=11&dtpt=241&dett=2&cstd=0&cisv=r20211201.85747&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C2PvkdA-LN-2aabo-3PaukGxF5xmn6yt5JQlDNoxMbgP5JmAi5KGcbReLsSR9niP6AJ5gT4bXrubGGgkYIzuVE2IBjvZ_JcHBvIvj0kGMrc5FNbPuBHj3s6XilmkqemntL-VgN5bQywFTaueS8QsdBVaGyEA&dbm_d=AKAmf-BiQrEPJsMuQVcyWsiQ5yEHPY_d4DuOAG7YMwql2jE-RnVBKZC3TEhkf6TZ5pOUlxDzW3zyUQZZyc6qADw4ja30EYSX4VF6CQ6ylOEAS3LAoYusBsiu3tz2tBJil817tRLmjkILcpdYDDHxijKjZGhPbNSi_dXTLhkL4MNwYpG0wPchbgW0xudUd4hQkzIY4D-jLVh1vmI8fuFi5CxbqslEewk3Hm9K7YEpd01JY4N-jVc5fasC48WcwIZzrYXNDx1c49pwnttOn8MrOuz2jQXZ7T9ZokLGtqXK_0KVNgHy2HohWVXHTN5mnFGoS8UEzMRGgxt1V3CuetbVhgYJJuwCWCvCoVIMo98t4KMaWDl57ZLtf-kYOJxQwAMQkZHq9SIYY49UR9jIw8-LhKWXJUW749A6AvYqrE6ZR0aCxGA4ygZDHcRr5cCs2SF7_1IDTpPgOVJIf0rFhghUQcCBhkgXlME70me3uG4wm5TVbhZ1g1adyBTXo-Qxc1rkv88PvNm1NnBi9rJW1P3nVlS4TWk1Bo7nKYv0a0GHj4drZjkY18cks9NWGh_qyu9HY66kW6YW3P1QQyah_pQPfMTGuHy4zQHxe-tIbDz0yoD0PhMBB22TJTBv3dRK3GAs1UdqTisvamhbKF7tLgmfrquLXHDbsJJMPwV8ZqJGMeaGXJpPAlH7Pzj2JozRlD078wHiyHHGzzstFsjBBUTD-xYilkYZyxuVgaYgsbU96YZQ0503DmnO7S95O45yER82QcKapymESC3EUWN6erpWCfjDZSFjnONn59nXzZqJ4wQKAlmNy-UjRHqPPT1y3uBQ3lF8HDiiEWDpg4ceuTfsV55s2bNGHNjy-ibxNuL0tWeDfohtruZz9EmlqZhz0fbPcFhYtPSLiX7Y-A_S48X_jRFwYqYezSj_uKXdk9TanP3efukSfqibQpABEqfUwnX0T7F8TQ3IDpxcafkHhbyDWeBIjZRfFNz0b28_-Mq4w-k75W6HFPS3JWJ0ARUV0Uq1M-ukzYLW810lm0dtfTrgy7bPo-gBxIENe2Jz1rGv8ggvxuMgtmZRJ1SPmYSZq7LDoC42S5m3vGQJpz3hkY6kIYoHWekg90QONh6HEPiaG63fYL3MGWQ8RnG5tZoo8dyyovNOL0qhqINk4qtbvG7ydXW8jwN7B8x6fsWXerqQntN24WAHsOD7R9GKIvrhinbF2zQ9_Xfpo45XIvJlaMgElG5Ls3Ckq3G27qDoG3FXlXbrjF8Skd2aO3dMI7lOmjldFI7lBLx44DK1RT8A2Iq8yW9x6qqAeArWG-krmX2dy7kwvLBlQocRSGTVk_KUSAaYGHrAoR46_hdvXQRwBJL3Z_QBJOed80JCYfW29RANjY87buYWzd68dkLYwUV_HW8LVemTTD9RIhcZnPCMz6MSqwjhmOO8Gd9pMnKfk9RCqwGt2qvQN9z3YMqkcVBPJFDVqDYrxMtu3ni_nLh34NRlemQE2OcZRB1X-_xbUyt2SNZqxYERQnCeepzEJnehLdB9pNwxiLhBVGpfF5TSlfrNL80ClvvmcL-wrq3RM1ht_DXbDLrwvxSoiKVekeGPPLHGs0jrCAARkJBUbOYoZ10ev_TvPoKaQhsdBNPRBJFm1TqUidX51iOCoEEMTxs-KST8pRKfgqnQp7fgMvFordyDGNaReXsOG_LA5YlTj9iapI_5fLUcYUygQyJXA-Qnvz3KIE-WPDf2dxovn23TXUGvT1RbdgRmckau1xRNZH3zCBayns-mzffJOZ23-dfY-Y3VgM9AYZUxeqb9U2OCu5dIHmUugtRh1O5cJrftkokknXSIZn3pUu_PWaOH6g3FLHDxpW-K6400Mxq4xXikVEIq8bF9UC4Bjc5y0eWfzyEyuhR5o_u1dnzo1kRAZSD5eJiylSMAdxKe9DhSbTAA9faRcKQpA17qL5mpgt7ZfC662d6nc6mcIm67w3X7HDc6Uv7hc4vUog-fkcDvoWDTiuMSB0KFGdk900Dyi-RN4XyKq2ZKBd-QNKfoWTKGYejnDRyKWrGKjg7bP88dLvFm8SctSJZKFja22AjCCj-4ys5yWIPOV8jlXWNvfW9u5BPWF2ccN0ibkqJxY1GwIebABR-F_yySmNJx8axwCVpmG3Pi28JHLhIm-bHFta28VSQkkkCucFX0b1F2Tn-WQ4qz3WWz63Gvxbv0nG7LjwE73qmXhosBTCP92BXfjmNy0NVE_G_q6Ri1q3APbs-2Wh6tClSgKp1CKJRo03ZKhAKvkAYBdppj0eJqW0JHiPbcPMOBvUFjz_tecWPlVqEn9TRh_TGeVncwGZyMWvbF03c4r4CcN6bqcufzjBD_8vnMg9mstoaZ24NEsjKBZ3d6iUA6s4r-lHjqNJfPdMcYFGc1MwoTc66hR3Lc5-0JH3b_3PweyZCbaHHUnva5-gPGIRcRww6fDHngs_RECEcezkNeCWd5ddoM0dU58McpZxga2aCavIaiffCJo5U68m4xFkneDZjK2aEvPENFsbQjzcFRCd1C6dx1J_Qu_n1cGvZ2duT90a1LqmL6Ym0Stm_T0IvcCsge3lfq_U5YPuiHYjQyhu69sWHgBKE49j1cJNzXVF4pN2-tKd2tf31rPhONj3aIO4OtGRSC2pky5eRNituIhPLrvFiLHktLK5oAMK7b5VutvQ6INTgLAhclUn1syaX7bVY8-0ilF1HJHS36brBH3IV-GGCf9hE2UtbfadiMw1smQGPbQdCDm_Ehlc1YqUnaoZV8p8r73k2qnORbZVVO_TBUqL7Tuq2zGleJbsS2ufXTyGUdsJ6JIjGlwZTmxJfdbSAQnHklxJOUePhYQ0U0-9MS5iggXzfiCgPKYl_GfLCIl4OpE8XCsYlkutndvz34bULPNh2RpFuf0WWp-QJWIbbiQU5HiEeaJeHtUu8MHs6a33asAOmF4hff8qpUcDi_ia--7qLyStc3BXUreQBJFKN_c0mbtg7-WLobE09KBsVOvBxb3ctOhRdo6Aqm2l93Jtv7ttVncPdo699OwA&cid=CAASEuRobyLsy9JZbvD-Sbvy21XX7A&rfl=2%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:29 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
PugMaster
image6.pubmatic.com/AdServer/ Frame 9D8D 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=85527652&p=156696&s=269885&a=0&ptask=DSP&np=0&fp=1&rp=0&mpc=10&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
0e4c8708a7a07f2f3a664d1de55518a463f159f7f6b70ca45c4471fa26045f8f

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:29 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
1866
content-type
text/html; charset=UTF-8
view
googleads4.g.doubleclick.net/pcs/ Frame 3FAD 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssooW-EMW-2vqj9X6MxJ_A40Jynl-SlOLqirFREHh7zAnESnO419NxXPTOfYdQAttstnFnfAHBFMVp7ABe8FjJZ9dFNiK9dUdZtqEFIu_JV1Cgdm53UsnLDuufSu-fIJDhFeW233XOdEgu-98jzcxAJxftDFz7XrlfvQySElZvIr273LZ7QjL61MtujHbAdkLefn-brnRCgKKVa1xgVkr-ztAxNtFGPai8MSp4PLYtbWbnrRoMx7SYVw3fTQZsvzSAbBcIQwlgxWBcEXNx8Xu7FBrngsCJq9RNcbyg-luIZvO_mn1Cp11mHtL36Z-IgDgztFOpnoFCsOxPhCyYCxOKBo1Wo9ziw1QLyN-XBiZbn398JyAqDZ7vQjLXDauLqDO4mT43Yghfu4CF-XSMmHf0DESYMZnk_JqkqDopKwvJQJhKwmb-r5VJ3FTMuImOrPon1LzJG2yk4_uQsuZlgb7cf1BpVw-HRFNv5ojZSGHjbY8DfnkfAYJeysoYrUoIvDBepdKmTBgyJwArO_-2Db1Wqc2nKfLDkRFFo_jqTJUbxKI5l-S2VIJfFnU5deM2EbuL20El91pxmO6NSL70mV2MYdLy9zDqNza-69ZARVauNh9GdUNS0zdNrGPfMVcJSzhfF7b2Avfor6DPhmUBljbMGMWXJ7U754wj-mbYkilLZgHL69Y--swqSOt1Y-WODCkQWJOwGb2O6MwoTERccTEGUd4cSbsZoNlBDJLYozipgchfsJ7NUG0hNed6RsRQ_SayZnmqQq4SPWbuIeg5tUpw5fpTaUWdjwnVxxzl16hL1RAW_NBiNW1qYgH2bt9ww16gHvnTp2P9A0e7yJAxGfe7NBAomtwxLx5ZDW_D5sniKDiRiaC7oiQhdQw2IIq8dDSsMDwVRLK3poRAbmFKFV8CdzhBd4s0Fb9KJ65xOVsRKo_eRMu6aRsLTHtH_CZ1Kb6wGLuEjNcsdzp0F5D6MZ-xc0ivYotWeamqcKq0kMMUWuiyvQbQ2D0JUr2aqconeMuN8YJymo81ndEd-jHqLn9UTurZuqOX_81mpVz5Q0bbqiRSaSadh7UkETK2LlC72nEY6ELRpRFLXeBdof0uML2You-bhiQNqVX85zvykh0Rl60m51TSEzhz7CxGoVWfHDVavQwQHvdYn3ZyY37LMYcRsy4L8t0YS2xTckAmqG0eaVZWVFOpsrK9DR39OnMyZNyH3ZKQ3EYjayZeoEALcK7m0-sJ63yTQZAa9&sai=AMfl-YSQypoiEy3BCkbDbKDACKPEYPz9MwJ8AWulSxSWu1Lr_-YcMfuyhhK3IgA86uuFo-455dusCvOyKTataZnT0V-v9qeYE5KCYKK7VHNQW9SECxoca5pLUq16qjhDkXGDsqIea-41ROSdcGgiojKKOF7J3qlNbg&sig=Cg0ArKJSzJhGP4h7sz9mEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=146&vt=11&dtpt=146&dett=2&cstd=0&cisv=r20211201.03411&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DKCo6qNLcqYmHfFJd3J_etw0MvPxlhXBeV6Kc2dN_6zgypZGD78QmQqBaZOX-xBi8tTZJKUPeE3DaOoOuSAF9zI-fk11fDiDn3xlr2sfg2Wki57yEJVWjiZmLvmoGBQQjQla0saa0d_capWJeJDHOkULxu0Q&dbm_d=AKAmf-BRDFAizPqMnKvYkt3xOnS-6QVu3ppvF_qvmqjdAYUBCY-9dCbjNfoL1J8U-ZcRGNsDqPBT6pkXWPft91WlhxmJtCWCUapwcKmSaEYeup-5rTTAn-tocevy46kPlNUs4hAN0dw76sOpF-chjfgXSccdR0vXc_ivO3tRczk7xYETkRAP7Xi4yjtrvTjQqR4xYjEUz3XVUh1JEJ90j-yD6mL6hbFt-o086AO2c2kI_s-nuWR1qrP5Wk3fxIHiRfw1-5wx8gy7wdsaJBZ6jgz1GtT1YVPtLFRdhb_3ONMUV76maJLpseBdfSFnOjb8Orfx5NlF5gJpT4BDfpKJ0hyPOVMdHMk-TRaoP1hz0gF6b6mcDzX3V1LXCUKYuqAUWHw3NQij2TIXZWb6DfZBGvYnnLBFxx_sbituD72vwaRO-sIM4QZb8mqY0C_xLU9TsW803OL_Gd2ZgR5g_p3DeERk0MLeEHHb3J2yx5l9RkymXW1wN4lHxFICPrj4PQmQpmrewTiWXK66VLEWprihgQbaSksfCujqtb4sEf1WMIH-o58OaeCTy4lWHH0BEto-jl8f5eatIdr6MLPJgq-qEaTqTNgUHh4XttXUlCNSHowykY6xVNaMN2cG0i2YImA0xj8BJ8PnQ8kde3lp60CI0WeE5V_j_Q7bxVXGjS1uB3fRX9REhDfDg-au6Zs8-nEukD8DTHaz3TWGJIzdpw-bM5LcTRU6DsYTS4A2Kxmi_7WeZJleSBFeExk1RdpPGEEJYZgD6E6ICVVDBa8QuqtwVzSceb1jwPDC0mCX2-D7KzCd-VXARJX_hXRveKREH7Zzl7glzjO1Vo0Kik33leDvQP6yA1ad1uCFddkf9hQKxOZVoJKe3uIUom2JnvsKPphIZHNhOp1KlYZZvK4BNrNwLHPK9OVvfBZxVeQ_F40Czjt81132uoUI7heXtQsDZ-DOJ9BJpYngFJrEa-_jC0waXCadtBmlVShSQBe_BSa0vMYu6DCU36rGp3vQt3ixydZp-ekfs0Ysx7281NB0JqtXs6VPpydsFa20aAjj0sqxiA6UQw93_Fs6tM7dVMFwpwmEW5T6yf9xuh9emJuayC2lGeWljIqo9cHvIGca30oaswaNkJPD58Uz5sgg_DUPoT89x8cD5LuKDdaqnvR6pfkEHIwVGiLehE4on_X6JZE0fmjRvw8AOAIu5uDMMVA2u2Ar1Z77uRR24lnphPuGYypJmp734GzMzX3cp7ZQZsCawPFiTIyn-8YyTfEjPmsQM40TZiYX2ps25w_5l0oFbke9lAxx7J9kVXf3uOcsArtjVZGvURDR7gcSEsNvl-ZVP6ArxLMT8-IxQ7Kgwlgrer7EhdTBZnpAvCP9FvOBe1MfTztfDasyQmDR3gDEceBw2CS-J6a0rws5nobV6isNSRum0D_0i1ZZ-XLllEiGBOSktWLvdXZJx-c9rvRlKfhHkq8KKlCEsarJaUFFXrMcalcu-DaG9k_Wjq28uQbkAZuEOhck0DbUkdFOphMLUYlqxp_5_My_edB5lB_oV8mBgAb2oHxOdcnqGHrSnmZGsY1205Cs0lXgc-St84DDSwUx5f917GjuYi5RUaF2cSiUv2zAfFj5oxGRNUCq1JmukGupIhmCG5Za_nq-AD3W5kZjIa7M3dYNMSHjRNTtajyUOh6htU1vvWPG0ZwuJIhKALcU9c5MxhTW2E1rijNacs25GxuuxoB8OF-Vn8oUTIE1B9WL94Y3oNK5cagTnOExjHdmRE0bseQsEWL1t3T7bFYt-ASTbaMCXtjV_tix3Wna39XBIrxC0cZ4N6qzQkYxJ8euyPFthzN5q7esFIgLF0C_s8TVPOhPnk1cdzlDuKGkfW5mV7W3paRoYtcp9MObXQ62Vz4zpV_1kKG9wKVEr45FTGro7n2WZb6h6qnrvyqnOPaXtOXsW1oo3tU5XQA0VgelrHgHDIhHIDfkB0nrMcn_ytEkg2UznhGHwxGp150imW0As7wyRwJVaeHWQCzA8xGzAAj8WYPAndwRqe2WMG-itB792VZ8NZWyUFKpMEnNyJAkTe3-dqPAgnTp5fSyuE1ubHRn8h08zRF0V1LdpH_HZXHCeE79CQpDMqqMJUjEMTUlcKTCeU8X6PmqVQSoATT81vqVu-f8R0-m-fPlJz-K8ZrCVJB5g0lGRCo7SJjYdKnzUKmkolhYNtOxRCdoM7uZzvhD0xnvCcTiirAedQjyn_SjGVV9g6wnhztr6MB3udUy078NKWh7uTlG-Ic6pinisXYeoxm0TXZzbZSJwUsxGd0hxa2hwQ1c0OBnMXd8FWPjWQgyetgrVpYjz5vt8uUzEmYt-QsiTzYllgSxGb_m7HNouHijnx_FiD-NICrJBh8Itd3w_dk736rDYxFyCmW-KGVvR72Eia7sZP6_sYHo-Klf9CKIkqsAoMZJQf8fPozV7B5bO9npLhOgQsMIVqkORu0E9j1TWH5HfmssqwQ8kjLKqpXskIH24cPVgJbxWW49YWjUuuVxUZBZWjOhD5ITUAZIfNGFR0sKimD6I9wDmhTHQtlSH3RVDO7bFEoHr3sm5cXAwQpW7sh5FRi8I-lt7Pm3XW9kVjwEL0yfr01IyaC-iFr7WPhvlgwXrFqvzmJ0ld4zrBSrxk0U6HRfkBXFy3JezKjtLtJgYNJRQj3oQavbHlEWXclRd_c4S6PG1J_FTWzVbUSBNlovW1Za89snlPqN2xXnm2kzmTjPhlSuIo_Hda_SNCWx_44HDuniw4XCDRGeXkoIuzPxGLdObGRTLMpmfHh8UFhdo-fs7gu7zy6TGNYZ5wl7mmnqTcknknjfghy0oqGeciUxITqhW470xlGLBr-llmY_hxxHEY-8RNflQaJxD0KIwbiOI4YOxHmi3JJfvnss8-2syYLmxWjzxwUBrgHwK8YJMns0zlLHeUfMv-Co2HUHqjiZ6xJ9SQYBXSuxVrWfjFA3T_tXMJmt8k-jURAZZaRK4JtzMunMHU04Eo01aCXXIfirXCZoVzkqxJs1a9t5QQT3xwP_a40xhzF8zVde9BMDazPzWEC8tn42loQbraEWy8mkvFyKqSH-WhVbfTT7qH-FXot9IYgWUXzmpFdD7a7m0p37b3tC74GioM3v8nxRpDMIbhyMOGvpo6hsprtw1aEO1A&cid=CAASEuRoGakV0I-cDD8tzm8IpiUG-g&rfl=1%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.41.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s40-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:29 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
pixel.gif
beacon.krxd.net/ 		0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/pixel.gif?source=smarttag&fired=report&confid=womptv2nm&_kpid=9427dd0d-835c-471c-a5db-ab01ae8a681c&_kcp_s=Freestar&_kcp_d=www.bleepingcomputer.com&_knifr=27&_kua_kx_tz=0&geo_country=ca&geo_region=qc&geo_dma=124462&_kua_kx_lang=en-us&_kua_kx_tech_browser_language=en-us&_kua_kx_tech_browser=Chrome%209&_kua_kx_tech_manufacturer=Microsoft%20Corporation&_kua_kx_tech_device=Computer&_kua_kx_tech_os=Windows%2010&_kua_kx_geo_country=ca&_kua_kx_geo_region=qc&_kua_kx_geo_dma=124462&_kpa_url_path_1=news&_kpa_url_path_2=security&_kpa_url_path_3=emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot&_kpa_domain=www.bleepingcomputer.com&t_navigation_type=0&t_dns=1&t_tcp=42&t_http_request=-1&t_http_response=21&t_content_ready=573&t_window_load=0&t_redirect=0&interchange_ran=false&userdata_was_requested=true&userdata_did_respond=true&store_user_after=wxab2426i&userdata_user=OhYsC-3I%2Cwxab2426i&sview=1&kplt0=39860&kplt1=47346&jsonp_requests=https%3A%2F%2Fconsumer.krxd.net%2Fconsent%2Fget%2F9427dd0d-835c-471c-a5db-ab01ae8a681c%2C236%2Chttps%3A%2F%2Fbeacon.krxd.net%2Foptout_check%2C347%2Chttps%3A%2F%2Fcdn.krxd.net%2Fuserdata%2Fget%2C487
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.213.185.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-185-73.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:29 GMT
cache-control
private, no-cache, no-store
x-request-time
D=46 t=1638669029
x-served-by
beacon-n012-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 5444 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Thu, 02 Dec 2021 09:38:23 GMT
expires
Fri, 02 Dec 2022 09:38:23 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
231126
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
830b8ca5f78f00f8a0d79813f2ba95b0a7efd1ee7536567b5c25219323f3209b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:50:29 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame C348 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Sat, 04 Dec 2021 19:21:13 GMT
expires
Sun, 05 Dec 2021 19:21:13 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
23356
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 3FAD 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
995c49ccf09dc914eb2693d46c54dc9fd97bc2e5ac4ceaf17add5ea3d6fece6b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
834b0b92-82e7-4f6b-aa2c-c0b46affd41e.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/834b0b92-82e7-4f6b-aa2c-c0b46affd41e.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e33b0e88e98b044bb7339fe15b58a8da3cdbb95ae3c5e5fec466f642ec7cc1a1

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:29 GMT
content-encoding
br
age
1223
etag
"vRd9BuQwXB18EkVxsaGxV0vf0Zq0haX6c1+qThijWkc"
access-control-max-age
86400
fastly-io-info
ifsz=62026 idim=1600x900 ifmt=jpeg ofsz=14621 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
14086
rtb-h
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame 75ED
Redirect Chain
  • https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
  • https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=1fda3fd9-8494-4066-aca3-a092cc97baf1-tuct8a5a066&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...
0
147 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=1fda3fd9-8494-4066-aca3-a092cc97baf1-tuct8a5a066&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
accept-ranges
bytes
date
Sun, 05 Dec 2021 01:50:30 GMT
via
1.1 varnish
x-served-by
cache-yul12822-YUL
x-cache
MISS
x-cache-hits
0
x-timer
S1638669030.129567,VS0,VE9
content-length
0

Redirect headers

server
nginx
location
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=1fda3fd9-8494-4066-aca3-a092cc97baf1-tuct8a5a066&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
accept-ranges
bytes
date
Sun, 05 Dec 2021 01:50:30 GMT
via
1.1 varnish
x-served-by
cache-yul12824-YUL
x-cache
MISS
x-cache-hits
0
x-timer
S1638669030.050351,VS0,VE10
x-vcl-time-ms
10
content-length
0
Pug
image2.pubmatic.com/AdServer/ Frame 6477
Redirect Chain
  • https://gocm.c.appier.net/pubmatic
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=2DE6u0asAquivNV75hqsYQ
42 B
391 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=2DE6u0asAquivNV75hqsYQ
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:50:30 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
10:0:394
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

server
nginx
date
Sun, 05 Dec 2021 01:50:30 GMT
content-type
text/html; charset=utf-8
content-length
153
cache-control
no-store
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=2DE6u0asAquivNV75hqsYQ
p3p
CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pug
simage2.pubmatic.com/AdServer/ Frame F793
Redirect Chain
  • https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={device_id}&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
0
89 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:50:30 GMT
content-type
text/html; charset=utf-8
x-lat
njrpug005:2:344
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private
content-encoding
gzip

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
content-length
0
date
Sun, 05 Dec 2021 01:50:30 GMT
server
_
pbmtc.gif
beacon.lynx.cognitivlabs.com/ Frame 0ED6
Redirect Chain
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=86761b6e-766b-4453-ab67-bab011547e12&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
42 B
351 B 		Document
General
Check archive.org
Download Go to
Full URL
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.205.58.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-205-58-132.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

date
Sun, 05 Dec 2021 01:50:30 GMT
content-type
image/gif
content-length
42
server
Kestrel

Redirect headers

server
nginx
date
Sun, 05 Dec 2021 01:50:30 GMT
x-lat
njrpug005:0:619
location
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private
cookiesync
core.iprom.net/ Frame 6A7D 		43 B
282 B 		Document
General
Check archive.org
Download Go to
Full URL
https://core.iprom.net/cookiesync
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

Vary
Accept-Encoding
X-adserver-worker
leviathan-fd4926f79332@version_1.362v2
Connection
close
X-server-arch
v2
Content-Type
image/gif
Content-Length
43
X-core-time
1ms
Date
Sun, 05 Dec 2021 01:50:30 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame F4CB
Redirect Chain
  • https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:C65D11E4B81E46FF927733811942FFDC
1 B
145 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:C65D11E4B81E46FF927733811942FFDC
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Sun, 05 Dec 2021 01:50:30 GMT
content-type
text/html; charset=utf-8
content-length
1
x-lat
njrpug025:0:350
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

server
nginx
date
Sun, 05 Dec 2021 01:50:30 GMT
content-type
text/html
content-length
138
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:C65D11E4B81E46FF927733811942FFDC
expires
Sat, 04 Dec 2021 01:50:30 GMT
cache-control
no-cache
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
access-control-allow-origin
*
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Pug
simage2.pubmatic.com/AdServer/ Frame 9D8D
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=1452678799778604270
42 B
407 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=1452678799778604270
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:25:48 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug026:0:422
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
server
nginx
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=1452678799778604270
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
Pug
simage2.pubmatic.com/AdServer/ Frame 9D8D
Redirect Chain
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7205020425431634120
42 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7205020425431634120
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:30 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug007:0:482
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:30 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 569.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
d47c1565-b351-45f0-9cd8-bbc14cc2fdff
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7205020425431634120
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 9D8D
Redirect Chain
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:9219cd41-64a7-41a6-9776-2ff0599ff330&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
42 B
187 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:9219cd41-64a7-41a6-9776-2ff0599ff330&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Server
104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:06:07 GMT
cache-control
no-store, no-cache, private
x-lat
njrpug021:0:469
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:9219cd41-64a7-41a6-9776-2ff0599ff330&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=3000
Content-Length
0
P3P
policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
d1ba4609
rtb.gumgum.com/getuid/ Frame 9D8D 		35 B
238 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.225.34.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-225-34-171.compute-1.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame A80A 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Thu, 02 Dec 2021 09:38:23 GMT
expires
Fri, 02 Dec 2022 09:38:23 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
231127
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
514171
vid.springserve.com/vast/ Frame 3CCD 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain=
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.142.30.148 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-142-30-148.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
d83c42234fa1909988fa322bbd921e3d3ebd1da93aa404f0279c8e1d2fe3a793

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:30 GMT
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
nginx
content-encoding
gzip
content-type
application/xml;charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame 3646
Redirect Chain
  • https://beacon.walmart.com/etap.gif?tap=gAds&google_gid=CAESEIW9x6bt6Xa-T_isYnRzur0&google_cver=1&google_push=AYg5qPKPBfbWEKkksVtQ5nP7vJJUVX1rd7i4WQ4caY10xzMsAZFC5-5zKS11MfWcWfUNeNSgRNPACXuxXEy8tS6...
  • https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=QMdU_pC-nF63E9J77j4Pr0&tap=gAds&google_gid=CAESEIW9x6bt6Xa-T_isYnRzur0&google_cver=1&google_push=AYg5qPKPBfbWEKkksVtQ5nP7vJJUVX1rd7i4...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=QMdU_pC-nF63E9J77j4Pr0&tap=gAds&google_gid=CAESEIW9x6bt6Xa-T_isYnRzur0&google_cver=1&google_push=AYg5qPKPBfbWEKkksVtQ5nP7vJJUVX1rd7i4WQ4caY10xzMsAZFC5-5zKS11MfWcWfUNeNSgRNPACXuxXEy8tS6fTuHEDdaQi-Ln
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

strict-transport-security
max-age=7884000; includeSubDomains
via
HTTP/2.0 odnd
last-modified
Wed, 03 Nov 2021 00:06:43 GMT
date
Sun, 05 Dec 2021 01:50:30 GMT
content-type
text/plain; charset=utf-8
location
https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=QMdU_pC-nF63E9J77j4Pr0&tap=gAds&google_gid=CAESEIW9x6bt6Xa-T_isYnRzur0&google_cver=1&google_push=AYg5qPKPBfbWEKkksVtQ5nP7vJJUVX1rd7i4WQ4caY10xzMsAZFC5-5zKS11MfWcWfUNeNSgRNPACXuxXEy8tS6fTuHEDdaQi-Ln
cache-control
no-store, no-cache, must-revalidate
accept-ranges
bytes
timing-allow-origin
*
content-length
0
x-tb
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 3646
Redirect Chain
  • https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJzRmqm...
  • https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDUwMTUwMjMyNDAwMDAyMDYwNDgxMQ%3D%3D&google_push=AYg5qPJzRmqm3TOHfwy-JIZabCzRGWAnjzHftmQtyLBMwaYmoz7d7Bb7_NNfAh8r8k7rk2...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDUwMTUwMjMyNDAwMDAyMDYwNDgxMQ%3D%3D&google_push=AYg5qPJzRmqm3TOHfwy-JIZabCzRGWAnjzHftmQtyLBMwaYmoz7d7Bb7_NNfAh8r8k7rk269JK_wlhPj-L_w67A5ntTzMVdsMi_m
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDUwMTUwMjMyNDAwMDAyMDYwNDgxMQ%3D%3D&google_push=AYg5qPJzRmqm3TOHfwy-JIZabCzRGWAnjzHftmQtyLBMwaYmoz7d7Bb7_NNfAh8r8k7rk269JK_wlhPj-L_w67A5ntTzMVdsMi_m
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
cache-control
max-age=0, no-cache, no-store
content-length
0
strict-transport-security
max-age=2628000
expires
Sun, 05 Dec 2021 01:50:30 GMT
pixel
cm.g.doubleclick.net/ Frame 3646
Redirect Chain
  • https://rtb.openx.net/sync/dds?google_gid=CAESENH8HCX0wHi5UH0WGbAjQnU&google_cver=1&google_push=AYg5qPLNQxqTjB6aTsB-BsOKB7VBthlyClNvWKEe8MFuEtOTASev2Nkx2eQ3IbIyDf5q1nu19cTTafE7BOQ6KSgYjsCBaabFgnM
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLNQxqTjB6aTsB-BsOKB7VBthlyClNvWKEe8MFuEtOTASev2Nkx2eQ3IbIyDf5q1nu19cTTafE7BOQ6KSgYjsCBaabFgnM&google_hm=L1GOZY0lxpEDlTzdTJcDyA==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLNQxqTjB6aTsB-BsOKB7VBthlyClNvWKEe8MFuEtOTASev2Nkx2eQ3IbIyDf5q1nu19cTTafE7BOQ6KSgYjsCBaabFgnM&google_hm=L1GOZY0lxpEDlTzdTJcDyA==
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
via
1.1 google
server
Cowboy
access-control-allow-origin
null
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLNQxqTjB6aTsB-BsOKB7VBthlyClNvWKEe8MFuEtOTASev2Nkx2eQ3IbIyDf5q1nu19cTTafE7BOQ6KSgYjsCBaabFgnM&google_hm=L1GOZY0lxpEDlTzdTJcDyA==
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-request-id
e8l94qvsr8r2pndg80336a0f31ies8ea
pixel
cm.g.doubleclick.net/ Frame 3646
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=a1EDqBmGSoC8aBvbqGKORw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=a1EDqBmGSoC8aBvbqGKORw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK9JGOG5KEdnA847SVmraP29OgXdbrjd6OiUFg8yu7EIRbzo5WWWJr1EK8bZdd0e5hCEzKJAX2rOmRd-gjNw1BVzJns6No5
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=a1EDqBmGSoC8aBvbqGKORw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK9JGOG5KEdnA847SVmraP29OgXdbrjd6OiUFg8yu7EIRbzo5WWWJr1EK8bZdd0e5hCEzKJAX2rOmRd-gjNw1BVzJns6No5
date
Sun, 05 Dec 2021 01:50:29 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame 3646
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2J...
0
0
trk
ag.innovid.com/ Frame 3646 		43 B
296 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ag.innovid.com/trk?tid=11711&google_gid=CAESEP003VWIuXFfFYDzdtNfS4w&google_cver=1&google_push=AYg5qPK74qLM5BBlQve79Jb6E1mnv345QHJ_1ToBzuGERKMZBD5TIlzJXxRxLHcNhZJ99Hqb019G4ZJ7iiVpIX8ildHysovf-aod
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:445b:901:5dde:90cc:842c:e1f Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
cache-control
no-cache
content-type
image/gif
content-length
43
request-time
0
expires
-1
pixel
cm.g.doubleclick.net/ Frame 3646
Redirect Chain
  • https://cc.adingo.jp/adx/push/?google_gid=CAESEBk9zoQlfVUJo57fis4DpU4&google_cver=1&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
  • https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21...
0
0
attr
cm.g.doubleclick.net/pixel/ Frame 3646 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KRbadrse7pKHxbYVuR_x6NJf12o4dKfKrbzcbMpy5phfwB2019QgWgAQ261uAk31QZi1gA
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:30 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
gen_204
pagead2.googlesyndication.com/pagead/ Frame DD10 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BX3lD3xqsYdWfJITEowaSkrUYAAAAADgB4AQC&bg=!UVKlUhbNAAaQHwIOkB87ACkAdvg8WjRvRdhCC8rcxZbqFwK0jDABAK9SVqId5SZpSjAR9-FpeH2uiQIAAAh6UgAAAJRoAQeZAttSAyAqn0UPNCwjXP6dwys1Kce4u1kVH6XeMrLh69max7UMdB2LHAp6KfNzOZaSDYXXY29h89p0QFZjNpjaP8c67DqWJxUH9M_Qnj9OS3a-DTPJ8b1I7DP0z2YlIdcTbWwU9VhYCRWI8tfime244OzItiHRcbTW_WzJhiRutdPDjf5PkcoCur4CLKkiMEBSHXd9lVzyuZES2SWulUtpgj4IkjSztbk9d8x8b4lMnfjxTt2QNfFHZijuwDHKBiRUiubKx9YSyF1h6da2Avry4rYsjj-DwI2o8z1_c8002sA9qf5lDfvY6KuCjVCmOlsBftP6nvXYLlWXgtGcwJV30QI61bVLns-vIpio8eK5w0-dWJEMXPDsuZcGsiSPXQZjbXsB6-dDe7hFvbAfZe7yr3ekMFa5KC683do1EJdMx4i5IiWzI6v1G8x8s8V8OegFoyAf2-NqJr9A-HwGu_6P8AS3ybkzT095pAQO6Hs7u0HVRak4ko3YQvXn_7NInggeoYwvWt0c0YPSi-fYI4O96lhNcPkCiKI0A4-4JSYdZzp5XVuYrE6mu50oY_BXlmm2VacxBC8raDj55u1J5HSDZZmgQj1NdF-XkkOueT1kKkUw8oZ2TzyIeMsBd57dqrRRRgfW3J4d3Ddt2FQJMMmV_jrRniIdZlVd3ZGuA0QnAd-dxnasQ8juCCc5UqNiaM-6DoiqE3oeqn49ZzaHDIq0bpTXvYHOCfpfHoCepyTv8zWTCQJ_SUyf_xJIJGdXqqseRjUN69PBwZVBXzTFTOfxkjYMf9eQ6OrPFFUko-bJnDYIsMw1P5QNjl8ClB56XgzDHzTTSkrS2lqDGm9gwmPpD_WdiTz6hgX4kXYQpxXI4z7gWiHSzw6pvMovUkWfyTMsEjnoJDrw20MssTGa5GaWheamw2gPIESNegD6PuZCnmnnRryy_MiscnbKhM7J6G0QYztNhzTgGPcFGt53aw
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
pagead2.googlesyndication.com/bg/ Frame 434F 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6610f6e5ebf811f47e5c53f5f536df0e8f431dc31af4618cd5c0e53ef5443374
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 18:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
113702
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13522
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 18:15:28 GMT
vpaid_25214542.js
vpaid.springserve.com/production/ Frame 182D 		495 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vpaid.springserve.com/production/vpaid_25214542.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:8400:15:6f6c:b180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6b065f38eaed75574515532e2d687fd23450a662a972d044626b848d6e9d1045

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 01:33:13 GMT
content-encoding
br
last-modified
Fri, 19 Nov 2021 18:30:16 GMT
server
AmazonS3
age
519438
etag
W/"185feb14359001049d144410afbeaaa4"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 ee623581f95aa65c7c8707871d87b791.cloudfront.net (CloudFront)
cache-control
max-age=2678400
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
FJZB5mXn7v9hdufaDeOdWFNrYesG8Bpwb2Oa7_vkpSJEfiJcpGpv8g==
pixel
cm.g.doubleclick.net/ Frame C348
Redirect Chain
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMtyV38g_dQPONeLol_kk2o&google_cver=1&google_push=AYg5qPK_GazHLI3C7_Cbpo82-DtI-8O6cOpYAIQp4vVmWzREQSq1LjGbAP...
  • https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AYg5qPK_GazHLI3C7_Cbpo82-DtI-8O6cOpYAIQp4vVmWzREQSq1LjGbAPBia_RPLLCgswyDXhXafk8_Orc9GEINNloBSqMcpAOf&google_hm=2YfLJ4...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AYg5qPK_GazHLI3C7_Cbpo82-DtI-8O6cOpYAIQp4vVmWzREQSq1LjGbAPBia_RPLLCgswyDXhXafk8_Orc9GEINNloBSqMcpAOf&google_hm=2YfLJ43lSx165-4VdnV6Aw
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AYg5qPK_GazHLI3C7_Cbpo82-DtI-8O6cOpYAIQp4vVmWzREQSq1LjGbAPBia_RPLLCgswyDXhXafk8_Orc9GEINNloBSqMcpAOf&google_hm=2YfLJ43lSx165-4VdnV6Aw
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame C348
Redirect Chain
  • https://d.agkn.com/pixel/2175/?google_gid=CAESEEj0y1-I3H_JUMoDktMhIq8&google_cver=1&google_push=AYg5qPJtU13ZKVlZvxPxeP4FfP0Kdq7IPWkZX_8f_beZE4LgVJWTflaqOq-P-sqavcBJT6wEV-NtkZkLaTtRfgK8xKlbJbxhELq_
  • https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJtU13ZKVlZvxPxeP4FfP0Kdq7IPWkZX_8f_beZE4LgVJWTflaqOq-P-sqavcBJT6wEV-NtkZkLaTtRfgK8xKlbJbxhELq_&google_hm=Q0FFU0VFajB5MS1JM0hfS...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJtU13ZKVlZvxPxeP4FfP0Kdq7IPWkZX_8f_beZE4LgVJWTflaqOq-P-sqavcBJT6wEV-NtkZkLaTtRfgK8xKlbJbxhELq_&google_hm=Q0FFU0VFajB5MS1JM0hfSlVNb0RrdE1oSXE4
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
via
1.1 95a7b3c60127f88f316c1c042cf353c3.cloudfront.net (CloudFront)
server
Apache-Coyote/1.1
x-amz-cf-pop
EWR53-C1
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
location
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJtU13ZKVlZvxPxeP4FfP0Kdq7IPWkZX_8f_beZE4LgVJWTflaqOq-P-sqavcBJT6wEV-NtkZkLaTtRfgK8xKlbJbxhELq_&google_hm=Q0FFU0VFajB5MS1JM0hfSlVNb0RrdE1oSXE4
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
krRQJoa5mDzRlDbHKSnMM0KM7Ot5kKP5ukSDddT1vLutBlnTGMqiFw==
expires
Sat, 01 Jan 2000 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame C348
Redirect Chain
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_4530&src.visitorid=CAESEN2ax7ulewDrrxgprRBHmLw&google_cver=1&google_push=AYg5qPLVT75ipNRezwkgLFIBdpIbw4pDTfoOeFHTO0FLbXtb3yP8eUehvct_Vp38QneNne3citdLzsGu4...
  • https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AYg5qPLVT75ipNRezwkgLFIBdpIbw4pDTfoOeFHTO0FLbXtb3yP8eUehvct_Vp38QneNne3citdLzsGu4ZWxe7Nq0jOcnYFH8dT7&google_hm=MTA1OTU4NDQwMj...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AYg5qPLVT75ipNRezwkgLFIBdpIbw4pDTfoOeFHTO0FLbXtb3yP8eUehvct_Vp38QneNne3citdLzsGu4ZWxe7Nq0jOcnYFH8dT7&google_hm=MTA1OTU4NDQwMjU4OTU5MTU3MDk
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
via
1.1 google
server
Apache
p3p
CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AYg5qPLVT75ipNRezwkgLFIBdpIbw4pDTfoOeFHTO0FLbXtb3yP8eUehvct_Vp38QneNne3citdLzsGu4ZWxe7Nq0jOcnYFH8dT7&google_hm=MTA1OTU4NDQwMjU4OTU5MTU3MDk
cache-control
no-cache, no-store, must-revalidate
alt-svc
clear
content-length
0
x-application-context
application
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame C348
Redirect Chain
  • https://rtb.openx.net/sync/dds?google_gid=CAESENH8HCX0wHi5UH0WGbAjQnU&google_cver=1&google_push=AYg5qPKXkKoNeUdgwvi6Ydb_nAE1awiv1LPYYv3c5njH5wi8Z4hqBQwLAcp7OKLSKG7-NvR2HphorQMVylljzP7NjnOWC6QpKMPO
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKXkKoNeUdgwvi6Ydb_nAE1awiv1LPYYv3c5njH5wi8Z4hqBQwLAcp7OKLSKG7-NvR2HphorQMVylljzP7NjnOWC6QpKMPO&google_hm=L1GOZY0lxpEDlTzdTJcDyA==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKXkKoNeUdgwvi6Ydb_nAE1awiv1LPYYv3c5njH5wi8Z4hqBQwLAcp7OKLSKG7-NvR2HphorQMVylljzP7NjnOWC6QpKMPO&google_hm=L1GOZY0lxpEDlTzdTJcDyA==
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:29 GMT
via
1.1 google
server
Cowboy
access-control-allow-origin
null
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKXkKoNeUdgwvi6Ydb_nAE1awiv1LPYYv3c5njH5wi8Z4hqBQwLAcp7OKLSKG7-NvR2HphorQMVylljzP7NjnOWC6QpKMPO&google_hm=L1GOZY0lxpEDlTzdTJcDyA==
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-request-id
s5k7dvscjnorhdtv8ic38jal7beqa2r7
pixel
cm.g.doubleclick.net/ Frame C348
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=a1EDqBmGSoC8aBvbqGKORw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=a1EDqBmGSoC8aBvbqGKORw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJygpDEgr3xdeDKf1Ny76acj_SfTserFocPaOT9c-_bAjyHD84qOjJ4WvWWLmZwWK_O1NLjKh8X3kHArrYFJmwBQ9ERsPcW
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=a1EDqBmGSoC8aBvbqGKORw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJygpDEgr3xdeDKf1Ny76acj_SfTserFocPaOT9c-_bAjyHD84qOjJ4WvWWLmZwWK_O1NLjKh8X3kHArrYFJmwBQ9ERsPcW
date
Sun, 05 Dec 2021 01:50:30 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame C348
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n&google_gid=CAESED61yng7GXz8XgVHNAd97-I&google_cver=1&google_push=AYg5qPKtEdgzQ4TUTveyfzJoHv3KkwjCSz1dTFJvzIzzpX9KwwkNn4zp9nnCvToz7zIax4YZ-18ozpZ...
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTNhMmQ4YzVhZGNlM2Y4MDc2MWQxOTFkYzczMDQ4MzFlNWZjMDQ0Mw
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTNhMmQ4YzVhZGNlM2Y4MDc2MWQxOTFkYzczMDQ4MzFlNWZjMDQ0Mw
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTNhMmQ4YzVhZGNlM2Y4MDc2MWQxOTFkYzczMDQ4MzFlNWZjMDQ0Mw
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
0228ab361cece0438ff9eb16e4e5890e
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
pixel
cm.g.doubleclick.net/ Frame C348
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzG...
0
0
attr
cm.g.doubleclick.net/pixel/ Frame C348 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JVaBqsBO6AmAy2RLcTHaIhCTJ59MWyUeerHwN-z0c-fm5b0E3PMOULrULY2zcK66eEDB_K
Requested by
Host: 05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
URL: https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:30 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
pagead2.googlesyndication.com/bg/ Frame 5444 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6610f6e5ebf811f47e5c53f5f536df0e8f431dc31af4618cd5c0e53ef5443374
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 18:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
113702
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13522
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 18:15:28 GMT
index.html
storage.googleapis.com/session-hub/ Frame 2AB6 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/session-hub/index.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2010 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
b73857582989f2602487dc4de28f9e84ec0f34dad3857a405137e60150e4bfa4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/

Response headers

x-guploader-uploadid
ADPycdvKF-FpJxN7NYkXKtQzkfFJQhPCaDR6SJZ82WJGMG7s-81Gvky4McnNpU39cGiO0vutdpZhCcxRP1Fc_y2FUnVny52LoQ
expires
Sun, 05 Dec 2021 01:57:39 GMT
date
Sun, 05 Dec 2021 00:57:39 GMT
last-modified
Wed, 28 Aug 2019 19:06:32 GMT
etag
"81bfe4f005f3280a68f6b07b2b1c8d60"
x-goog-generation
1567019192557207
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
2151
content-type
text/html
content-language
en
x-goog-hash
crc32c=R+UPRg== md5=gb/k8AXzKApo9rB7KxyNYA==
x-goog-storage-class
REGIONAL
accept-ranges
bytes
content-length
2151
server
UploadServer
age
3171
cache-control
public, max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
pagead2.googlesyndication.com/bg/ Frame A80A 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6610f6e5ebf811f47e5c53f5f536df0e8f431dc31af4618cd5c0e53ef5443374
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 18:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
113702
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13522
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 18:15:28 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 182D 		160 B
1005 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
829471fae4063e334bfd47ba2c8508a2da9ee24d66974c731c65188fa0d40934
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:30 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
4c1ba5bf-3d50-4b9f-93fd-fd970ca9bcb4
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
160
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame 182D 		0
66 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:29 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
openrtb
ads.adaptv.advertising.com/rtb/ Frame 182D 		0
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.81.191.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-81-191-231.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
openrtb
ads.adaptv.advertising.com/rtb/ Frame 182D 		0
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.81.191.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-81-191-231.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
937e1f6a-4c86-481c-8fb2-5a6018496d53.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/937e1f6a-4c86-481c-8fb2-5a6018496d53.jpg?crop=834:541,smart&width=834&height=541&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
140852976f26386afd24e8b07c5fd1c4f43c4bf004236d3bd3a704ee154e99f9

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:30 GMT
content-encoding
br
age
1235
etag
"MuFENSRXK5Jlill46k64v/R72jdsibjq/2JyXRBFB6s"
access-control-max-age
86400
fastly-io-info
ifsz=110792 idim=1600x900 ifmt=jpeg ofsz=30774 odim=834x541 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
30329
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
830b8ca5f78f00f8a0d79813f2ba95b0a7efd1ee7536567b5c25219323f3209b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:50:30 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads.adaptv.advertising.com/a/h/ Frame 182D 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669030063&gdpr=&gdpr_consent=&us_privacy=&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=[scpid]&hp=[hp]&eov=eov&pi.width=640&pi.height=480
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.81.191.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-81-191-231.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
f84b469a69ccfaad0bb1b8fbc57ad100b1972b849b7c897af7ca2cabf879efe8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
server
adaptv/1.0
content-type
text/xml
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
953
expires
0
o2shim
acds.prod.vidible.tv/ Frame 29A9 		15 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=48441f6f-76fe-46b3-81a0-fd0004006197&pblob=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.222.130.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-222-130-154.compute-1.amazonaws.com
Software
/
Resource Hash
68a6e4df2c9b52e1e00f74e1dfd8a3f1ed971630f2145db2ed6017d7c0f47991

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:30 GMT
content-encoding
gzip
access-control-max-age
3600
access-control-allow-methods
POST, GET, HEAD, PUT, PATCH, DELETE
content-type
application/javascript
access-control-allow-origin
*
access-control-allow-headers
content-length
6645
gen_204
pagead2.googlesyndication.com/pagead/ Frame 434F 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=ByYwF5BqsYfjEBdWdowavo5LQBgAAAAA4AeAEAg&bg=!8_Cl8LTNAAaQHwIOkB87ACkAdvg8WmZ7F2NhNG1gINAAiYNqguzoZR60yyDTQmyqz1m1Mg8EG7a37gIAAAFHUgAAAC5oAQeZAuz2gj2CkfaVfIogRUQ_Vy2LJaEE5L4LO2X2Q1yRVAr9IQp-o4n_OurJ5Q8qHQHcf8PQodklsudv-YLKLK7ukbuPbfeTy1W4bDTqotZMd4A0KqUyJyJKdNqh-Nj1sweCtbzSu47J6Q2mds2BZKdUkLxdiEorAPnNVk0y0Mv9G88zK9dP40BYZzsHEKiGkEiC0wFUm7XKd-V-1ba_e_Wu3McSrRz5SMzZP1Xvo-_Wf4HB5EOMLJ8EzgCbdVgQqQxH_KPUxPH-_oTSafteeEspB3f52w-GbJAuJtIGjYX2XQ885TJ5U8T8RW1jFTDKORC9AKV2IITxKqOFZrj8VRJuunzIxYpps0exM2OpbIUHrYKYrUUSAMtMRU-I1rQhEzIAhusw92FXmEzH-KsFDrdNhcrLdRbKl-b6TxZtMmipCbdwCcdN2JrVNg2C3Z9o3Vny6CaB8ubkjhEnMiu53xQQEW5fZ90Wndeuw4Lw_vfVkA5hVpUaxtl2EwEBYnH_PdieUCQvvqcmNumDB-MLaxX910NjqAwnqMBg-_RX9lhWQxnI8h8885ylsxfK-ZpUmyyKYZYyNrftNfuJq9rHW3RZPrS8ZPycE4ysF8Tr_nRw8e9QKkRoj3VTmPQd9MuufMAHhYCko7T5gjt2S-PAegmWYeSt1Bf-5h6c7nm6m3XJ9Ow0ohRKLERjTIou5LPe7-It4YVmopTOPr6MB2fo4zu5AACBsy6az0xs3nujKTjZM2n1F4BYMaw1kQtq4Zrk1mpzH5O7raGIRVMxXcCGmXeCrxq_o9z-qteRD7lV7wocdJwCPyUzrefiNRL1Mk3jEnQbnvEooabSf2raD7-KNBVdodemK6UubsTx4Sdk4p0ruTcgNgLPX8oPVvs3ntkce2NyDZPoDLX-cZLg_GeN--bd6pOSaIe3uWyTDGc3kZOAVvw0S3e_B-LXb1InD01bBf9me2E9ert0OsECHw6ZLswY0N_Sc58QyEs731vV83r9
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 5444 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bah2S5BqsYYSQNM-gogaWx4qoCAAAAAA4AeAEAg&bg=!LC-lL2vNAAaQHwIOkB87ACkAdvg8Wnf_IY0oljWE5ZQki2QjEekkyxlsJSJXgRAlkMyQBXklF3H2xgIAAAEKUgAAABdoAQeZA3LZry9-yNS01mnfnSxnGO0aq8FJfjKVY6ZwMuBgeQE2r03U0cV-Wo1hSc5-uLCsTTvulUyt8i3qDqWmSHW9x9cI1n3apIgjLI7nkFXTKISzbAVQtqyuWS5Hng65DjAXGn4SqOL1OYcIOx58eG4FMUdzweWNyKj_zX1lPNkRjr6O0WehtyE0uukzqPnburh4cXkKVwmXiPbIVwjNaZLlxpt9-FGZqCbCM79Iie82vjSPwbHDlsf0VGSnJPoMdIRG8bWS_mktuorXKg2alFsmqJaOGtvOI672YQkle7l0WDGsAJPbbQlHFZ1NpszNMXVab9Ip-ql0wPzEzK3fD-_FLS1QvJSpqTTTpQjNIgXRo1LvMIcbZyVcT9xoVudKvVhK8aNNraKIETaWMuFUFDdPnGJK6EtAAcsQizNjFqPXB1ilFz97MMuWVhtmMb_EZH1QbsWLjX2DUc3bYHB511MYU38PC-BUmr-5rfWEtCaC38EZts5hrddebEUy4Td9c83nIzDXGO2szKj5pEJpB88b0b2FSr1nmtSi1-E3fKdxZOMhUBhmrxF7pXCqCryD-27zYzzX9IPMBHSgWA_uTgRdBeISo9-JrDLp1iho5Skx1PK-Emu_DXKKlQPfKLCZn6i_sG5IGzr2QH8I_dEmDuNjx7Qlc_w-zHiDcPe2O8gq80-5iA0QAH-eBNT6Lop9vvt8fJWH8rhaFfKQ6z3KOAXGWnuoseL2QkMcxkSQf3BZ6-6pAGoT55WL43PCJAN5sXctXUf1uos5rR1MHM2rUlotS7jGSyYkwmhlOWVhXA7ZQnni3V9BvQVJ0FWrHpCtQ2hNWOAxIc0XuShmirME1J_RyYOJ2yrMQQ8dGsTEkMQT7p-WVN8Y-LCJFRZXbWfdeLoWAI98pPz58HD5sK2bNyHO2cKPgxge5PVh-6fTe-01TGnraeCIbu2FtkEZFh9mSVGCsyr8vLcgDhxyRZYFA704QiTaY0j78_jozpHn047p_yVwpzWFmL4S2eE7vMd66TS4woRqjQ72tp-Qd3od5GHfnzUcbys-to7i8j0ntm1AmwmvigSP8wjt9pX1ckXVaffMywVdC0jvOjOaRhKIyZt6C5yVV9v07GzqBdR7A5OwbNMm9JSkUlGxhZmmMHVhgl17rbuS50FlI5RlEFZvlnSn0xKaY-c
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame A80A 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BCK_w5RqsYfzUD46WyQPB3o_wCgAAAAA4AeAEAg&bg=!sbKlsvbNAAaQHwIOkB87ACkAdvg8WnMG2kzEAlyFV4mQ2tVKbtxnUNedf52y7UQHXq93DpkUpMf6rAIAAAD6UgAAABJoAQeZAw-A_nLxQKB9yJYF8zFRqMhkenRCHziBL1zLgw6fMZAehDOP4jbmIPUJcFYpupm-2LUCrQpBDSvjrKbNQb2aA0V0rpczo0fRYdSPJncu0FBE98pIzWjpQS47ZtiH99ZM1t6lCvH1qbhuUIkUll2Ow3oAp5AvxhNP5LSnGsIrBdsHp__WbY7pjZL2NUHzpDHgsp7RcN8UQMvgKgUCem7kxxjQ-fN6qkp6z65cYebQYMDSdUGTLX79M9X5tiAca_JZF90HevbSrsoWieFqCgfeYmR6j9ZwW_TLZygNr00IS-prK7furDvxU8ZQ0L91OG0ZFlaaU5pJ28ZTYzPw6QF9_wPpQxt585oQAaTONp8MLD89wN6li-ff-hdT924pdDhuTOQ-U5zKzEJ6cMwjsEet458Xwd1EEf4cyS3wahjWIXT4NXBUjg3N8OKlbTQ0mHnRg8ZSFvsNMMm0LdmjMEtbdhcKbYqEbEFJbqdTr08v9J1wo_WXSX8BbSK0dR0pS-qS4cV2Ew2kN2TWQj8ZhW32vXt5ERlXOTjFPFFLTUBJAQGRz0gaOh8SwU6nnUJc8TVJFFuWaCPWVJWmuCdDj2nyf78QpFE8etmDnHui8br_4bbQrSFzbuBnQJp8lENLEqnv2rWr8p3l9ZAlO3ftCOg4sEGYD9wh2W9flq_18gJZnpToh4dOX_cLp4RtEH-dBa11l-tGv6r-mBgWZKxb_P9bzAJWo1KxO_ACJA8SVL-OFk8VE0bd5ACth-g6g1Wj2ly63ZndrxIQfsog_-9YRnHcGiy5SuCq6xP-FGfB8pQRjh1YOn7STkJ_8dVm0KkipwcikEazMioiYP4EcvY0NVbk0ux2iR5smK8S0VK9lx-lr8inzW9yRRa9T-SpoSD7GBfPtd8j8PKxyGV5bQXJqHInWWZ6rX18gDc1OYFEfn2DjNTmaPaIsFxL_EKoSeGzqc57cdTmcydvsR-6_H-OQbsAmObjVl43oYUyPbiykK2uCNlXDQU1C4S7Q0W3OAbw7h4UZYttxPK6t4cg8Z_oPXnvlic
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
0.js
cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/ Frame 29A9 		319 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Requested by
Host: acds.prod.vidible.tv
URL: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=48441f6f-76fe-46b3-81a0-fd0004006197&pblob=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4998:14:800::1001 Ashburn, United States, ASN14777 (YAHOO, US),
Reverse DNS
Software
ATS /
Resource Hash
415522d8ed63727924c2a9dcfe8ee62e86d97f0860aa9d73103efccef9e6c969
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

ats-carp-promotion
1
date
Mon, 29 Nov 2021 16:25:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
465878
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-length
104909
x-amz-id-2
ViDU7qxIVXCQ1OoL+wnEuf7bcOjIs2T7ni4ZpbYjPgnIAOe5CwvGhyqrgU0nSXPjJWD8zviCczc=
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 29 Oct 2021 12:07:18 GMT
server
ATS
etag
"ad866575d644f8b5c5d7a56ff730d7e3-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET
x-amz-request-id
XVSF9HDPN0WNYG5D
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=1209600
x-amz-version-id
null
accept-ranges
bytes
content-type
application/javascript
impression.gif
trk.vidible.tv/trk/ Frame 29A9 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/impression.gif?pid=59947c0544a64b1a49e52a48&bcid=603d9102810cd10001d1d12f&s=true&pv=10.2.82&ifr=true&cb=0.21741205526589225&pt=o2unit&sid=d4c42b6a-9039-472f-8f40-1942c25d13ca&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.41.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-41-176.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:30 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:50:30 GMT
st
capi.connatix.com/tr/ Frame 3CCD 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/st?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:29 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
moatapi.js
z.moatads.com/aolvidibleapi29384728347/ Frame 182D 		133 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/aolvidibleapi29384728347/moatapi.js
Requested by
Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
90542f9de6cab010087ab4bcab0e3b0a2ec1e449e445434dc1bb5c852033f046

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:30 GMT
content-encoding
gzip
last-modified
Tue, 25 Feb 2020 18:37:38 GMT
server
AmazonS3
x-amz-request-id
248CC7A683259DAA
etag
"d678022569896f7b7293494e3a69c8c7"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=10934
accept-ranges
bytes
content-length
44266
x-amz-id-2
3gL1G73xdwsJvoBVhRBYvjjgpoiElrEMgkbddhjUjbkesF76DaTRBtuV3PjNJcRAEgbxpZrGLm4=
VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads-ec.v.ssp.yahoo.com/a/h/ Frame 29A9
Redirect Chain
  • https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669030063&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&p...
  • https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669030063&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.he...
249 B
0 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669030063&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=fe3bd228-9b1e-4d2f-b608-6781007b4b39&a.is_yahoo=3&redirect_y=dHM9MTYzODY2OTAzMDc0NC4zMTQyMDk6YXBpZD1VUGI2YjRjODk5LTU1NmQtMTFlYy05ZjA5LTBlOThjZTUzMGUzNzptaWdyYXRlZDJ5PSIxIjpyZXF1ZXN0X2lkPWZlM2JkMjI4LTliMWUtNGQyZi1iNjA4LTY3ODEwMDdiNGIzOQ==
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
3.231.253.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-231-253-205.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
content-encoding
gzip
server
ATS/9.1.0.33
Age
1
content-type
text/xml
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
192
expires
0

Redirect headers

strict-transport-security
max-age=31536000
server
adaptv/1.0
access-control-allow-origin
https://www.bleepingcomputer.com
content-type
text/plain
location
https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669030063&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=fe3bd228-9b1e-4d2f-b608-6781007b4b39&a.is_yahoo=3&redirect_y=dHM9MTYzODY2OTAzMDc0NC4zMTQyMDk6YXBpZD1VUGI2YjRjODk5LTU1NmQtMTFlYy05ZjA5LTBlOThjZTUzMGUzNzptaWdyYXRlZDJ5PSIxIjpyZXF1ZXN0X2lkPWZlM2JkMjI4LTliMWUtNGQyZi1iNjA4LTY3ODEwMDdiNGIzOQ==
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
0
display.gif
trk.vidible.tv/trk/ Frame 29A9 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/display.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=d4c42b6a-9039-472f-8f40-1942c25d13ca&vvuid=936b077e-79f0-45db-8b43-9ef609f9058e&orgId=28949&plcid=1279691&vrid=48441f6f-76fe-46b3-81a0-fd0004006197&ab=0&dt=133&h=469&spaceid=793604934&w=834&cb=0.9940186741001991
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.41.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-41-176.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:30 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:50:30 GMT
ad-request.gif
trk.vidible.tv/trk/ Frame 29A9 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/ad-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=d4c42b6a-9039-472f-8f40-1942c25d13ca&vvuid=936b077e-79f0-45db-8b43-9ef609f9058e&orgId=28949&plcid=1279691&vrid=48441f6f-76fe-46b3-81a0-fd0004006197&at=preroll&ps=html5-vpaid&spaceid=793604934&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&cb=0.3774759181043992
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.41.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-41-176.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:30 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:50:30 GMT
ad-engine-request.gif
trk.vidible.tv/trk/ Frame 29A9 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/ad-engine-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=d4c42b6a-9039-472f-8f40-1942c25d13ca&vvuid=936b077e-79f0-45db-8b43-9ef609f9058e&orgId=28949&plcid=1279691&vrid=48441f6f-76fe-46b3-81a0-fd0004006197&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=834&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&h=469&cb=0.7355357569578884
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.41.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-41-176.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:30 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:50:30 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&ac=1&bq=7&i=AOL_VIDIBLE_API1&t=1638669030757&de=272093702953&d=291%3A-%3A-%3A-&bo=bleepingcomputer.com&bd=bleepingcomputer.com&f=0&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:50:30 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 627A 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss_JGRW9_p3WcelCn0HgRUGlvFxmGczN521Op9JxfqK-4T9bNFuQaTUm4Dh4fThXnaJ2zQMf2Q35o3eQZSiNWnQlk7OAsdFNZRrTF7MAuGNsF10ek4&sai=AMfl-YSkASiON7G_O9p-dHbC7z6OGDBDrNWrwMDFu_ULfrtFT_h46NJsaCDyJ0c63pYwXHCcQEN5n-7abxuyV9D21MVPs6uIIOvr82HuXx1TRfJI8mhPGueV3aHUkjeA&sig=Cg0ArKJSzPjSQi38FiigEAE&cid=CAASEuRobyLsy9JZbvD-Sbvy21XX7A&id=lidar2&mcvt=1007&p=226,315,320,1043&mtos=0,1007,1007,1007,1007&tos=0,1007,0,0,0&v=20211202&bin=7&avms=nio&bs=0,0&mc=0.96&if=1&app=0&itpl=20&adk=960084856&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638669028803&rpt=936&isd=0&lsd=0&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
envelope
api.rlcdn.com/api/identity/ 		0
259 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.rlcdn.com/api/identity/envelope?pid=1258
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.155.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.155.120.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
access-control-allow-headers
Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length
0
id
id.crwdcntrl.net/ 		77 B
831 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id.crwdcntrl.net/id
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.73.153.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-73-153-177.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
0265daca84edfc7afa2af71bc29d2c01afd7146b56f6a8987aa959a25ac91171

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
Jetty(9.4.38.v20210224)
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache
x-server
10.40.14.48
access-control-allow-credentials
true
content-type
application/json;charset=utf-8
content-length
77
expires
0
id
id.sharedid.org/ 		41 B
379 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id.sharedid.org/id
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.218.247.33 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-218-247-33.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
27a172eb814cce5a689f3b94b43fdac851e702f540233515e8280bfb84f6b10d

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache,no-store,must-revalidate
access-control-allow-credentials
true
content-length
41
expires
0
rid
match.adsrvr.org/track/ 		108 B
739 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
3cc026fab39eaf6f1bc4d81bc70075ecd8898f63a269be52c1ef00f5729527a1

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
x-aspnet-version
4.0.30319
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
108
expires
Tue, 04 Jan 2022 01:50:31 GMT
check.html
biddr.brealtime.com/ Frame 5A38 		926 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://biddr.brealtime.com/check.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.17.120.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Date
Sun, 05 Dec 2021 01:50:31 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
x-amz-id-2
m/iP8HNMbhF4060df/qdHjSXRhe5mH/wL0uhFM/VUNQ5NRd3/WDQsRrAhyXS3rDOvDdamw1oRcc=
x-amz-request-id
834KF6H61TQ1VB4K
Last-Modified
Tue, 08 Sep 2020 13:51:51 GMT
CF-Cache-Status
HIT
Age
1998
Expires
Sun, 05 Dec 2021 01:51:31 GMT
Cache-Control
public, max-age=60
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
Server
cloudflare
CF-RAY
6b899fc49a38715a-YUL
Content-Encoding
gzip
checksync.php
contextual.media.net/ Frame 67FE 		32 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c39238598cc03d4fbaab44e7f0b3d4552f8c2617e0203cf6c5f74ce5ada647a9
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

server
Apache
content-type
text/html; charset=UTF-8
x-mnet-hl2
E
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
strict-transport-security
max-age=604800
vary
Accept-Encoding
content-encoding
gzip
cache-control
max-age=70009
expires
Sun, 05 Dec 2021 21:17:20 GMT
date
Sun, 05 Dec 2021 01:50:31 GMT
content-length
11108
pd
us-u.openx.net/w/1.0/ Frame C05B 		1 KB
691 B 		Document
General
Check archive.org
Download Go to
Full URL
https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
74079c1cde82d6cd3c0d6ae99bbefb7cb0d7d42ecb76979c4fdd5aa4125d928e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.221.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sun, 05 Dec 2021 01:50:31 GMT
content-type
text/html
content-length
672
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
ixmatch.html
js-sec.indexww.com/um/ Frame 4F74 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Server
Apache
Last-Modified
Thu, 11 Feb 2021 16:12:45 GMT
ETag
"e20015-90b-5bb11ca420f07"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1151
Date
Sun, 05 Dec 2021 01:50:31 GMT
Connection
keep-alive
index.html
cdn.districtm.io/ids/ Frame 3D54 		116 B
236 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
content-type
text/html
cf-ray
6b899fc47dc9ca4f-YUL
age
7171
last-modified
Thu, 20 May 2021 02:18:27 GMT
via
1.1 9e89086b4bc4697bea1e1dec6ddc5c5c.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-amz-cf-id
L99qIotPmlJjbT4iwBbKu1kEeM_UgfVqhchNaQ6wvCqMgdYd3yYGjw==
x-amz-cf-pop
JFK51-C1
x-cache
Hit from cloudfront
vary
Accept-Encoding
server
cloudflare
content-encoding
br
async_usersync.html
acdn.adnxs.com/dmp/ Frame A83D 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Connection
keep-alive
Content-Length
17053
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/html
Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
W/"5fc7ff8f-cf34"
Expires
Wed, 24 Nov 2021 05:35:57 GMT
Cache-Control
max-age=86402
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Accept-Ranges
bytes
Date
Sun, 05 Dec 2021 01:50:31 GMT
Age
74686
X-Served-By
cache-lga21956-LGA, cache-yul12829-YUL
X-Cache
HIT, HIT
X-Cache-Hits
4, 511026
X-Timer
S1638669031.152911,VS0,VE0
Vary
Accept-Encoding
index.html
cdn.districtm.io/ids/ Frame C436 		116 B
358 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
content-type
text/html
cf-ray
6b899fc47dcdca4f-YUL
age
7171
last-modified
Thu, 20 May 2021 02:18:27 GMT
via
1.1 697118bcd171d3b8a0299bf4ce5a8604.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-amz-cf-id
YnC1qT18NczxkY4xIzngCpKmO6lckP-uodBjOeo2AJIgwZzX3Ch26w==
x-amz-cf-pop
JFK51-C1
x-cache
Hit from cloudfront
vary
Accept-Encoding
server
cloudflare
content-encoding
br
ixmatch.html
js-sec.indexww.com/um/ Frame 47F1 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Server
Apache
Last-Modified
Thu, 11 Feb 2021 16:12:45 GMT
ETag
"e20015-90b-5bb11ca420f07"
Accept-Ranges
bytes
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
1151
Date
Sun, 05 Dec 2021 01:50:31 GMT
Connection
keep-alive
checksync.php
contextual.media.net/ Frame 8DA1 		32 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c39238598cc03d4fbaab44e7f0b3d4552f8c2617e0203cf6c5f74ce5ada647a9
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

server
Apache
content-type
text/html; charset=UTF-8
x-mnet-hl2
E
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
strict-transport-security
max-age=604800
vary
Accept-Encoding
content-encoding
gzip
cache-control
max-age=70009
expires
Sun, 05 Dec 2021 21:17:20 GMT
date
Sun, 05 Dec 2021 01:50:31 GMT
content-length
11108
sync
eb2.3lift.com/ Frame 6FA7 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://eb2.3lift.com/sync?
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
712e541dd878bef4c1b8775dd20054ada7da73b11af40bafec8dad0c7241b683

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
content-type
text/html; charset=utf-8
content-length
464
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate
pd
us-u.openx.net/w/1.0/ Frame F444 		1 KB
691 B 		Document
General
Check archive.org
Download Go to
Full URL
https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
74079c1cde82d6cd3c0d6ae99bbefb7cb0d7d42ecb76979c4fdd5aa4125d928e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.221.0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sun, 05 Dec 2021 01:50:31 GMT
content-type
text/html
content-length
672
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
showad.js
ads.pubmatic.com/AdServer/js/ Frame FD44 		38 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e2cdec10db9a0a224e9f5e49b6f004c5426564fb8d857ad3df480e9c916bafe6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

last-modified
Tue, 19 Oct 2021 10:00:01 GMT
etag
"1302647-96ae-5ceb1b98ba7c4"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
13882
content-type
text/html; charset=UTF-8
cache-control
public, max-age=62809
expires
Sun, 05 Dec 2021 19:17:20 GMT
date
Sun, 05 Dec 2021 01:50:31 GMT
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame 40DC 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40334-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Sun, 05 Dec 2021 01:50:31 GMT
Connection
keep-alive
Vary
Accept-Encoding
showad.js
ads.pubmatic.com/AdServer/js/ Frame 1A3B 		38 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-161-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e2cdec10db9a0a224e9f5e49b6f004c5426564fb8d857ad3df480e9c916bafe6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

last-modified
Tue, 19 Oct 2021 10:00:01 GMT
etag
"1302647-96ae-5ceb1b98ba7c4"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
13882
content-type
text/html; charset=UTF-8
cache-control
public, max-age=62809
expires
Sun, 05 Dec 2021 19:17:20 GMT
date
Sun, 05 Dec 2021 01:50:31 GMT
vary
Accept-Encoding
/
de.tynt.com/deb/ Frame A0A1
Redirect Chain
  • https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
  • https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
  • https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.33 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip33.67-202-105.static.steadfastdns.net
Software
/
Resource Hash
2adfa45e20ea5b1db632dd3cea892dac22e371708e8c2cef673e6d9dd462a971

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires
Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy
unsafe-url
content-type
text/html
content-length
1333
date
Sun, 05 Dec 2021 01:50:30 GMT
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Redirect headers

location
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires
Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy
unsafe-url
content-length
0
date
Sun, 05 Dec 2021 01:50:30 GMT
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
async_usersync.html
acdn.adnxs.com/dmp/ Frame 64BB 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

Connection
keep-alive
Content-Length
17053
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/html
Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
W/"5fc7ff8f-cf34"
Expires
Wed, 24 Nov 2021 05:35:57 GMT
Cache-Control
max-age=86402
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Accept-Ranges
bytes
Date
Sun, 05 Dec 2021 01:50:31 GMT
Age
74686
X-Served-By
cache-lga21956-LGA, cache-yul12829-YUL
X-Cache
HIT, HIT
X-Cache-Hits
4, 511027
X-Timer
S1638669031.172914,VS0,VE0
Vary
Accept-Encoding
sync
eb2.3lift.com/ Frame B7AA 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://eb2.3lift.com/sync?
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
712e541dd878bef4c1b8775dd20054ada7da73b11af40bafec8dad0c7241b683

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
content-type
text/html; charset=utf-8
content-length
464
content-encoding
gzip
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control
no-cache, no-store, must-revalidate
sync
x.bidswitch.net/
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=themediagrid
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=themediagrid
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=1452678799778604270&ssp=themediagrid
43 B
220 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/sync?dsp_id=70&user_id=1452678799778604270&ssp=themediagrid
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
18.157.70.90 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-157-70-90.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:31 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
nginx
location
https://x.bidswitch.net/sync?dsp_id=70&user_id=1452678799778604270&ssp=themediagrid
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
ad-engine-response.gif
trk.vidible.tv/trk/ Frame 29A9 		0
0
bc2
bc-ssb-cle.springserve.com/ Frame 182D 		6 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://bc-ssb-cle.springserve.com/bc2?r=20a84aff-dc47-4bda-a92f-5970487397ff-s.514171-d.528021-dc.132380&aid=962&det_d=www.bleepingcomputer.com&det_w=834
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.16.251.19 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-16-251-19.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
714d7c5f332e64c98e94a312e3c0f0957380efb646993bd66b77d0ffb9a53781

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:31 GMT
content-encoding
gzip
access-control-allow-credentials
true
server
nginx
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
usermatch
ssum-sec.casalemedia.com/ Frame CAB9 		1 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
fa8ed057f3d5158fa61380204083312f507221f670ee325e6c6f50ecad99918e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://js-sec.indexww.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
73|46|88|130|57|176|8|218
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1428
Expires
Sun, 05 Dec 2021 01:50:31 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Connection
keep-alive
sync
ups.analytics.yahoo.com/ups/58294/ Frame C05B
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID}
  • https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=dec387d0-fcc9-45f6-b6c6-b160082dcd1b
  • https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=dec387d0-fcc9-45f6-b6c6-b160082dcd1b&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
0
630 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=dec387d0-fcc9-45f6-b6c6-b160082dcd1b&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H2
Server
3.218.90.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-218-90-66.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=dec387d0-fcc9-45f6-b6c6-b160082dcd1b&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
date
Sun, 05 Dec 2021 01:50:31 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
396846.gif
idsync.rlcdn.com/ Frame C05B
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D
  • https://id.rlcdn.com/464246.gif?partner_uid=a5c17b3f-e9e4-49df-ba98-f099a61558aa
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
  • https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=a5c17b3f-e9e4-49df-ba98-f099a61558aa
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=a5c17b3f-e9e4-49df-ba98-f099a61558aa
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

date
Sun, 05 Dec 2021 01:50:31 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=a5c17b3f-e9e4-49df-ba98-f099a61558aa
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
sd
us-u.openx.net/w/1.0/ Frame C05B
Redirect Chain
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=7205020425431634120
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072399&val=7205020425431634120
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
32bd83f1-094e-4615-870b-7cf4aadf7fb0
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://us-u.openx.net/w/1.0/sd?id=537072399&val=7205020425431634120
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame C05B 		43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=a8d17824-3809-c445-25ef-f2fdf7bdf292
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
P0YZ08TQ4N7TR81ECK77
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame C05B
Redirect Chain
  • https://ad.turn.com/r/cs?pid=9&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=2848199581176410271&gdpr=0&gdpr_consent=&us_privacy=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073061&val=2848199581176410271&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537073061&val=2848199581176410271&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
sd
us-u.openx.net/w/1.0/ Frame C05B
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=Yawa4AAJpMVYSwBG
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Yawa4AAJpMVYSwBG
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 varnish
server
Varnish
x-timer
S1638669031.304345,VS0,VE0
x-served-by
cache-yul12826-YUL
x-cache
HIT
location
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Yawa4AAJpMVYSwBG
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
64c0621d-b40f-edf6-d436-669f60d9f43b
pr-bh.ybp.yahoo.com/sync/openx/ Frame C05B 		43 B
869 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/openx/64c0621d-b40f-edf6-d436-669f60d9f43b?gdpr=0
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a02:1f9d:78fd:b4f5:2185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
sd
us-u.openx.net/w/1.0/ Frame C05B
Redirect Chain
  • https://match.adsrvr.org/track/cmf/openx?oxid=f0070459-24a3-7fbf-e5e1-706a9f8e3972&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=0a060ae1-17dc-465b-b9b3-37e0e67725c6&ttd_puid=f0070459-24a3-7fbf-e5e1-706a9f8e3972
43 B
62 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072971&val=0a060ae1-17dc-465b-b9b3-37e0e67725c6&ttd_puid=f0070459-24a3-7fbf-e5e1-706a9f8e3972
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072971&val=0a060ae1-17dc-465b-b9b3-37e0e67725c6&ttd_puid=f0070459-24a3-7fbf-e5e1-706a9f8e3972
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
293
pixel
cm.g.doubleclick.net/ Frame C05B 		170 B
192 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZGM2OGQ3OTMtZWRkNC0yMTFiLWYwMDEtMmFkMzU1NmNmNzEy
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame C05B
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHeILPWdmbEHivdcTPUW7as&google_cver=1
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHeILPWdmbEHivdcTPUW7as&google_cver=1
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHeILPWdmbEHivdcTPUW7as&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
xuid
eb2.3lift.com/ Frame 6FA7
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=3658&xuid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&dongle=0cfd
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=3658&xuid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&dongle=0cfd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://eb2.3lift.com/xuid?mid=3658&xuid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&dongle=0cfd
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
209
xuid
eb2.3lift.com/ Frame 6FA7
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESENgfXL-mZhUIOp7yN7sb5Lo&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESENgfXL-mZhUIOp7yN7sb5Lo&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESENgfXL-mZhUIOp7yN7sb5Lo&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
332
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 6FA7
Redirect Chain
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTM0OTM0NjA0MTc3NjYyNzk4NDc%3D
170 B
192 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTM0OTM0NjA0MTc3NjYyNzk4NDc%3D
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTM0OTM0NjA0MTc3NjYyNzk4NDc%3D
date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
/
p.adsymptotic.com/d/px/ Frame 6FA7
Redirect Chain
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=13493460417766279847&dbredirect=true&gdpr=0&consent=
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=13493460417766279847&dbredirect=true&gdpr=0&consent=&cookiesTest=true
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=8528f9ba-61f2-49a6-8781-6631118dab13&_noobservation=1
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=8528f9ba-61f2-49a6-8781-6631118dab13&_noobservation=1&_expected_cookie=d074e30...
43 B
97 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=8528f9ba-61f2-49a6-8781-6631118dab13&_noobservation=1&_expected_cookie=d074e30a4ca1c37d1d2cc2837eff8fd0
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
104.18.99.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6b899fc809b6ca67-YUL
p3p
CP='NON DSP COR CONi OUR BUS CNT'
content-type
image/gif
content-length
43

Redirect headers

location
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=8528f9ba-61f2-49a6-8781-6631118dab13&_noobservation=1&_expected_cookie=d074e30a4ca1c37d1d2cc2837eff8fd0
date
Sun, 05 Dec 2021 01:50:31 GMT
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
6b899fc7992dca67-YUL
content-length
0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
xuid
eb2.3lift.com/ Frame 6FA7
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/13493460417766279847?gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-tjQ2Tn5E2oRk7KoQD1A14wtKzo1pqOie5W69k18Lag--~A&dongle=0883
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2662&xuid=y-tjQ2Tn5E2oRk7KoQD1A14wtKzo1pqOie5W69k18Lag--~A&dongle=0883
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date
Sun, 05 Dec 2021 01:50:31 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://eb2.3lift.com/xuid?mid=2662&xuid=y-tjQ2Tn5E2oRk7KoQD1A14wtKzo1pqOie5W69k18Lag--~A&dongle=0883
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
xuid
eb2.3lift.com/ Frame 6FA7
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=13493460417766279847&gdpr=0&gdpr_consent=
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=91fae357-6d96-49d0-85ee-50af585ffd28
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=91fae357-6d96-49d0-85ee-50af585ffd28
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=70a2554c-2118-4ebb-9f52-225af99a73ea&ssp=triplelift&expires=30&user_group=5&bsw_param=91fae357-6d96-49d0-85ee-50af585ffd28
  • https://eb2.3lift.com/xuid?mid=2409&xuid=91fae357-6d96-49d0-85ee-50af585ffd28&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2409&xuid=91fae357-6d96-49d0-85ee-50af585ffd28&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location
//eb2.3lift.com/xuid?mid=2409&xuid=91fae357-6d96-49d0-85ee-50af585ffd28&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Date
Sun, 05 Dec 2021 01:50:31 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
c.gif
c.bing.com/ Frame 6FA7 		42 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.bing.com/c.gif?xid=13493460417766279847&Red3=TLMS_pd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
etag
"c4ddde5e69d2d71:0"
last-modified
Fri, 05 Nov 2021 17:20:03 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F5B78B394D5F4D12AE954BA87204E9B3 Ref B: YMQ01EDGE0310 Ref C: 2021-12-05T01:50:31Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42
757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame 6FA7 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=0&gdpr_consent=&uid=13493460417766279847
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
xuid
eb2.3lift.com/ Frame 6FA7
Redirect Chain
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent=
  • https://stags.bluekai.com/site/23178?id=Fie7GdxwzfeqB4UoLqtl&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLE...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5IZUWKN2HMR4HO...
  • https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=Fie7GdxwzfeqB4UoLqtl
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=Fie7GdxwzfeqB4UoLqtl
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
P3p
CP="We do not support P3P header."
Location
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=Fie7GdxwzfeqB4UoLqtl
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
115
Expires
Thu, 01 Dec 1994 16:00:00 GMT
xuid
eb2.3lift.com/ Frame 6FA7
Redirect Chain
  • https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=4771&xuid=2848199581176410271&dongle=d407
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=4771&xuid=2848199581176410271&dongle=d407
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://eb2.3lift.com/xuid?mid=4771&xuid=2848199581176410271&dongle=d407
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
sync
ups.analytics.yahoo.com/ups/58294/ Frame F444
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID}
  • https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=dec387d0-fcc9-45f6-b6c6-b160082dcd1b
  • https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=dec387d0-fcc9-45f6-b6c6-b160082dcd1b&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=dec387d0-fcc9-45f6-b6c6-b160082dcd1b&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H2
Server
3.218.90.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-218-90-66.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=dec387d0-fcc9-45f6-b6c6-b160082dcd1b&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
date
Sun, 05 Dec 2021 01:50:31 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
362358.gif
idsync.rlcdn.com/ Frame F444
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D
  • https://id.rlcdn.com/464246.gif?partner_uid=a5c17b3f-e9e4-49df-ba98-f099a61558aa
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBJdLCeWp6pQsclVti242-s&google_cver=1
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBJdLCeWp6pQsclVti242-s&google_cver=1
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEBJdLCeWp6pQsclVti242-s&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
289
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame F444
Redirect Chain
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=7205020425431634120
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072399&val=7205020425431634120
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
f56708a4-6bdf-43c7-b54c-58892cd614a5
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://us-u.openx.net/w/1.0/sd?id=537072399&val=7205020425431634120
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame F444 		43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=a8d17824-3809-c445-25ef-f2fdf7bdf292
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
W9QR23WEMEV9JV0N6BJS
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame F444
Redirect Chain
  • https://ad.turn.com/r/cs?pid=9&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=2848199581176410271&gdpr=0&gdpr_consent=&us_privacy=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073061&val=2848199581176410271&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537073061&val=2848199581176410271&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
sd
us-u.openx.net/w/1.0/ Frame F444
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=Yawa4AAJpMVYSwBG
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Yawa4AAJpMVYSwBG
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 varnish
server
Varnish
x-timer
S1638669031.352064,VS0,VE0
x-served-by
cache-yul12826-YUL
x-cache
HIT
location
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Yawa4AAJpMVYSwBG
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
64c0621d-b40f-edf6-d436-669f60d9f43b
pr-bh.ybp.yahoo.com/sync/openx/ Frame F444 		43 B
869 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/openx/64c0621d-b40f-edf6-d436-669f60d9f43b?gdpr=0
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a02:1f9d:78fd:b4f5:2185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
sd
us-u.openx.net/w/1.0/ Frame F444
Redirect Chain
  • https://match.adsrvr.org/track/cmf/openx?oxid=f0070459-24a3-7fbf-e5e1-706a9f8e3972&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=0a060ae1-17dc-465b-b9b3-37e0e67725c6&ttd_puid=f0070459-24a3-7fbf-e5e1-706a9f8e3972
43 B
62 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072971&val=0a060ae1-17dc-465b-b9b3-37e0e67725c6&ttd_puid=f0070459-24a3-7fbf-e5e1-706a9f8e3972
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072971&val=0a060ae1-17dc-465b-b9b3-37e0e67725c6&ttd_puid=f0070459-24a3-7fbf-e5e1-706a9f8e3972
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
293
pixel
cm.g.doubleclick.net/ Frame F444 		170 B
192 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZGM2OGQ3OTMtZWRkNC0yMTFiLWYwMDEtMmFkMzU1NmNmNzEy
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame F444
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHeILPWdmbEHivdcTPUW7as&google_cver=1
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHeILPWdmbEHivdcTPUW7as&google_cver=1
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
server
OXGW/16.221.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHeILPWdmbEHivdcTPUW7as&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
xuid
eb2.3lift.com/ Frame B7AA
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=3658&xuid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&dongle=0cfd
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=3658&xuid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&dongle=0cfd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://eb2.3lift.com/xuid?mid=3658&xuid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&dongle=0cfd
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
209
xuid
eb2.3lift.com/ Frame B7AA
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESENgfXL-mZhUIOp7yN7sb5Lo&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESENgfXL-mZhUIOp7yN7sb5Lo&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESENgfXL-mZhUIOp7yN7sb5Lo&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
332
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame B7AA
Redirect Chain
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTM0OTM0NjA0MTc3NjYyNzk4NDc%3D
170 B
192 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTM0OTM0NjA0MTc3NjYyNzk4NDc%3D
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H3
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTM0OTM0NjA0MTc3NjYyNzk4NDc%3D
date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
/
p.adsymptotic.com/d/px/ Frame B7AA
Redirect Chain
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=13493460417766279847&dbredirect=true&gdpr=0&consent=
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=13493460417766279847&dbredirect=true&gdpr=0&consent=&cookiesTest=true
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=8528f9ba-61f2-49a6-8781-6631118dab13&_noobservation=1
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=8528f9ba-61f2-49a6-8781-6631118dab13&_noobservation=1&_expected_cookie=2405364...
43 B
142 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=8528f9ba-61f2-49a6-8781-6631118dab13&_noobservation=1&_expected_cookie=2405364280928fa2c2ec9703a3a38c05
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
104.18.99.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6b899fc7f9a3ca67-YUL
p3p
CP='NON DSP COR CONi OUR BUS CNT'
content-type
image/gif
content-length
43

Redirect headers

location
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=8528f9ba-61f2-49a6-8781-6631118dab13&_noobservation=1&_expected_cookie=2405364280928fa2c2ec9703a3a38c05
date
Sun, 05 Dec 2021 01:50:31 GMT
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
6b899fc79928ca67-YUL
content-length
0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
xuid
eb2.3lift.com/ Frame B7AA
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/13493460417766279847?gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-tjQ2Tn5E2oRk7KoQD1A14wtKzo1pqOie5W69k18Lag--~A&dongle=0883
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2662&xuid=y-tjQ2Tn5E2oRk7KoQD1A14wtKzo1pqOie5W69k18Lag--~A&dongle=0883
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date
Sun, 05 Dec 2021 01:50:31 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://eb2.3lift.com/xuid?mid=2662&xuid=y-tjQ2Tn5E2oRk7KoQD1A14wtKzo1pqOie5W69k18Lag--~A&dongle=0883
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
xuid
eb2.3lift.com/ Frame B7AA
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=13493460417766279847&gdpr=0&gdpr_consent=
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=triplelift
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=2810316550256815995&expires=30&ssp=triplelift
  • https://eb2.3lift.com/xuid?mid=2409&xuid=91fae357-6d96-49d0-85ee-50af585ffd28&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2409&xuid=91fae357-6d96-49d0-85ee-50af585ffd28&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location
//eb2.3lift.com/xuid?mid=2409&xuid=91fae357-6d96-49d0-85ee-50af585ffd28&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Date
Sun, 05 Dec 2021 01:50:31 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
c.gif
c.bing.com/ Frame B7AA 		42 B
666 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.bing.com/c.gif?xid=13493460417766279847&Red3=TLMS_pd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
etag
"c4ddde5e69d2d71:0"
last-modified
Fri, 05 Nov 2021 17:20:03 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 33DE4C5904A1454B8682A8F872CBD038 Ref B: YMQ01EDGE0310 Ref C: 2021-12-05T01:50:31Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42
757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame B7AA 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=0&gdpr_consent=&uid=13493460417766279847
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
xuid
eb2.3lift.com/ Frame B7AA
Redirect Chain
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent=
  • https://stags.bluekai.com/site/23178?id=MOcTeHahRHcu11lsoSet&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLE...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5JVHWGVDFJBQWQ...
  • https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=MOcTeHahRHcu11lsoSet
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=MOcTeHahRHcu11lsoSet
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
P3p
CP="We do not support P3P header."
Location
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=MOcTeHahRHcu11lsoSet
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
115
Expires
Thu, 01 Dec 1994 16:00:00 GMT
xuid
eb2.3lift.com/ Frame B7AA
Redirect Chain
  • https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=4771&xuid=2848199581176410271&dongle=d407
37 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=4771&xuid=2848199581176410271&dongle=d407
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://eb2.3lift.com/xuid?mid=4771&xuid=2848199581176410271&dongle=d407
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
idsync.d5cb6b96.js
cdn.districtm.io/ids/ Frame C436 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by
Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/ids/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 fba70d1e4c74a3621a7d03b3d021b4dc.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
82744
cf-polished
origSize=3302
x-cache
Miss from cloudfront
cf-bgj
minify
content-encoding
br
last-modified
Thu, 20 May 2021 02:18:27 GMT
server
cloudflare
etag
W/"74ede07ef946dc2316f86b2661cf2dd3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=172800
x-amz-cf-pop
EWR52-C4
cf-ray
6b899fc5bf3fca4f-YUL
x-amz-cf-id
grPGiWniH68bfTtn_MAV7TZgFVtqyKFXbidN-Zh6RPPqvpzkLyNSHw==
expires
Tue, 07 Dec 2021 01:50:31 GMT
idsync.d5cb6b96.js
cdn.districtm.io/ids/ Frame 3D54 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by
Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/ids/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 fba70d1e4c74a3621a7d03b3d021b4dc.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
82744
cf-polished
origSize=3302
x-cache
Miss from cloudfront
cf-bgj
minify
content-encoding
br
last-modified
Thu, 20 May 2021 02:18:27 GMT
server
cloudflare
etag
W/"74ede07ef946dc2316f86b2661cf2dd3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=172800
x-amz-cf-pop
EWR52-C4
cf-ray
6b899fc5bf40ca4f-YUL
x-amz-cf-id
grPGiWniH68bfTtn_MAV7TZgFVtqyKFXbidN-Zh6RPPqvpzkLyNSHw==
expires
Tue, 07 Dec 2021 01:50:31 GMT
usync.js
eus.rubiconproject.com/ Frame 40DC 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
952ff494a4f911577bd010f4a1e393e93cb090ce1976f464442cc8aa1ac6b12b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:31 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=17360
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9514
Expires
Sun, 05 Dec 2021 06:39:51 GMT
usermatch
ssum-sec.casalemedia.com/ Frame CFC4 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0bdba55f50b3eb06309082e875d6987a4a89f4776b9746f131a592b90e125d7a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://js-sec.indexww.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
3|4|65|90|230|81|131|176
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1658
Expires
Sun, 05 Dec 2021 01:50:31 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Connection
keep-alive
Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame CAB9 		43 B
869 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB?gdpr_consent=&us_privacy=&gdpr=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a02:1f9d:78fd:b4f5:2185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
crum
dsum-sec.casalemedia.com/ Frame CAB9
Redirect Chain
  • https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=7205020425431634120
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=7205020425431634120
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 569.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
93e54bd4-1247-4990-96b6-3260b2b92fbc
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=7205020425431634120
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame CAB9
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Yawa4AAJpMVYSwBG
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Yawa4AAJpMVYSwBG
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 varnish
server
Varnish
x-timer
S1638669031.377514,VS0,VE0
x-served-by
cache-yul12826-YUL
x-cache
HIT
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Yawa4AAJpMVYSwBG
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
ie
match.prod.bidr.io/cookie-sync/ Frame CAB9 		43 B
430 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.prod.bidr.io/cookie-sync/ie
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.166.81.178 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-166-81-178.compute-1.amazonaws.com
Software
nginx /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control
no-cache, must-revalidate
Connection
keep-alive
content-type
image/gif
Content-Length
43
expires
Fri, 01 Jan 1990 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame CAB9
Redirect Chain
  • https://p.rfihub.com/cm?in=1&pub=2079
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=1783777309855063265
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=1783777309855063265
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=1783777309855063265
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
crum
dsum.casalemedia.com/ Frame CAB9
Redirect Chain
  • https://match.deepintent.com/usersync/113
  • https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_fe5a87ec034349adb9d1d
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_fe5a87ec034349adb9d1d
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

location
https://dsum.casalemedia.com/crum?cm_dsp_id=176&external_user_id=di_fe5a87ec034349adb9d1d
date
Sun, 05 Dec 2021 01:50:30 GMT
server
b
content-type
image/gif
content-length
0
p3p
policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
crum
dsum-sec.casalemedia.com/ Frame CAB9
Redirect Chain
  • https://beacon.lynx.cognitivlabs.com/ix.gif
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=51be4f23-aef6-49ff-aea7-33d2bf749ef8&expiration=1670205031
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=51be4f23-aef6-49ff-aea7-33d2bf749ef8&expiration=1670205031
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=51be4f23-aef6-49ff-aea7-33d2bf749ef8&expiration=1670205031
date
Sun, 05 Dec 2021 01:50:31 GMT
server
Kestrel
content-length
0
demconf.jpg
dpm.demdex.net/ Frame CAB9
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=23728&dpuuid=Yawa4gBzq4Mi9uUbPgLGCwAA%26020?gdpr_consent=&us_privacy=&gdpr=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Yawa4gBzq4Mi9uUbPgLGCwAA%26020
42 B
943 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Yawa4gBzq4Mi9uUbPgLGCwAA%26020
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
54.149.241.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-149-241-156.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

DCS
dcs-prod-usw2-1-v017-0714c1492.edge-usw2.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
qa3aNM4pTc8=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-usw2-1-v017-067c1d99a.edge-usw2.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
SX22HPViQIk=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Yawa4gBzq4Mi9uUbPgLGCwAA%26020
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
htw-pixel.gif
js-sec.indexww.com/ht/ Frame CAB9 		43 B
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://js-sec.indexww.com/ht/htw-pixel.gif?Yawa4gBzq4Mi9uUbPgLGCwAA%26020
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:31 GMT
Last-Modified
Tue, 24 Jan 2017 19:36:04 GMT
Server
Apache
ETag
"902a3d-2b-546dc3a097100"
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=2182
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 02:26:53 GMT
async_usersync
ib.adnxs.com/ Frame A83D 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
0e82531c-1233-4a6e-b475-18fca070a7b3
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 64BB 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
04f71c1b-e25c-42f8-af62-e181fdfb228c
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
pubcid.php
hbx.media.net/ Frame 67FE 		57 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hbx.media.net/pubcid.php?itype=HB&cb=window.advBidxc.mnetCoRtusId
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7b48a74fa0f94d83ae6d60c772f5e7aa66e7be1b63ccf223ca14e34d3d7b0d22
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
max-age=1800
content-length
18543
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 02:20:31 GMT
sync
gum.criteo.com/ Frame 67FE 		61 B
372 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=&j=window.advBidxc.mnetRtusId
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
f77f47058428a1c21dad5a75ac13fbfdeb9858947218fee2112fded5972a0b5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
date
Sun, 05 Dec 2021 01:50:31 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
1581
content-length
175
expires
60
cksync.html
contextual.media.net/ Frame 6A6B
Redirect Chain
  • https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Drkt%26refUrl%3D%26vid%3D866903141428167063173972840...
  • https://contextual.media.net/cksync.html?cs=8&vsid=2816706317397284000V10&type=rkt&refUrl=&vid=86690314142816706317397284000V10&ovsid=970314627676561193
219 B
648 B 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/cksync.html?cs=8&vsid=2816706317397284000V10&type=rkt&refUrl=&vid=86690314142816706317397284000V10&ovsid=970314627676561193
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
85af3052d288ffd9157258dfe4daf5309f0b64d0067ab8221cd0c62909c18419
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/

Response headers

server
Apache
content-length
219
content-type
text/html;charset=UTF-8
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
max-age=0, no-cache, no-store
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Date
Sun, 05 Dec 2021 01:50:31 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://contextual.media.net/cksync.html?cs=8&vsid=2816706317397284000V10&type=rkt&refUrl=&vid=86690314142816706317397284000V10&ovsid=970314627676561193
Content-Length
0
Server
Jetty(9.3.29.v20201019)
cksync.php
contextual.media.net/ Frame 67FE
Redirect Chain
  • https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dcon%26refUrl...
  • https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=60d94f392c98122e&is_secure=true&version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=con&refUrl=&vid=86690314142816706317397284000V10&ovsid=AAAGdipzeeBVhAMrebIgAAAAAAA&expiration=1638755431&is_secure=true
45 B
458 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=con&refUrl=&vid=86690314142816706317397284000V10&ovsid=AAAGdipzeeBVhAMrebIgAAAAAAA&expiration=1638755431&is_secure=true
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=con&refUrl=&vid=86690314142816706317397284000V10&ovsid=AAAGdipzeeBVhAMrebIgAAAAAAA&expiration=1638755431&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
cksync.php
contextual.media.net/ Frame 67FE
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dmma%26refUrl%3D%26vid%3D866903141428167063173972...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=mma&refUrl=&vid=86690314142816706317397284000V10&ovsid=17d961ac-1ae0-4000-b6db-9706d9b036cb
45 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=mma&refUrl=&vid=86690314142816706317397284000V10&ovsid=17d961ac-1ae0-4000-b6db-9706d9b036cb
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
MT3 4133 baa842e master iad-pixel-x1 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=mma&refUrl=&vid=86690314142816706317397284000V10&ovsid=17d961ac-1ae0-4000-b6db-9706d9b036cb
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:50:30 GMT
cksync
cs.media.net/ Frame 67FE
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MjgxNjcwNjMxNzM5NzI4NDAwMFYxMA%3D%3D&google_sc=1
  • https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEClov87a3B7yE4YtjXppqj8&google_cver=1
45 B
445 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEClov87a3B7yE4YtjXppqj8&google_cver=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEClov87a3B7yE4YtjXppqj8&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cksync.php
contextual.media.net/ Frame 67FE
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Ddxu%26refUrl%3D%26vid%3D86690314142816706317397...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=dxu&refUrl=&vid=86690314142816706317397284000V10&ovsid=DyLVqr8t1MTGFy5
45 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=dxu&refUrl=&vid=86690314142816706317397284000V10&ovsid=DyLVqr8t1MTGFy5
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:30 GMT
Server
PingMatch/v2.0.30-691-gbabbd08#rel-ec2-master i-04c39fa72970bc4e6@us-east-1d@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=dxu&refUrl=&vid=86690314142816706317397284000V10&ovsid=DyLVqr8t1MTGFy5
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
cksync.php
contextual.media.net/ Frame 67FE
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
  • https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=74618072-e52e-4fe0-a124-a6ec1943183f
45 B
613 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=74618072-e52e-4fe0-a124-a6ec1943183f
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
Kestrel
x-errorlevel
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=74618072-e52e-4fe0-a124-a6ec1943183f
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
4351349
content-length
0
expires
Sun, 05 Dec 2021 00:00:00 GMT
cksync.php
contextual.media.net/ Frame 67FE
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dmedianet%26bsw_param...
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=1de77307d007487fbf82d47b61a3cc6d&ssp=medianet&bsw_param=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=0&consent=&gdpr_pd=1&expires=7
  • https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=0&gdpr_consent=&gdpr_pd=1
45 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=0&gdpr_consent=&gdpr_pd=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Location
//contextual.media.net/cksync.php?cs=1&type=bs&ovsid=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=0&gdpr_consent=&gdpr_pd=1
Date
Sun, 05 Dec 2021 01:50:31 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
cksync.php
contextual.media.net/ Frame 67FE
Redirect Chain
  • https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dzem%26refUrl%3D%26vid%3D86690314142816706317397284...
  • https://stags.bluekai.com/site/23178?id=p3can97Ty9ZsKgjlEt5c&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPLQGNRWC3RZG5KHSOK2ONFWO2TMIV2DK...
  • https://contextual.media.net/cksync.php?cs=8&ovsid=p3can97Ty9ZsKgjlEt5c&refUrl=&type=zem&vid=86690314142816706317397284000V10&vsid=2816706317397284000V10
45 B
452 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&ovsid=p3can97Ty9ZsKgjlEt5c&refUrl=&type=zem&vid=86690314142816706317397284000V10&vsid=2816706317397284000V10
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
P3p
CP="We do not support P3P header."
Location
https://contextual.media.net/cksync.php?cs=8&ovsid=p3can97Ty9ZsKgjlEt5c&refUrl=&type=zem&vid=86690314142816706317397284000V10&vsid=2816706317397284000V10
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
196
Expires
Thu, 01 Dec 1994 16:00:00 GMT
cksync.php
contextual.media.net/ Frame 67FE
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=2816706317397284000V10
  • https://contextual.media.net/cksync.php?type=mf&ovsid=2c55b0ff-e26e-43d5-94da-2bb3ffc74b65&cs=1
45 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?type=mf&ovsid=2c55b0ff-e26e-43d5-94da-2bb3ffc74b65&cs=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

location
//contextual.media.net/cksync.php?type=mf&ovsid=2c55b0ff-e26e-43d5-94da-2bb3ffc74b65&cs=1
date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
alt-svc
clear
content-length
0
via
1.1 google
710489.gif
id.rlcdn.com/ Frame 67FE 		42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/710489.gif
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
cksync
cs.media.net/ Frame 67FE
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1
  • https://cs.media.net/cksync?cs=1&type=ttd&ovsid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
45 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
199
cksync.php
contextual.media.net/ Frame 67FE
Redirect Chain
  • https://ad.turn.com/r/cs?pid=59&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Damb%26refUrl%3D%26vid%3D86690314142816706317397284000V10%26ov...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=amb&refUrl=&vid=86690314142816706317397284000V10&ovsid=2848199581176410271
45 B
451 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=amb&refUrl=&vid=86690314142816706317397284000V10&ovsid=2848199581176410271
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

location
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=amb&refUrl=&vid=86690314142816706317397284000V10&ovsid=2848199581176410271
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
pubcid.php
hbx.media.net/ Frame 8DA1 		57 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hbx.media.net/pubcid.php?itype=HB&cb=window.advBidxc.mnetCoRtusId
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7b48a74fa0f94d83ae6d60c772f5e7aa66e7be1b63ccf223ca14e34d3d7b0d22
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
max-age=1800
content-length
18543
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 02:20:31 GMT
sync
gum.criteo.com/ Frame 8DA1 		61 B
372 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=&j=window.advBidxc.mnetRtusId
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
f77f47058428a1c21dad5a75ac13fbfdeb9858947218fee2112fded5972a0b5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
date
Sun, 05 Dec 2021 01:50:31 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
1497
content-length
175
expires
60
cksync
cs.media.net/ Frame 8DA1
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MjgxNjcwNjMxNzM5NzI4NDAwMFYxMA%3D%3D&google_sc=1
  • https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEClov87a3B7yE4YtjXppqj8&google_cver=1
45 B
445 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEClov87a3B7yE4YtjXppqj8&google_cver=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEClov87a3B7yE4YtjXppqj8&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cksync.html
contextual.media.net/ Frame 8DD5
Redirect Chain
  • https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Drkt%26refUrl%3D%26vid%3D866903144128167063173972840...
  • https://contextual.media.net/cksync.html?cs=8&vsid=2816706317397284000V10&type=rkt&refUrl=&vid=86690314412816706317397284000V10&ovsid=2810316550256815995
219 B
649 B 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/cksync.html?cs=8&vsid=2816706317397284000V10&type=rkt&refUrl=&vid=86690314412816706317397284000V10&ovsid=2810316550256815995
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
85af3052d288ffd9157258dfe4daf5309f0b64d0067ab8221cd0c62909c18419
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/

Response headers

server
Apache
content-length
219
content-type
text/html;charset=UTF-8
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
max-age=0, no-cache, no-store
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Date
Sun, 05 Dec 2021 01:50:31 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://contextual.media.net/cksync.html?cs=8&vsid=2816706317397284000V10&type=rkt&refUrl=&vid=86690314412816706317397284000V10&ovsid=2810316550256815995
Content-Length
0
Server
Jetty(9.3.29.v20201019)
cksync.php
contextual.media.net/ Frame 8DA1
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
  • https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=36f7a3cb-90f4-4a98-9dde-87e0b14996bf
45 B
614 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=36f7a3cb-90f4-4a98-9dde-87e0b14996bf
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
server
Kestrel
x-errorlevel
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=36f7a3cb-90f4-4a98-9dde-87e0b14996bf
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
2025959
content-length
0
expires
Sun, 05 Dec 2021 00:00:00 GMT
cksync.php
contextual.media.net/ Frame 8DA1
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
  • https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dmedianet
  • https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dmedianet
  • https://x.bidswitch.net/sync?dsp_id=59&user_id=4a315f5b-792e-42e5-94f2-3f23d680431b&ssp=medianet
  • https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=&gdpr_consent=&gdpr_pd=
45 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Location
//contextual.media.net/cksync.php?cs=1&type=bs&ovsid=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=&gdpr_consent=&gdpr_pd=
Date
Sun, 05 Dec 2021 01:50:31 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
cksync.php
contextual.media.net/ Frame 8DA1
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=2816706317397284000V10
  • https://contextual.media.net/cksync.php?type=mf&ovsid=2c55b0ff-e26e-43d5-94da-2bb3ffc74b65&cs=1
45 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?type=mf&ovsid=2c55b0ff-e26e-43d5-94da-2bb3ffc74b65&cs=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

location
//contextual.media.net/cksync.php?type=mf&ovsid=2c55b0ff-e26e-43d5-94da-2bb3ffc74b65&cs=1
date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate
alt-svc
clear
content-length
0
via
1.1 google
710489.gif
id.rlcdn.com/ Frame 8DA1 		42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/710489.gif
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
cksync
cs.media.net/ Frame 8DA1
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1
  • https://cs.media.net/cksync?cs=1&type=ttd&ovsid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
45 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=0a060ae1-17dc-465b-b9b3-37e0e67725c6
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
199
cksync.php
contextual.media.net/ Frame 8DA1
Redirect Chain
  • https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dcon%26refUrl...
  • https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=5b6ed1ad7c56122e&is_secure=true&version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=con&refUrl=&vid=86690314412816706317397284000V10&ovsid=AAAGdXSNZEPasQMAgdc2AAAAAAA&expiration=1638755431&is_secure=true
45 B
458 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=con&refUrl=&vid=86690314412816706317397284000V10&ovsid=AAAGdXSNZEPasQMAgdc2AAAAAAA&expiration=1638755431&is_secure=true
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=con&refUrl=&vid=86690314412816706317397284000V10&ovsid=AAAGdXSNZEPasQMAgdc2AAAAAAA&expiration=1638755431&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
cksync.php
contextual.media.net/ Frame 8DA1
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dmma%26refUrl%3D%26vid%3D866903144128167063173972...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=mma&refUrl=&vid=86690314412816706317397284000V10&ovsid=17d961ac-1ae0-4000-b6db-9706d9b036cb
45 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=mma&refUrl=&vid=86690314412816706317397284000V10&ovsid=17d961ac-1ae0-4000-b6db-9706d9b036cb
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
MT3 4133 baa842e master iad-pixel-x20 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=mma&refUrl=&vid=86690314412816706317397284000V10&ovsid=17d961ac-1ae0-4000-b6db-9706d9b036cb
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:50:30 GMT
cksync.php
contextual.media.net/ Frame 8DA1
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Ddxu%26refUrl%3D%26vid%3D86690314412816706317397...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=dxu&refUrl=&vid=86690314412816706317397284000V10&ovsid=DyLVqr8t1MTGFy5
45 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=dxu&refUrl=&vid=86690314412816706317397284000V10&ovsid=DyLVqr8t1MTGFy5
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:30 GMT
Server
PingMatch/v2.0.30-691-gbabbd08#rel-ec2-master i-09b28297f33b5541d@us-east-1e@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
P3P
policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=dxu&refUrl=&vid=86690314412816706317397284000V10&ovsid=DyLVqr8t1MTGFy5
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
cksync.php
contextual.media.net/ Frame 8DA1
Redirect Chain
  • https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Dzem%26refUrl%3D%26vid%3D86690314412816706317397284...
  • https://stags.bluekai.com/site/23178?id=MOcTeHahRHcu11lsoSet&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPKNJ5RVIZKIMFUFESDDOUYTC3DTN5JWK...
  • https://contextual.media.net/cksync.php?cs=8&ovsid=MOcTeHahRHcu11lsoSet&refUrl=&type=zem&vid=86690314412816706317397284000V10&vsid=2816706317397284000V10
45 B
452 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&ovsid=MOcTeHahRHcu11lsoSet&refUrl=&type=zem&vid=86690314412816706317397284000V10&vsid=2816706317397284000V10
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
P3p
CP="We do not support P3P header."
Location
https://contextual.media.net/cksync.php?cs=8&ovsid=MOcTeHahRHcu11lsoSet&refUrl=&type=zem&vid=86690314412816706317397284000V10&vsid=2816706317397284000V10
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
196
Expires
Thu, 01 Dec 1994 16:00:00 GMT
cksync.php
contextual.media.net/ Frame 8DA1
Redirect Chain
  • https://ad.turn.com/r/cs?pid=59&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D2816706317397284000V10%26type%3Damb%26refUrl%3D%26vid%3D86690314412816706317397284000V10%26ov...
  • https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=amb&refUrl=&vid=86690314412816706317397284000V10&ovsid=2848199581176410271
45 B
451 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=amb&refUrl=&vid=86690314412816706317397284000V10&ovsid=2848199581176410271
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Sun, 05 Dec 2021 01:50:31 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

location
https://contextual.media.net/cksync.php?cs=8&vsid=2816706317397284000V10&type=amb&refUrl=&vid=86690314412816706317397284000V10&ovsid=2848199581176410271
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
buyers
dmx.districtm.io/s/v1/ Frame C436 		427 B
681 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/v1/buyers
Requested by
Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ee1aefa691ed27b92a4d2ba2612931d156456f77afcd8f3d389efeeb08ab4199
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
DELETE, GET, OPTIONS, POST
content-type
application/json
access-control-allow-origin
https://cdn.districtm.io
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6b899fc6b801ca4f-YUL
access-control-allow-headers
Origin, Content-Type
buyers
dmx.districtm.io/s/v1/ Frame 3D54 		588 B
709 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/v1/buyers
Requested by
Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
baf857ec7b510958a50bfef8a3ec9cdf45d1909c7b1df9da7252d27b1da14791
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
DELETE, GET, OPTIONS, POST
content-type
application/json
access-control-allow-origin
https://cdn.districtm.io
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6b899fc6b806ca4f-YUL
access-control-allow-headers
Origin, Content-Type
crum
dsum-sec.casalemedia.com/ Frame CFC4
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=17d961ac-1ae0-4000-b6db-9706d9b036cb
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=17d961ac-1ae0-4000-b6db-9706d9b036cb
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
MT3 4133 baa842e master iad-pixel-x23 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=17d961ac-1ae0-4000-b6db-9706d9b036cb
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:50:30 GMT
rum
dsum-sec.casalemedia.com/ Frame CFC4
Redirect Chain
  • https://ad.turn.com/r/cs?pid=21
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=2848199581176410271
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=2848199581176410271
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=2848199581176410271
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
rum
dsum.casalemedia.com/ Frame CFC4
Redirect Chain
  • https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1
  • https://casale-match.dotomi.com/match/bounce/current?DotomiTest=5ca215a44390122e&is_secure=true&networkId=19998&version=1
  • https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGdc-Aay49lQMcVRAGAAAAAAA&expiration=1638755431&is_secure=true
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGdc-Aay49lQMcVRAGAAAAAAA&expiration=1638755431&is_secure=true
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGdc-Aay49lQMcVRAGAAAAAAA&expiration=1638755431&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
crum
dsum-sec.casalemedia.com/ Frame CFC4
Redirect Chain
  • https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=C65D11E4B81E46FF927733811942FFDC
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=C65D11E4B81E46FF927733811942FFDC
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

date
Sun, 05 Dec 2021 01:50:31 GMT
x-content-type-options
nosniff
server
nginx
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=C65D11E4B81E46FF927733811942FFDC
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
138
expires
Sat, 04 Dec 2021 01:50:31 GMT
usermatchredir
ssum-sec.casalemedia.com/ Frame CFC4
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&gdpr_consent=&us_privacy=&gdpr=
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
342
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame CFC4
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=1_cKONCnDmrM9Fxj1fdGYtWjXmzMpw5v2KUf2M71
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=1_cKONCnDmrM9Fxj1fdGYtWjXmzMpw5v2KUf2M71
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=1_cKONCnDmrM9Fxj1fdGYtWjXmzMpw5v2KUf2M71
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame CFC4
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casa...
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662301221777215
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662301221777215
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 01:50:31 GMT

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
cf-cache-status
DYNAMIC
x-function
209
server
cloudflare
x-reuse-index
9316
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6b899fc738534bd0-YUL
p3p
CP="NOI DEVo TAIa OUR BUS"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662301221777215
cache-control
no-cache, private
content-type
text/html
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires
Thu, 01 Jan 1970 00:00:00 GMT
sync
ups.analytics.yahoo.com/ups/55859/ Frame CFC4
Redirect Chain
  • https://match.deepintent.com/usersync/113
  • https://x.bidswitch.net/sync?expires=720&dsp_id=422&user_id=di_fe5a87ec034349adb9d1d
  • https://pixel.advertising.com/ups/55859/sync?uid=91fae357-6d96-49d0-85ee-50af585ffd28&_origin=1&gdpr=&gdpr_consent=
  • https://ups.analytics.yahoo.com/ups/55859/sync?uid=91fae357-6d96-49d0-85ee-50af585ffd28&_origin=1&gdpr=&gdpr_consent=&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
0
185 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55859/sync?uid=91fae357-6d96-49d0-85ee-50af585ffd28&_origin=1&gdpr=&gdpr_consent=&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Server
3.218.90.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-218-90-66.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
server
ATS/9.1.0.33
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/55859/sync?uid=91fae357-6d96-49d0-85ee-50af585ffd28&_origin=1&gdpr=&gdpr_consent=&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
date
Sun, 05 Dec 2021 01:50:31 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
htw-pixel.gif
js-sec.indexww.com/ht/ Frame CFC4 		43 B
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://js-sec.indexww.com/ht/htw-pixel.gif?Yawa4gBzq4Mi9uUbPgLGCwAA%26020
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https://www.bleepingcomputer.com/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.52.162.21 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-162-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:31 GMT
Last-Modified
Tue, 24 Jan 2017 19:36:04 GMT
Server
Apache
ETag
"902a3d-2b-546dc3a097100"
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=2182
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
43
Expires
Sun, 05 Dec 2021 02:26:53 GMT
usync.html
eus.rubiconproject.com/ Frame 7428
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
  • https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
about:blank

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40334-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Sun, 05 Dec 2021 01:50:31 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Server
AkamaiGHost
Content-Length
0
Location
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Date
Sun, 05 Dec 2021 01:50:31 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
match
cms-xch-chicago.33across.com/ Frame A0A1
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dthe33across%26bsw_pa...
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=1de77307d007487fbf82d47b61a3cc6d&ssp=the33across&bsw_param=91fae357-6d96-49d0-85ee-50af585ffd28&gdpr=&consent=&gdpr_pd=&expires=7
  • https://ssc-cms.33across.com/ps/?gdpr_consent=&ri=10&ru=https%3A%2F%2Fcms-xch.33across.com%2Fmatch%3Fgdpr_58%3D%24gdpr_58%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26bidder_id%3...
  • https://cms-xch.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=91fae357-6d96-49d0-85ee-50af585ffd28
  • https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=91fae357-6d96-49d0-85ee-50af585ffd28
68 B
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=91fae357-6d96-49d0-85ee-50af585ffd28
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:32 GMT
via
1.1 google, 1.1 google
server
nginx/1.20.1
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
clear
content-length
68
content-type
image/png

Redirect headers

location
https://cms-xch-chicago.33across.com:443/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=91fae357-6d96-49d0-85ee-50af585ffd28
date
Sun, 05 Dec 2021 01:50:31 GMT
server
awselb/2.0
content-length
134
content-type
text/html
match
cms-xch-chicago.33across.com/ Frame A0A1
Redirect Chain
  • https://ssc-cms.33across.com/ps/?us_privacy=&ts=1638669031325.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fc...
  • https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D
  • https://cms-xch-chicago.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=17d961ac-1ae0-4000-b6db-9706d9b036cb
68 B
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=17d961ac-1ae0-4000-b6db-9706d9b036cb
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google, 1.1 google
server
nginx/1.20.1
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
clear
content-length
68
content-type
image/png

Redirect headers

Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
MT3 4133 baa842e master iad-pixel-x28 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://cms-xch-chicago.33across.com/match?liv=g&us_privacy=&bidder_id=1&external_user_id=17d961ac-1ae0-4000-b6db-9706d9b036cb
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Sun, 05 Dec 2021 01:50:30 GMT
match
cms-xch-chicago.33across.com/ Frame A0A1
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
  • https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-7h9tRulE2uFxsB6QY0gDLbcPV3aP5mnm~A
  • https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-7h9tRulE2uFxsB6QY0gDLbcPV3aP5mnm%7EA&ts=1638669031&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
68 B
213 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-7h9tRulE2uFxsB6QY0gDLbcPV3aP5mnm%7EA&ts=1638669031&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google, 1.1 google
server
nginx/1.20.1
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
clear
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:30 GMT
referrer-policy
unsafe-url
server
33XP005
x-33x-status
8000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-7h9tRulE2uFxsB6QY0gDLbcPV3aP5mnm%7EA&ts=1638669031&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
match
cms-xch-chicago.33across.com/ Frame A0A1
Redirect Chain
  • https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
  • https://33across-match.dotomi.com/match/bounce/current?DotomiTest=28a291b4097e122f&is_secure=true&networkId=78390&version=1&us_privacy=
  • https://ssc-cms.33across.com/ps?xi=64&xu=AAAGdRmaSRjZhgMS-K6GAAAAAAA&expiration=1638755431&is_secure=true&us_privacy=
  • https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGdRmaSRjZhgMS-K6GAAAAAAA&ts=1638669031&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
68 B
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGdRmaSRjZhgMS-K6GAAAAAAA&ts=1638669031&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google, 1.1 google
server
nginx/1.20.1
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
clear
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
referrer-policy
unsafe-url
server
33XP001
x-33x-status
8000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGdRmaSRjZhgMS-K6GAAAAAAA&ts=1638669031&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
match
cms-xch-chicago.33across.com/ Frame A0A1
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy=
  • https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1641261031%26external_user_id%3D0a060ae1-17dc-465b-b9b3-37e0e67725c6
  • https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1641261031&external_user_id=0a060ae1-17dc-465b-b9b3-37e0e67725c6
68 B
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1641261031&external_user_id=0a060ae1-17dc-465b-b9b3-37e0e67725c6
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google, 1.1 google
server
nginx/1.20.1
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
clear
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
referrer-policy
unsafe-url
server
33XP001
x-33x-status
40000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1641261031&external_user_id=0a060ae1-17dc-465b-b9b3-37e0e67725c6
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
log
c21lg-d.media.net/ Frame 67FE 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c21lg-d.media.net/log?logid=kfk&evtid=cs&origin=1&pvgid=data-con&ovsid=eb9ee303-3098-4ead-a714-9125f3b49df5&cs=15&vsid=2816706317397284000V10
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Jetty(9.4.35.v20201120) /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
Jetty(9.4.35.v20201120)
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Sun, 05 Dec 2021 01:50:31 GMT
log
c21lg-d.media.net/ Frame 8DA1 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c21lg-d.media.net/log?logid=kfk&evtid=cs&origin=1&pvgid=data-con&ovsid=eb9ee303-3098-4ead-a714-9125f3b49df5&cs=15&vsid=2816706317397284000V10
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C251%2C175%2C178%2C157%2C3017%2C2027%2C3016%2C214%2C2026%2C159%2C238%2C117%2C97%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C3007%2C201%2C4%2C246%2C203%2C126%2C226%2C80%2C10000%2C9%2C229%2C108%2C82%2C109&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1&itype=PREBID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.167.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-167-93.deploy.static.akamaitechnologies.com
Software
Jetty(9.4.35.v20201120) /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
Jetty(9.4.35.v20201120)
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Sun, 05 Dec 2021 01:50:31 GMT
2810316550256815995
dmx.districtm.io/s/10056/ Frame C436
Redirect Chain
  • https://p.rfihub.com/cm?pub=36496&in=1
  • https://dmx.districtm.io/s/10056/2810316550256815995
75 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10056/2810316550256815995
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
187eb2b62d3893ba4ae9736a65cbe16b85a20d966e0d734199e8f5da1484ba21
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:50:31 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b899fc798e4ca4f-YUL

Redirect headers

Location
https://dmx.districtm.io/s/10056/2810316550256815995
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
AADRPU7DWDYAAC1tRSs1sA
dmx.districtm.io/s/10025/ Frame C436
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/districtm
  • https://dmx.districtm.io/s/10025/AADRPU7DWDYAAC1tRSs1sA
78 B
175 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10025/AADRPU7DWDYAAC1tRSs1sA
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ecc7cc576c45b7d75e632b408e7e3eb63ec6c9bdeed91e9b4e4afc539b667d2e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:50:31 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b899fc7d917ca4f-YUL

Redirect headers

location
https://dmx.districtm.io/s/10025/AADRPU7DWDYAAC1tRSs1sA
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
strict-transport-security
max-age=2592000; includeSubDomains
y-v6iA94FE2uGgLH5Mv50OdzL4RqBs33ts~A~UPb6b4c899-556d-11ec-9f09-0e98ce530e37
dmx.districtm.io/s/10051/ Frame C436
Redirect Chain
  • https://pixel.advertising.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPb6b4c899-556d-11ec-9f09-0e98ce530e37
  • https://dmx.districtm.io/s/10051/y-v6iA94FE2uGgLH5Mv50OdzL4RqBs33ts~A~UPb6b4c899-556d-11ec-9f09-0e98ce530e37
131 B
185 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10051/y-v6iA94FE2uGgLH5Mv50OdzL4RqBs33ts~A~UPb6b4c899-556d-11ec-9f09-0e98ce530e37
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ce34eb03cbabe0fa191964e0837ad386097f8207f6f82a19bbb566a9cfb1a82
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:50:31 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b899fc81955ca4f-YUL

Redirect headers

location
https://dmx.districtm.io/s/10051/y-v6iA94FE2uGgLH5Mv50OdzL4RqBs33ts~A~UPb6b4c899-556d-11ec-9f09-0e98ce530e37
date
Sun, 05 Dec 2021 01:50:31 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
ie65HF3Q4cl5eT0MwBbs
dmx.districtm.io/s/10027/ Frame C436
Redirect Chain
  • https://us.creativecdn.com/cm-notify?pi=districtm
  • https://dmx.districtm.io/s/10027/ie65HF3Q4cl5eT0MwBbs?pi=districtm
76 B
223 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10027/ie65HF3Q4cl5eT0MwBbs?pi=districtm
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9cbe77b69625e17d5ae4d7dd160bea4e0044c5b85ae3edaea370fc7067457c4e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:50:31 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b899fc8195aca4f-YUL

Redirect headers

location
https://dmx.districtm.io/s/10027/ie65HF3Q4cl5eT0MwBbs?pi=districtm
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT, Sun, 05 Dec 2021 01:50:31 GMT
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
xswp1o64ToFOAZv37ofaZSV4zbQ
dmx.districtm.io/s/10026/ Frame C436
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=132
  • https://dmx.districtm.io/s/10026/xswp1o64ToFOAZv37ofaZSV4zbQ
83 B
156 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10026/xswp1o64ToFOAZv37ofaZSV4zbQ
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8b55fc568cb954d4d8a798daed724d4c04728d17c64c7102274b120d147c71ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:50:31 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b899fc7d91bca4f-YUL

Redirect headers

Location
https://dmx.districtm.io/s/10026/xswp1o64ToFOAZv37ofaZSV4zbQ
Date
Sun, 05 Dec 2021 01:50:31 GMT
Connection
keep-alive
Content-Length
83
Content-Type
text/html; charset=utf-8
y-c_DrfvRE2uGiNxzrb1OfqwI_L4QZUNNM4Z58Uzk-~A
dmx.districtm.io/s/10057/ Frame 3D54
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58377/occ?gdpr=&gdpr_consent=
  • https://dmx.districtm.io/s/10057/y-c_DrfvRE2uGiNxzrb1OfqwI_L4QZUNNM4Z58Uzk-~A
100 B
153 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10057/y-c_DrfvRE2uGiNxzrb1OfqwI_L4QZUNNM4Z58Uzk-~A
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0cd951de444b20e3102dc1ab4c73a679ecfbb0cd5b0ea921839911d12c11ffa2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:50:31 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b899fc7a8ebca4f-YUL

Redirect headers

location
https://dmx.districtm.io/s/10057/y-c_DrfvRE2uGiNxzrb1OfqwI_L4QZUNNM4Z58Uzk-~A
date
Sun, 05 Dec 2021 01:50:31 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Yawa4AAJpMVYSwBG
dmx.us-east-34.districtm.io/s/10016/ Frame 3D54
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/1477?redir=https%3A//dmx.us-east-34.districtm.io/s/10016/$%7BTM_USER_ID%7D
  • https://dmx.us-east-34.districtm.io/s/10016/Yawa4AAJpMVYSwBG
72 B
209 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.us-east-34.districtm.io/s/10016/Yawa4AAJpMVYSwBG
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
34.73.194.24 North Charleston, United States, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),
Reverse DNS
24.194.73.34.bc.googleusercontent.com
Software
/
Resource Hash
2709bdddaa0ad619fce3d4890ec33135b629c4d9cb5db5e1efd9b9312d9f0dbe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
content-length
72
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 varnish
server
Varnish
x-timer
S1638669032.573510,VS0,VE0
x-served-by
cache-yul12826-YUL
x-cache
HIT
location
https://dmx.us-east-34.districtm.io/s/10016/Yawa4AAJpMVYSwBG
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
8169d5dd-0a59-4fc8-aa31-a786caffc331
dmx.districtm.io/s/10059/ Frame 3D54
Redirect Chain
  • https://match.sharethrough.com/1PQ8qgv7/v1/
  • https://dmx.districtm.io/s/10059/8169d5dd-0a59-4fc8-aa31-a786caffc331
92 B
140 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10059/8169d5dd-0a59-4fc8-aa31-a786caffc331
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
943a4737d869145e2b755e99a3be24f4ab1ce524b92aade8476cd8a939997f60
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:50:31 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b899fc7e92fca4f-YUL

Redirect headers

location
https://dmx.districtm.io/s/10059/8169d5dd-0a59-4fc8-aa31-a786caffc331
date
Sun, 05 Dec 2021 01:50:31 GMT
content-length
0
AAAGdipzeeBVkgN8v6psAAAAAAA&expiration=1638755431&nuid=21qWKCsXGVpnyh5n8TvtcHVALUl&is_secure=true
dmx.us-east-34.districtm.io/s/10007/ Frame 3D54
Redirect Chain
  • https://districtm-match.dotomi.com/match/bounce/current?version=1&networkId=33921&nuid=21qWKCsXGVpnyh5n8TvtcHVALUl&rurl=//dmx.us-east-34.districtm.io/s/10007/
  • https://districtm-match.dotomi.com/match/bounce/current?DotomiTest=230a0eb50584122d&is_secure=true&version=1&networkId=33921&nuid=21qWKCsXGVpnyh5n8TvtcHVALUl&rurl=%2F%2Fdmx.us-east-34.districtm.io%...
  • https://dmx.us-east-34.districtm.io/s/10007/AAAGdipzeeBVkgN8v6psAAAAAAA&expiration=1638755431&nuid=21qWKCsXGVpnyh5n8TvtcHVALUl&is_secure=true
153 B
290 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.us-east-34.districtm.io/s/10007/AAAGdipzeeBVkgN8v6psAAAAAAA&expiration=1638755431&nuid=21qWKCsXGVpnyh5n8TvtcHVALUl&is_secure=true
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
34.73.194.24 North Charleston, United States, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),
Reverse DNS
24.194.73.34.bc.googleusercontent.com
Software
/
Resource Hash
4ffb3c059a52703436b925b5625f0f035e500656dba60bf6fd900e209497967e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
content-length
153
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
//dmx.us-east-34.districtm.io/s/10007/AAAGdipzeeBVkgN8v6psAAAAAAA&expiration=1638755431&nuid=21qWKCsXGVpnyh5n8TvtcHVALUl&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
AADRPU7DWDYAAC1tRSs1sA
dmx.districtm.io/s/10025/ Frame 3D54
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/districtm
  • https://dmx.districtm.io/s/10025/AADRPU7DWDYAAC1tRSs1sA
78 B
142 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/10025/AADRPU7DWDYAAC1tRSs1sA
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ecc7cc576c45b7d75e632b408e7e3eb63ec6c9bdeed91e9b4e4afc539b667d2e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://cdn.districtm.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
date
Sun, 05 Dec 2021 01:50:31 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
6b899fc7b902ca4f-YUL

Redirect headers

location
https://dmx.districtm.io/s/10025/AADRPU7DWDYAAC1tRSs1sA
Date
Sun, 05 Dec 2021 01:50:31 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
strict-transport-security
max-age=2592000; includeSubDomains
627448
vid.springserve.com/vast/ Frame 182D 		22 B
219 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.springserve.com/vast/627448?w=640&h=480&cb=2438318089071&url=bleepingcomputer.com&ip=37.120.205.180&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F96.0.4664.45+Safari%2F537.36&dnt=&gdpr_consent=&gdpr=&us_privacy=&schain=&ip=37.120.205.180&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F96.0.4664.45+Safari%2F537.36&lat=45.4994&lon=-73.5703&dnt=&desc=&ic=&dur=&ap=&app_bundle=&app_name=&app_store_url=&inv_partner_domain=&vid=&min_dur=&max_dur=&mute=&placement=&skip=&prodq=&content_id=&content_episode=&content_title=&content_series=&content_season=&content_genre=&content_livestream=&content_producer_name=&rating=&channel_name=&language=&network_name=&did=&pp=%7B%7BPRICE_PAID%7D%7D&device_make=Google&device_model=Chrome&brand_name=Google&country=CA&ifa_type=&gdpr_consent=&gdpr=&us_privacy=&payid=a24eb6%3A1224&schain=&coppa=&lmt=&omidpn=%7B%7BOMID_PN%7D%7D&omidpv=%7B%7BOMID_PV%7D%7D&_bchc=1
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.142.30.148 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-142-30-148.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
263b5c14ea0c8dba145eaa30a0e60b7f9e0d3cb3c8f2356f59832ff329fa6d38

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:31 GMT
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
nginx
content-length
22
content-type
application/xml;charset=UTF-8
index.html
storage.googleapis.com/session-hub/ Frame 830A 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/session-hub/index.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2010 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
b73857582989f2602487dc4de28f9e84ec0f34dad3857a405137e60150e4bfa4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

x-guploader-uploadid
ADPycdvKF-FpJxN7NYkXKtQzkfFJQhPCaDR6SJZ82WJGMG7s-81Gvky4McnNpU39cGiO0vutdpZhCcxRP1Fc_y2FUnVny52LoQ
expires
Sun, 05 Dec 2021 01:57:39 GMT
date
Sun, 05 Dec 2021 00:57:39 GMT
last-modified
Wed, 28 Aug 2019 19:06:32 GMT
etag
"81bfe4f005f3280a68f6b07b2b1c8d60"
x-goog-generation
1567019192557207
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
2151
content-type
text/html
content-language
en
x-goog-hash
crc32c=R+UPRg== md5=gb/k8AXzKApo9rB7KxyNYA==
x-goog-storage-class
REGIONAL
accept-ranges
bytes
content-length
2151
server
UploadServer
age
3172
cache-control
public, max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
i
vid-io-cle.springserve.com/vd/ Frame 182D 		0
122 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid-io-cle.springserve.com/vd/i?suuid=20a84aff&ps_id=514171&batch=1
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.19.190.206 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-19-190-206.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:31 GMT
access-control-allow-credentials
true
server
nginx
content-length
0
usync.js
eus.rubiconproject.com/ Frame 7428 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.73.244.44 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-73-244-44.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
952ff494a4f911577bd010f4a1e393e93cb090ce1976f464442cc8aa1ac6b12b

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:31 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Nov 2021 00:01:00 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=17360
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9514
Expires
Sun, 05 Dec 2021 06:39:51 GMT
match
cms-xch-chicago.33across.com/ Frame 7428
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=
  • https://ssc-cms.33across.com/ps/?xi=1&xu=KWSL87CK-1M-EIIR
  • https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KWSL87CK-1M-EIIR&ts=1638669031&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
68 B
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KWSL87CK-1M-EIIR&ts=1638669031&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
nginx/1.20.1 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google, 1.1 google
server
nginx/1.20.1
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
clear
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:31 GMT
referrer-policy
unsafe-url
server
33XP004
x-33x-status
8000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KWSL87CK-1M-EIIR&ts=1638669031&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
users
dmx.districtm.io/s/v1/ Frame C436 		0
670 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/v1/users
Requested by
Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://cdn.districtm.io/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
DELETE, GET, OPTIONS, POST
access-control-allow-origin
https://cdn.districtm.io
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6b899fc90ac6ca4f-YUL
access-control-allow-headers
Origin, Content-Type
users
dmx.districtm.io/s/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/v1/users
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://cdn.districtm.io
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cf-ray
6b899fc8a9e4ca6f-YUL
access-control-allow-origin
https://cdn.districtm.io
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
access-control-allow-headers
Origin, Content-Type
access-control-allow-methods
DELETE, GET, OPTIONS, POST
access-control-max-age
14400
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
users
dmx.districtm.io/s/v1/ Frame 3D54 		0
883 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/v1/users
Requested by
Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://cdn.districtm.io/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 05 Dec 2021 01:50:32 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
DELETE, GET, OPTIONS, POST
access-control-allow-origin
https://cdn.districtm.io
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6b899fc9ab4dca4f-YUL
access-control-allow-headers
Origin, Content-Type
users
dmx.districtm.io/s/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/s/v1/users
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://cdn.districtm.io
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
cf-ray
6b899fc94a71ca6f-YUL
access-control-allow-origin
https://cdn.districtm.io
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
access-control-allow-headers
Origin, Content-Type
access-control-allow-methods
DELETE, GET, OPTIONS, POST
access-control-max-age
14400
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
830b8ca5f78f00f8a0d79813f2ba95b0a7efd1ee7536567b5c25219323f3209b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:50:31 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
SPug
simage4.pubmatic.com/AdServer/ Frame 9D8D 		0
128 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156696&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:32 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
async_usersync
ib.adnxs.com/ Frame A83D 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:32 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
4a067bf9-fe58-4140-b899-ad9e450dbbfd
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 64BB 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:32 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
f886cfb4-82a6-4b3b-b431-4109e030b32a
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
abt
capi.connatix.com/tr/ Frame 3CCD 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/abt?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:32 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
PugMaster
image6.pubmatic.com/AdServer/ Frame FD44 		560 B
852 B 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=90091754&p=156696&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
72781a6218413155d1b24c1a8ebc2c406556748de82bd0d7b131fa963ce1a74e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:33 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
560
content-type
text/html; charset=UTF-8
PugMaster
image6.pubmatic.com/AdServer/ Frame 1A3B 		560 B
616 B 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=83607166&p=156696&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
72781a6218413155d1b24c1a8ebc2c406556748de82bd0d7b131fa963ce1a74e

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:33 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
560
content-type
text/html; charset=UTF-8
mw
mwzeom.zeotap.com/ Frame FD44
Redirect Chain
  • https://pixel.onaudience.com/?partner=214&mapped=6B5103A8-1986-4A80-BC68-1BDBA8628E47
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1
  • https://pixel.onaudience.com/?partner=147&mapped=0a060ae1-17dc-465b-b9b3-37e0e67725c6&icm
  • https://spl.zeotap.com/?zdid=1332&zcluid=8cad49ac1da69e7c
  • https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=e7286cc6-fc38-4f65-7e5b-9bc3e8d39797&reqId=0ccdd910-7f45-43dc-741a-3e1da1e93124&zclui...
  • https://mwzeom.zeotap.com/mw?google_gid=CAESECecXKRLtMkbt60dDB3SYRA&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=e7286cc6-fc38-4f65-7e5b-9bc3e8d39797&reqId=0ccdd910-7f45-43dc-741a-3e1...
95 B
164 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mwzeom.zeotap.com/mw?google_gid=CAESECecXKRLtMkbt60dDB3SYRA&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=e7286cc6-fc38-4f65-7e5b-9bc3e8d39797&reqId=0ccdd910-7f45-43dc-741a-3e1da1e93124&zcluid=8cad49ac1da69e7c&zdid=1332
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:34 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
image/png
access-control-allow-origin
https://ads.pubmatic.com
access-control-allow-credentials
true
cf-ray
6b899fda8cb87148-YUL
access-control-allow-headers
*
content-length
95

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:34 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://mwzeom.zeotap.com/mw?google_gid=CAESECecXKRLtMkbt60dDB3SYRA&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=e7286cc6-fc38-4f65-7e5b-9bc3e8d39797&reqId=0ccdd910-7f45-43dc-741a-3e1da1e93124&zcluid=8cad49ac1da69e7c&zdid=1332
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
469
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
p.gif
visitor.fiftyt.com/ Frame FD44
Redirect Chain
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=&fbounce=1
0
436 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=&fbounce=1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
35.201.96.126 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
126.96.201.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:34 GMT
via
1.1 google
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
clear
content-length
0
p3p
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

date
Sun, 05 Dec 2021 01:50:34 GMT
via
1.1 google
p3p
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=&fbounce=1
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-type
text/html; charset=utf-8
alt-svc
clear
content-length
144
g.pixel
aa.agkn.com/adscores/ Frame FD44 		43 B
684 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212308278&puid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
156.154.202.36 , United States, ASN19907 (NEUSTAR-AS6, US),
Reverse DNS
Software
AAWebServer /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:34 GMT
Server
AAWebServer
Access-Control-Allow-Methods
GET, POST, OPTIONS
P3P
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
Content-Type
image/gif
Access-Control-Allow-Headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type
Content-Length
43
Expires
0
/
io.narrative.io/ Frame FD44
Redirect Chain
  • https://io.narrative.io/?companyId=673&id=pubmatic_id:6B5103A8-1986-4A80-BC68-1BDBA8628E47
  • https://io.narrative.io/?io.narrative.guid.v2=bc8d8430-556d-11ec-9141-120bff9cc4e7&companyId=673&id=pubmatic_id:6B5103A8-1986-4A80-BC68-1BDBA8628E47
0
135 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://io.narrative.io/?io.narrative.guid.v2=bc8d8430-556d-11ec-9141-120bff9cc4e7&companyId=673&id=pubmatic_id:6B5103A8-1986-4A80-BC68-1BDBA8628E47
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
3.215.189.212 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-215-189-212.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:34 GMT
Cache-Control
no-cache
Server
nginx/1.18.0
Connection
keep-alive

Redirect headers

Location
https://io.narrative.io/?io.narrative.guid.v2=bc8d8430-556d-11ec-9141-120bff9cc4e7&companyId=673&id=pubmatic_id:6B5103A8-1986-4A80-BC68-1BDBA8628E47
Date
Sun, 05 Dec 2021 01:50:34 GMT
Server
nginx/1.18.0
Connection
keep-alive
Content-Length
0
mw
mwzeom.zeotap.com/ Frame 1A3B
Redirect Chain
  • https://pixel.onaudience.com/?partner=214&mapped=6B5103A8-1986-4A80-BC68-1BDBA8628E47
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1
  • https://pixel.onaudience.com/?partner=147&mapped=0a060ae1-17dc-465b-b9b3-37e0e67725c6&icm
  • https://spl.zeotap.com/?zdid=1332&zcluid=8cad49ac1da69e7c
  • https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=737d0c9c-3993-490c-40e2-583e4e214dbf&reqId=8f812b1e-6374-446a-52fd-ccc2503400f1&zclui...
  • https://mwzeom.zeotap.com/mw?google_gid=CAESECecXKRLtMkbt60dDB3SYRA&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=737d0c9c-3993-490c-40e2-583e4e214dbf&reqId=8f812b1e-6374-446a-52fd-ccc...
95 B
153 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mwzeom.zeotap.com/mw?google_gid=CAESECecXKRLtMkbt60dDB3SYRA&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=737d0c9c-3993-490c-40e2-583e4e214dbf&reqId=8f812b1e-6374-446a-52fd-ccc2503400f1&zcluid=8cad49ac1da69e7c&zdid=1332
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
2606:4700:10::6816:1957 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:34 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
image/png
access-control-allow-origin
https://ads.pubmatic.com
access-control-allow-credentials
true
cf-ray
6b899fda8cb67148-YUL
access-control-allow-headers
*
content-length
95

Redirect headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:34 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://mwzeom.zeotap.com/mw?google_gid=CAESECecXKRLtMkbt60dDB3SYRA&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=737d0c9c-3993-490c-40e2-583e4e214dbf&reqId=8f812b1e-6374-446a-52fd-ccc2503400f1&zcluid=8cad49ac1da69e7c&zdid=1332
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
469
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
p.gif
visitor.fiftyt.com/ Frame 1A3B
Redirect Chain
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=&fbounce=1
0
438 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=&fbounce=1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Server
35.201.96.126 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
126.96.201.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:34 GMT
via
1.1 google
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
clear
content-length
0
p3p
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

date
Sun, 05 Dec 2021 01:50:34 GMT
via
1.1 google
p3p
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=6B5103A8-1986-4A80-BC68-1BDBA8628E47&gdpr=&fbounce=1
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-type
text/html; charset=utf-8
alt-svc
clear
content-length
144
g.pixel
aa.agkn.com/adscores/ Frame 1A3B 		43 B
684 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212308278&puid=6B5103A8-1986-4A80-BC68-1BDBA8628E47
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
156.154.202.36 , United States, ASN19907 (NEUSTAR-AS6, US),
Reverse DNS
Software
AAWebServer /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:34 GMT
Server
AAWebServer
Access-Control-Allow-Methods
GET, POST, OPTIONS
P3P
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
Content-Type
image/gif
Access-Control-Allow-Headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type
Content-Length
43
Expires
0
/
io.narrative.io/ Frame 1A3B
Redirect Chain
  • https://io.narrative.io/?companyId=673&id=pubmatic_id:6B5103A8-1986-4A80-BC68-1BDBA8628E47
  • https://io.narrative.io/?io.narrative.guid.v2=bc8d5d20-556d-11ec-96af-0e9f37bd45a9&companyId=673&id=pubmatic_id:6B5103A8-1986-4A80-BC68-1BDBA8628E47
0
247 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://io.narrative.io/?io.narrative.guid.v2=bc8d5d20-556d-11ec-96af-0e9f37bd45a9&companyId=673&id=pubmatic_id:6B5103A8-1986-4A80-BC68-1BDBA8628E47
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
3.215.189.212 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-215-189-212.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Sun, 05 Dec 2021 01:50:34 GMT
Cache-Control
no-cache
Server
nginx/1.18.0
Connection
keep-alive

Redirect headers

Location
https://io.narrative.io/?io.narrative.guid.v2=bc8d5d20-556d-11ec-96af-0e9f37bd45a9&companyId=673&id=pubmatic_id:6B5103A8-1986-4A80-BC68-1BDBA8628E47
Date
Sun, 05 Dec 2021 01:50:34 GMT
Server
nginx/1.18.0
Connection
keep-alive
Content-Length
0
g
capi.connatix.com/rtb/ Frame 3CCD 		417 B
673 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/rtb/g?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
149439fa84a78de93ee928240b6a46f0c8d5da15eb366d91be0d891dfb8be558

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:33 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
417
content-type
multipart/form-data
514171
vid.springserve.com/vast/ Frame 3CCD 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain=
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.142.30.148 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-142-30-148.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
63658ec7937e89f8d7c4fe8c66d3eaba82ecf95b38d7989ae6b5ee8e7b90290a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:36 GMT
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
nginx
content-encoding
gzip
content-type
application/xml;charset=UTF-8
vpaid_25214542.js
vpaid.springserve.com/production/ Frame 240E 		495 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vpaid.springserve.com/production/vpaid_25214542.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:8400:15:6f6c:b180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6b065f38eaed75574515532e2d687fd23450a662a972d044626b848d6e9d1045

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 29 Nov 2021 01:33:13 GMT
content-encoding
br
last-modified
Fri, 19 Nov 2021 18:30:16 GMT
server
AmazonS3
age
519444
etag
W/"185feb14359001049d144410afbeaaa4"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 ee623581f95aa65c7c8707871d87b791.cloudfront.net (CloudFront)
cache-control
max-age=2678400
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
Q8wvGCyopSdyqQQCgXWzpOIJv9sHWPFKMszsArhuDMgEtleuGVpDlQ==
prebid
ib.adnxs.com/ut/v3/ Frame 240E 		160 B
1005 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
f154c9cd99e4d0f2dd4682195fd665b861bd7696cd1a44547821f7837980e642
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:36 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
c67c9a6a-6d54-4938-b2b5-e9e97221142d
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
160
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame 240E 		0
66 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:35 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
openrtb
ads.adaptv.advertising.com/rtb/ Frame 240E 		0
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.81.191.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-81-191-231.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
openrtb
ads.adaptv.advertising.com/rtb/ Frame 240E 		0
225 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=RevNewExchange
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.81.191.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-81-191-231.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
server
adaptv/1.0
Connection
keep-alive
content-length
0
content-type
application/json
6f1c8b5f-b627-4778-a2d3-261997f48ae2.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		80 KB
80 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/6f1c8b5f-b627-4778-a2d3-261997f48ae2.jpg?crop=834:541,smart&width=834&height=541&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f2d93c219f91a38a44ec42951184d4a1d9a655597f908acf2daab59e1f6be99c

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:36 GMT
content-encoding
br
age
1241
etag
"BJEpKQIfVk9gfFq5ybAO/aznNltgdmsHA8hej/f0qXQ"
access-control-max-age
86400
fastly-io-info
ifsz=267428 idim=1600x800 ifmt=jpeg ofsz=81904 odim=834x541 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
81912
VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads.adaptv.advertising.com/a/h/ Frame 240E 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669036488&gdpr=&gdpr_consent=&us_privacy=&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=[scpid]&hp=[hp]&eov=eov&pi.width=640&pi.height=480
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.81.191.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-81-191-231.compute-1.amazonaws.com
Software
adaptv/1.0 /
Resource Hash
d94553d767a3a35d03c216544f9b20ad2cad8e257b7f7c0a9992bd3357a0e8c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
server
adaptv/1.0
content-type
text/xml
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
954
expires
0
o2shim
acds.prod.vidible.tv/ Frame D7D3 		15 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=57a801cf-34c5-4869-b541-b12797cf106b&pblob=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.222.130.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-222-130-154.compute-1.amazonaws.com
Software
/
Resource Hash
f703078e42761b82133b652601a12e6d990bb8559e608782b9a992b3cb5db849

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:36 GMT
content-encoding
gzip
access-control-max-age
3600
access-control-allow-methods
POST, GET, HEAD, PUT, PATCH, DELETE
content-type
application/javascript
access-control-allow-origin
*
access-control-allow-headers
content-length
6639
0.js
cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/ Frame D7D3 		319 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Requested by
Host: acds.prod.vidible.tv
URL: https://acds.prod.vidible.tv/o2shim?companionId=&cpmPassback=&placementId=1279691&orgId=28949&injectCompanionDummy=&pauseOnClick=&d.vw=&d.app=&r=bleepingcomputer.com%2F&vrid=57a801cf-34c5-4869-b541-b12797cf106b&pblob=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4998:14:800::1001 Ashburn, United States, ASN14777 (YAHOO, US),
Reverse DNS
Software
ATS /
Resource Hash
415522d8ed63727924c2a9dcfe8ee62e86d97f0860aa9d73103efccef9e6c969
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

ats-carp-promotion
1
date
Mon, 29 Nov 2021 16:25:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
465884
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-length
104909
x-amz-id-2
ViDU7qxIVXCQ1OoL+wnEuf7bcOjIs2T7ni4ZpbYjPgnIAOe5CwvGhyqrgU0nSXPjJWD8zviCczc=
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 29 Oct 2021 12:07:18 GMT
server
ATS
etag
"ad866575d644f8b5c5d7a56ff730d7e3-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET
x-amz-request-id
XVSF9HDPN0WNYG5D
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=1209600
x-amz-version-id
null
accept-ranges
bytes
content-type
application/javascript
impression.gif
trk.vidible.tv/trk/ Frame D7D3 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/impression.gif?pid=59947c0544a64b1a49e52a48&bcid=603d9102810cd10001d1d12f&s=true&pv=10.2.82&ifr=true&cb=0.9281874743357033&pt=o2unit&sid=ff09e185-c69f-4d9f-bc7d-84b2aa11bcf2&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.41.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-41-176.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:36 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:50:36 GMT
moatapi.js
z.moatads.com/aolvidibleapi29384728347/ Frame 240E 		133 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/aolvidibleapi29384728347/moatapi.js
Requested by
Host: cdn-ssl.vidible.tv
URL: https://cdn-ssl.vidible.tv/prod/ad-client/js/10.2.82/0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
90542f9de6cab010087ab4bcab0e3b0a2ec1e449e445434dc1bb5c852033f046

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:37 GMT
content-encoding
gzip
last-modified
Tue, 25 Feb 2020 18:37:38 GMT
server
AmazonS3
x-amz-request-id
248CC7A683259DAA
etag
"d678022569896f7b7293494e3a69c8c7"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=10927
accept-ranges
bytes
content-length
44266
x-amz-id-2
3gL1G73xdwsJvoBVhRBYvjjgpoiElrEMgkbddhjUjbkesF76DaTRBtuV3PjNJcRAEgbxpZrGLm4=
VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=
ads-ec.v.ssp.yahoo.com/a/h/ Frame D7D3
Redirect Chain
  • https://ads.adaptv.advertising.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669036488&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&p...
  • https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669036488&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.he...
249 B
0 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669036488&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=cf9bcd12-7007-4d07-b405-26d0ac67417a&a.is_yahoo=3&redirect_y=dHM9MTYzODY2OTAzNzA4Ni4xMzIwODA6YXBpZD1VUGI2YjRjODk5LTU1NmQtMTFlYy05ZjA5LTBlOThjZTUzMGUzNzptaWdyYXRlZDJ5PSIxIjpyZXF1ZXN0X2lkPWNmOWJjZDEyLTcwMDctNGQwNy1iNDA1LTI2ZDBhYzY3NDE3YQ==
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
HTTP/1.1
Server
3.231.253.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-231-253-205.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:37 GMT
content-encoding
gzip
server
ATS/9.1.0.33
Age
0
content-type
text/xml
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
192
expires
0

Redirect headers

strict-transport-security
max-age=31536000
server
adaptv/1.0
access-control-allow-origin
https://www.bleepingcomputer.com
content-type
text/plain
location
https://ads-ec.v.ssp.yahoo.com/a/h/VYmJZLEntSYpZcNpBsosMleWs6UAHVaBK84LVAMRQ0g=?cb=1638669036488&pet=preroll&pageUrl=bleepingcomputer.com%2F&scpid=%5Bscpid%5D&hp=%5Bhp%5D&eov=eov&pi.width=640&pi.height=480&a.cluster=0&a.pvt=0&a.d.pageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&a.hasAppInfo=2&a.sdk=o2unit&a.sdkType=js&depth=0&height=469&moatViewableOpportunity=0&p.vw.active=1&p.vw.psize=3&p.vw.viewable=0&p.vw.viewableOpportunity=0&width=834&a.y_rid=cf9bcd12-7007-4d07-b405-26d0ac67417a&a.is_yahoo=3&redirect_y=dHM9MTYzODY2OTAzNzA4Ni4xMzIwODA6YXBpZD1VUGI2YjRjODk5LTU1NmQtMTFlYy05ZjA5LTBlOThjZTUzMGUzNzptaWdyYXRlZDJ5PSIxIjpyZXF1ZXN0X2lkPWNmOWJjZDEyLTcwMDctNGQwNy1iNDA1LTI2ZDBhYzY3NDE3YQ==
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
0
display.gif
trk.vidible.tv/trk/ Frame D7D3 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/display.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=ff09e185-c69f-4d9f-bc7d-84b2aa11bcf2&vvuid=e95e5387-b1f5-4920-8277-3c68fcd90333&orgId=28949&plcid=1279691&vrid=57a801cf-34c5-4869-b541-b12797cf106b&ab=0&dt=130&h=469&spaceid=793604934&w=834&cb=0.20560715124022821
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.41.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-41-176.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:37 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:50:37 GMT
ad-request.gif
trk.vidible.tv/trk/ Frame D7D3 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/ad-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=ff09e185-c69f-4d9f-bc7d-84b2aa11bcf2&vvuid=e95e5387-b1f5-4920-8277-3c68fcd90333&orgId=28949&plcid=1279691&vrid=57a801cf-34c5-4869-b541-b12797cf106b&at=preroll&ps=html5-vpaid&spaceid=793604934&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&cb=0.6039928855526899
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.41.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-41-176.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:37 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:50:37 GMT
ad-engine-request.gif
trk.vidible.tv/trk/ Frame D7D3 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.vidible.tv/trk/ad-engine-request.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=ff09e185-c69f-4d9f-bc7d-84b2aa11bcf2&vvuid=e95e5387-b1f5-4920-8277-3c68fcd90333&orgId=28949&plcid=1279691&vrid=57a801cf-34c5-4869-b541-b12797cf106b&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=834&p.vw.active=1&p.vw.sound=100&vwa=0&vwm=-1&h=469&cb=0.22135407784493988
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.41.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-41-176.compute-1.amazonaws.com
Software
nginx/1.21.3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:37 GMT
cache-control
max-age=0, no-cache, no-store, must-revalidate
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
server
nginx/1.21.3
content-type
image/gif
content-length
43
expires
Sun, 05 Dec 2021 01:50:37 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&ac=1&bq=7&i=AOL_VIDIBLE_API1&t=1638669037099&de=883182035530&d=40%3A-%3A-%3A-&bo=bleepingcomputer.com&bd=bleepingcomputer.com&f=0&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:37 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Sun, 05 Dec 2021 01:50:37 GMT
ad-engine-response.gif
trk.vidible.tv/trk/ Frame D7D3 		0
0
bc2
bc-ssb-cle.springserve.com/ Frame 240E 		20 B
213 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bc-ssb-cle.springserve.com/bc2?r=da461805-60d3-47c0-b08d-afa3b6b7e5de-s.514171-d.528021-dc.132380&aid=962&det_d=www.bleepingcomputer.com&det_w=834
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.16.251.19 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-16-251-19.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:37 GMT
access-control-allow-credentials
true
server
nginx
content-length
20
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
i
vid-io-cle.springserve.com/vd/ Frame 240E 		0
122 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid-io-cle.springserve.com/vd/i?suuid=da461805&ps_id=514171&batch=1
Requested by
Host: vpaid.springserve.com
URL: https://vpaid.springserve.com/production/vpaid_25214542.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.19.190.206 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-19-190-206.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:37 GMT
access-control-allow-credentials
true
server
nginx
content-length
0
st
capi.connatix.com/tr/ Frame 3CCD 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/st?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:37 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
abt
capi.connatix.com/tr/ Frame 3CCD 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/abt?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:37 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
0
content-type
multipart/form-data
rules-p-UeXruRVtZz7w6.js
rules.quantcount.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-UeXruRVtZz7w6.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:4200:6:44e3:f8c0:93a1 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a7b5f5f96f81dea4efc53e1d4dae8b37c28bec27a45b42ccf604ee759e20caec

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 00:57:24 GMT
content-encoding
gzip
age
3196
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
last-modified
Thu, 07 Dec 2017 17:06:25 GMT
server
AmazonS3
etag
W/"cbc97d16c77ea1fcbbf42d246001e982"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 bcc31f3e5b9e78f99a5a01aa529f6c94.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
EWR53-C2
x-amz-cf-id
1phIi20x_eN-usU16BypqLovjLLvr1iuYJ2OOiywE8Ajp3HnqDodMw==
pixel;r=1142923927;labels=keywords.Botnet%2Ckeywords.Emotet%2Ckeywords.Malware%2Ckeywords.TrickBot%2Ckeywords.Trojan%2Ckeywords.Security%2Ckeywords.InfoSec%2Ckeywords.Computer%20Security%2Ctitle.Em...
pixel.quantserve.com/ 		35 B
210 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=1142923927;labels=keywords.Botnet%2Ckeywords.Emotet%2Ckeywords.Malware%2Ckeywords.TrickBot%2Ckeywords.Trojan%2Ckeywords.Security%2Ckeywords.InfoSec%2Ckeywords.Computer%20Security%2Ctitle.Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot%2Ctitle.Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot;rf=0;a=p-UeXruRVtZz7w6;url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F;uht=2;fpan=1;fpa=P0-1078609031-1638669039861;pbc=23ab3b00-8d24-4048-bf37-b882fba90a8f;ns=0;ce=1;qjs=1;qv=92a3679b-20211110211611;cm=;gdpr=0;ref=;d=bleepingcomputer.com;je=0;sr=1600x1200x24;dst=0;et=1638669039861;tzo=0;ogl=site_name.BleepingComputer%2Clocale.en_us%2Curl.https%3A%2F%2Fwww%252Ebleepingcomputer%252Ecom%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuil%2Ctype.article%2Ctitle.Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot%2Cdescription.The%20Emotet%20malware%20was%20considered%20the%20most%20widely%20spread%20malware%20in%20the%20past%252C%20us%2Cimage.https%3A%2F%2Fwww%252Ebleepstatic%252Ecom%2Fcontent%2Fhl-images%2F2020%2F07%2F28%2FEmotet%252Ejpg%2Cimage%3Asecure_url.https%3A%2F%2Fwww%252Ebleepstatic%252Ecom%2Fcontent%2Fhl-images%2F2020%2F07%2F28%2FEmotet%252Ejpg%2Cimage%3Awidth.1280%2Cimage%3Aheight.500
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:61c0:eb61:c438:2f4e , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:39 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
strict-transport-security
max-age=86400
expires
Fri, 04 Aug 1978 12:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		11 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211201&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111170101/show_ads_impl_fy2019.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3e1497e9026c5320a9a6c90b10017f5eb930d18056d4236c6fc54caedd5dad4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 01:50:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8841
x-xss-protection
0
rum
www.bleepingcomputer.com/cdn-cgi/ 		0
253 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.bleepingcomputer.com/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v64f9daad31f64f81be21cbef6184a5e31634941392597
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
content-type
application/json

Response headers

date
Sun, 05 Dec 2021 01:50:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
x-frame-options
DENY
access-control-allow-methods
POST,OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-max-age
86400
access-control-allow-credentials
true
cf-ray
6b899ffb8eb67133-YUL
vary
Origin
rum
www.bleepingcomputer.com/cdn-cgi/ 		0
77 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.bleepingcomputer.com/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v64f9daad31f64f81be21cbef6184a5e31634941392597
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
content-type
application/json

Response headers

date
Sun, 05 Dec 2021 01:50:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
x-frame-options
DENY
access-control-allow-methods
POST,OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-max-age
86400
access-control-allow-credentials
true
cf-ray
6b899ffbaf1e7133-YUL
vary
Origin
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Sun, 05 Dec 2021 01:50:39 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 6F42 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length
5046
date
Fri, 03 Dec 2021 18:15:28 GMT
expires
Sat, 03 Dec 2022 18:15:28 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
113712
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame D8CA 		783 B
534 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
7ebce8c74b46ec153078cfba6d91071f6277204e5f1955918abd515b6445cc20
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-U2HyrqSKilpP62R91eoyiw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/

Response headers

cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy
require-corp
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires
Sun, 05 Dec 2021 01:50:40 GMT
date
Sun, 05 Dec 2021 01:50:40 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-U2HyrqSKilpP62R91eoyiw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
512
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
pagead2.googlesyndication.com/bg/ Frame 6F42 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/ZhD25ev4EfR-XFP19TbfDo9DHcMa9GGM1cDlPvVEM3Q.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6610f6e5ebf811f47e5c53f5f536df0e8f431dc31af4618cd5c0e53ef5443374
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 18:15:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
113712
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13522
x-xss-protection
0
last-modified
Mon, 29 Nov 2021 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 03 Dec 2022 18:15:28 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame D8CA 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20211201&jk=376184159304027&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
generate_204
tpc.googlesyndication.com/ Frame 6F42 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?Qisd3g
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
gen_204
pagead2.googlesyndication.com/pagead/ 		0
22 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20211201&jk=376184159304027&bg=!qaqlqu7NAAaQHwIOkB87ACkAdvg8WiOHla3WK3J2N5rVM7EZERvPfjRuy2GESEM3vrx3sv-IXy7DsQIAAABiUgAAAAtoAQcKAI-BdZEjx_EVhtJe5-H-INtoIbmAWE4ofS72ym6MLk0dVVaMgNE1RNyHc0GKUjYPoeWLucRKstPQ4gqiuAnkf-gINZ3-hjf-wixh1ck4adS9_GjLkQlvfEAse38tIfYIT6IfniFd8vfE_Kkgu-a1nsT7nzewixe2Gbu8sEcPbWNDYPQq90HIPZlwOFEjzX6VjZkCxD4robFDW2fiNX_FzrIlvsxrM82iCaqcshbtRVdV3yrBpirc_v5PB6ixA4Lie_qbS-t6mNILwYOSsBXl4OfHtXzjRv00OQkZYl6bv0_hFcYTUTuD-YFA0VNCbHibJZ-K_AiBVZQ49ETdlJkkCE5iFJxDNH6zuDwgEpUf6wDN5uawwb-nLOzjeXitvDfgLGBmc8JYNnkROCl75ctnaw8wpFXgw-7h2p2-aUnu_00h1I78BRQRQko62NlBjpJw0KY6cEQuKCXnDz0nGJzDHOhEY6ZLbZkboGnFgAKfntsVZVsER9IWVQdDS9YCjmVMEmm1rO1eEU9l_OswdUF9hIpREhWzXBr3wA53rYZ-JFb1i9kcLnqLtggFzOXhU5BUBa61t_8-hJKxcmmlpQM9GCAt6y9qrSsvDjH5Z9HXKMwV9IozjLZCbxoKWh4e8cjFC2wphrIE3TBeqkru4n1sR54yJ7S3ZgOQkt7kHuxEic89P1hCIXLjaDa7NNS7mB0Xy3Ityd4KOKu3CoBf4kdg3kpcHojQdd8iqiAthzOj-fbfqeFXeKXKeX8tX1WHMAPQfimYhC_IG6xq4zOSpZ3MnHaRKEdCqKGV3pIhdQ80GpOJ1g5MrvyujplD5nhntBW4WUjo9tzofpJI77VXnkrLRWElKVm2rMrUZKBS2Zj4ja2A5owbICvPh0OmYLU5sk4vysatU9cQ8piml8vIDiJ0cn4Z0lGeHec46LmS5KxgiKuhxUmOfIzxd2OSSwHVRRJ_GDuJES9UTx4Wu884xTvk0wIfIGwDylqZScvGVHMTU9Wz6KeWKxD_70eHdUm3PEXAXfAJGEtwmdw8MSqmSofOHJOkdSul-4P4IUu1Yh2VUToz20kXCGq_oMU_9hs3ImiwFcrQvvltf1vothwYAAwgDCecI2XcoLB4wo4-PPWPAUMtNXxWO1fkHQ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:40 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
830b8ca5f78f00f8a0d79813f2ba95b0a7efd1ee7536567b5c25219323f3209b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:50:40 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
834b0b92-82e7-4f6b-aa2c-c0b46affd41e.jpg
img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/834b0b92-82e7-4f6b-aa2c-c0b46affd41e.jpg?crop=834:541,smart&width=834&height=541&format=jpeg&quality=60&fit=crop
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c37f4f9bf734ba728e2326c01a504fe6cccd209a9aed499237ad6dd7409df516

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:43 GMT
content-encoding
br
age
1236
etag
"v2aUIeZdnyvzt1sF+r6B+LKuRmu/K0D0sy3TKjXejPc"
access-control-max-age
86400
fastly-io-info
ifsz=62026 idim=1600x900 ifmt=jpeg ofsz=15807 odim=834x541 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
15188
bid
c.amazon-adsystem.com/e/dtb/ 		116 B
592 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&pid=gNew1BSHbHVSY&cb=2&ws=1600x1200&v=7.71.1&t=1000&slots=%5B%7B%22sd%22%3A%22bleepingcomputer_970x90_728x90_320x50_sticky%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%5D&schain=1.0%2C1!freestar.com%2C412%2C1%2C%2C%2C&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&vm=%7B%22ids%22%3A%7B%22id5%22%3A%22ID5*dWFAwFY04z_mUPxzUoTYiNX0tzwFFpM_VF37igydwjwA5QhPLSD5o1Swnj08Tk6UAOh9aiVnveTVVCsBXDpuZgDpHSEGeGBDjBgTBiC7caQA6olNF9n_KskrpSCHOAQXAOu7wa6YAvaE6r4dOmeh9QDtFQX-qPqtAef0DFG5fq0A92cgDjw_kZZsNLm_ReZrAPlIqvfbKm0DsaGNtJaIwgD7GOUGa99XsKwZnAZG_DEA_uBbUJVVsEzFSg01jWzTAQHwa2AumL7_E8EqYlptpwEEsFGdLXq5e0Q-23lAx2YBCPmw7yxYgmG1s6Okf_HvAQs6IOkEGxGYI-di1tLVxgEOfweOP2j6m0ts3kNke70BEeoIg2f2NZ_BVB_yO_1PARQXubUMoIgdD3jCa-cqhgFC6XkFdBrSh5wMHs4tOAkBRGJaAOuIjE8DzHDSFK75AUeRkulYLZSzlzkvdsIt2gFOglo7kIEDimTlus2Ev8MBURu6W0SkzWmOv23m2IS7%22%2C%22pubcommon%22%3A%2223ab3b00-8d24-4048-bf37-b882fba90a8f%22%7D%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.160.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-160-42.ewr53.r.cloudfront.net
Software
Server /
Resource Hash
01ff66c4767396e089a4b2bd0923db9f01c23e52dc07682c3fd4b26a56605782
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:43 GMT
via
1.1 29cdae592cbcdf154c4515153175497f.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
EWR53-C3
x-amz-rid
Z8FFZHQ39RSHRPRWK0MK
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
116
x-amz-cf-id
gl72NPGOsHfzAu8M7gl2B74-pU3caU2CqgKjj6NWerO3eRooXftzNQ==
translator
hbopenbid.pubmatic.com/ 		18 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
8f4b8b1fbed8f5f76d32683e623f547601c09a3e682ebffde528d614f5431c75

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:43 GMT
content-encoding
gzip
x-openrtb-version
2.3
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
application/json
cygnus
htlb.casalemedia.com/ 		17 KB
18 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=393562&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%221992dc67b3b209d4%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%224.42.1%22%2C%22userIds%22%3A%5B%22sharedid%22%2C%22pubcid%22%5D%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%22412%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%220a060ae1-17dc-465b-b9b3-37e0e67725c6%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%5D%7D%5D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22200bc3810774666e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%222013f563b5d50318%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%2C%22dfp_ad_unit_code%22%3A%22%2F15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.199.204.79 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-199-204-79.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
2f3a8f05d656eeda40560f2829b186ec5e166626bac9a16a49499a99b443e477

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:43 GMT
x-ak-initial-geo
CC:[CA], RC:[QC], CN:[NA], CIP:[37.120.205.180], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
x-cs-client-geo
19
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
17905
x-ak-client-geo
19
expires
Sun, 05 Dec 2021 01:50:43 GMT
arj
freestar-d.openx.net/w/1.0/ 		175 B
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=fcf94ba1-bbed-4eb7-8faf-a667ed034b6d&nocache=1638669043390&pubcid=23ab3b00-8d24-4048-bf37-b882fba90a8f&ttduuid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&schain=1.0%2C1!freestar.com%2C412%2C1%2C%2C%2C&aus=728x90%2C970x90&divids=bleepingcomputer_970x90_728x90_320x50_sticky&aucs=%252F15184186%252Fbleepingcomputer_970x90_728x90_320x50_sticky%252Fbleepingcomputer_970x90_728x90_320x50_sticky&auid=540959250
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.221.0 /
Resource Hash
72bbfc75b32a9d6d8cf8abe7c8e121c983338000ef69a072c8ba2618f0677841

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:43 GMT
content-encoding
gzip
server
OXGW/16.221.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
165
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
auction
tlx.3lift.com/header/ 		19 B
483 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=4.42.1&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tmax=1200
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.224.175.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-175-57.compute-1.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:43 GMT
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
application/json; charset=utf-8
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
prebid
ib.adnxs.com/ut/v3/ 		19 B
863 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:43 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
d7906e78-ef53-45ff-82c2-779130b2ad6b
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ 		140 B
985 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.132 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
556132fe40232600f6915aa58108384098ca87d0465286287a088452fd727451
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:43 GMT
X-Proxy-Origin
37.120.205.180; 37.120.205.180; 674.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid
a1dbaba5-c8b4-40fb-b2cb-21eedbb4e22f
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
140
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
hb
ssc.33across.com/api/v1/ 		119 B
196 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ssc.33across.com/api/v1/hb?guid=dPGcAuqZ0r6Ok4aKlId8sQ
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
76.20.149.34.bc.googleusercontent.com
Software
/ 33Across
Resource Hash
907f582e6ba023546ea075b2522ea84e692709567237e4f38929ceff1fb61c9a

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:43 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
120 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:43 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.151.182 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-151-182.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:43 GMT
access-control-allow-credentials
true
vary
Origin
prebid
ads.yieldmo.com/exchange/ 		0
230 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.yieldmo.com/exchange/prebid?pbav=4.42.1&p=%5B%7B%22placement_id%22%3A%22bleepingcomputer_970x90_728x90_320x50_sticky%22%2C%22callback_id%22%3A%22216076b1aca1b6d8%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%7D%5D&page_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&bust=1638669043395&pr=&scrd=1&dnt=false&description=The%20Emotet%20malware%20was%20considered%20the%20most%20widely%20spread%20malware%20in%20the%20past%2C%20using%20spam%20campaigns%20and%20malicious%20attachments%20to%20distribute%20the%20malware.&title=Emotet%20malware%20is%20back%20and%20rebuilding%20its%20botnet%20via%20TrickBot&w=1600&h=1200&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%7D&us_privacy=&pubcid=23ab3b00-8d24-4048-bf37-b882fba90a8f&tdid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%22412%22%2C%22hp%22%3A1%7D%5D%7D
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.226.174.129 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-226-174-129.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
pragma
no-cache
date
Sun, 05 Dec 2021 01:50:43 GMT
access-control-allow-credentials
true
x-robots-tag
none,NOINDEX,NOFOLLOW
access-control-allow-methods
POST, GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
94 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707c7680952&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&eidadserver.org=0a060ae1-17dc-465b-b9b3-37e0e67725c6&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
7c626d8c98f776ae253db4c6eab13bcfe67115a233d2b34cbcaec8bd53780baf

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:43 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
365 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a969d1301787836013037fa80ed00db&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&eidadserver.org=0a060ae1-17dc-465b-b9b3-37e0e67725c6&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
e19bbbcdf3b184181f642711f265c00e60d36347d075d6ccab56c66a10d4ceba

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:43 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
v1
dmx.districtm.io/b/ 		0
134 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

date
Sun, 05 Dec 2021 01:50:43 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
origin, Accept-Encoding
access-control-allow-methods
OPTIONS, POST
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6b89a0114819ca4f-YUL
access-control-allow-headers
origin, content-type
fastlane.json
fastlane.rubiconproject.com/a/api/ 		753 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55&rp_schain=1.0,1!freestar.com,412,1,,,&eid_pubcid.org=23ab3b00-8d24-4048-bf37-b882fba90a8f%5E1&eid_sharedid.org=01FP44J5YK9CZ5A0VW4N1WBNVE%5E1%5E01FP44J5YK9CZ5A0VW4N1WBNVE&tpid_tdid=0a060ae1-17dc-465b-b9b3-37e0e67725c6&eid_adserver.org=0a060ae1-17dc-465b-b9b3-37e0e67725c6&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-9%2CIAB19-10&tg_i.sectioncat=IAB19-9%2CIAB19-10&tg_i.pagecat=IAB19-9%2CIAB19-10&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&tg_i.fs_ad_product=stickyFooter&tg_i.dfp_ad_unit_code=15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky&tg_i.pbadslot=15184186%2Fbleepingcomputer_970x90_728x90_320x50_sticky%2Fbleepingcomputer_970x90_728x90_320x50_sticky&tk_flint=pbjs_lite_v4.42.1&x_source.tid=fcf94ba1-bbed-4eb7-8faf-a667ed034b6d&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.6419825305302571
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
2602:803:c002:200::41 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
0d2e02881c93e55cf5feefac46b87ff0493155e7f5b07a90de2b09d0655ba6b1

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Sun, 05 Dec 2021 01:50:43 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
753
Expires
Wed, 17 Sep 1975 21:32:10 GMT
prebid
prebid.media.net/rtb/ 		12 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
139.148.107.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
343820fe93600fe8f7c40f75ee944a13501edbff6a7cdb6cd1ef515d4ccd2462

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 05 Dec 2021 01:50:43 GMT
content-encoding
gzip
server
nginx
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
hbjson
grid.bidswitch.net/ 		2 B
318 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://grid.bidswitch.net/hbjson
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-4.42.7.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.211.165.199 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
199.165.211.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

Date
Sun, 05 Dec 2021 01:50:43 GMT
Server
nginx
Content-Type
application/json; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
2
ads
securepubads.g.doubleclick.net/gampad/ 		42 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=376184159304027&correlator=930032852318362&output=ldjh&impl=fifs&eid=31060438%2C31063889%2C44748553&vrg=2021120201&ptt=17&sc=1&sfv=1-0-38&ecs=20211205&iu_parts=15184186%2Cbleepingcomputer_970x90_728x90_320x50_sticky&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90&ris=19&rcs=1&prev_scp=fsrefresh%3D0%26fsrebid%3D0%26floors_id%3D65983f%26floors_hour%3D1%26fs_placementName%3Dbleepingcomputer_970x90_728x90_320x50_sticky%26fs_ad_product%3DstickyFooter%26amznbid%3D2%26amznp%3D2%26fspbg%3Dfreestar%26freestar_path%3D%252Fnews%252Fsecurity%252Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dpubmatic_728x90%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.21%26hb_adid%3D230642cfeedac2bc%26hb_bidder%3Dpubmatic%26fsbid%3Dtimeout&eri=1&cust_params=user-agent%3DChrome%26section%3Dnews&cookie=ID%3De3d418217285c23d%3AT%3D1638669023%3AS%3DALNI_MZhsysp5JVp7yRdKVmj6um0u9FwgA&bc=31&abxe=1&lmt=1637072838&dt=1638669043966&dlt=1638669022742&idt=1080&frm=20&biw=1600&bih=1200&oid=2&adxs=315&adys=1110&adks=3056404191&ucis=1&ifi=12&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x-1&msz=1600x-1&psts=AGkb-H9dDU1jIDEScnpyT_TTS2ZkPQ5Drfhy85ZsayO33UFsQvJBk569mKWxVursVFEuMbRjoo0EI62zLgfdJJthqcIWxNro%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=748970943.1638669023&ga_sid=1638669024&ga_hid=694903207&ga_fc=true&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120201.js?31063889
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
cafe /
Resource Hash
d68909c7a4c3c8190619ff7bf96c8292d37a03db3c58dc04ee40ba99b7c57a0f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 01:50:44 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10450
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
bl-f821a95-fce9ec60.js
tagan.adlightning.com/freestar/ Frame 8B28 		47 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/bl-f821a95-fce9ec60.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 03 Dec 2021 21:14:04 GMT
content-encoding
gzip
age
103001
x-cache
Hit from cloudfront
content-length
19737
x-amz-meta-git_commit
f821a95
last-modified
Fri, 03 Dec 2021 20:57:59 GMT
server
AmazonS3
etag
"5eef6669fc999c6f554cbb47518b36b4"
x-amz-version-id
IyRgxk0tko8XU044UcFMDeTCFL6j4o6p
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
GCwC76uEtakUwuD9JWJFp28bU_ITDCDYUvBWQgHYzKWBgnb2hjvZfw==
b-5a99e50-0ef925e1.js
tagan.adlightning.com/freestar/ Frame 8B28 		78 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/freestar/b-5a99e50-0ef925e1.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/freestar/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.162.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-162-9.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 08:26:02 GMT
content-encoding
gzip
age
1445083
x-cache
Hit from cloudfront
content-length
30111
x-amz-meta-git_commit
5a99e50
last-modified
Thu, 21 Oct 2021 14:42:46 GMT
server
AmazonS3
etag
"a5b54d0501be5fa645a46923bf1f6dfe"
x-amz-version-id
tynjFfgXKbXevSX.rzKqYE2SnqrB7ELk
via
1.1 1390ccfba3b832e28ba659d704aa57bb.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-C3
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
s5pWJkB7WtjJqsGT10G6ZAQUbR-AToMmCc_XAiSh7pksyzn2Od4ATg==
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
830b8ca5f78f00f8a0d79813f2ba95b0a7efd1ee7536567b5c25219323f3209b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:50:44 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
amp4ads-v0.mjs
cdn.ampproject.org/rtv/012111011823000/ Frame 8B28 		189 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
98ba8f881333898d751dabe4f8b4cacc4489a9f5b6b4fd1fc67c571dbfec95cf
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250263
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
55592
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:41 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"11dee2040f5fc1d7"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:41 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 8B28 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
65f6185cfe1cf88fa7981160dd6fa443e111887215b72953718ea70f8e2ba9f2
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250260
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4992
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"858600ba27ef7413"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:44 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 8B28 		89 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-analytics-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e97fc43ecd2f16948c3a8d2de65e0e5483db4ed5ab174058c178ca1c8665d0b
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250254
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28555
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"a64e482645fd262b"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:50 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 8B28 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-fit-text-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3d76ab4ac854cafef51bbbb5177ea75816df90e3c775294991a016404f2b6bb5
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250260
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1731
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"cb4f0e89d7d37d9b"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:44 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/012111011823000/v0/ Frame 8B28 		40 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012111011823000/v0/amp-form-0.1.mjs
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9a630b852e94f20cb8140704fd830bf40bfea0a2effaa67d06a0eadafbf3d508
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
250260
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12826
x-xss-protection
0
server
sffe
date
Thu, 02 Dec 2021 04:19:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f02165e023e70703"
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Fri, 02 Dec 2022 04:19:44 GMT
3475078732409437776
tpc.googlesyndication.com/daca_images/simgad/ Frame 8B28 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/3475078732409437776
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5690b289c02e28c255f52e917dc2ebd80dfbb5cdd3c23b68d20b220a6946f2dd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 16:29:40 GMT
x-content-type-options
nosniff
age
379264
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36120
x-xss-protection
0
last-modified
Wed, 03 Nov 2021 07:08:36 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Wed, 30 Nov 2022 16:29:40 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8B28 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 04 Dec 2021 19:49:59 GMT
x-content-type-options
nosniff
server
cafe
age
21645
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Sun, 05 Dec 2021 19:49:59 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8B28 		295 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Sun, 05 Dec 2021 00:17:40 GMT
x-content-type-options
nosniff
server
cafe
age
5584
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Mon, 06 Dec 2021 00:17:40 GMT
l
www.google.com/ads/measurement/ Frame 8B28 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSdzSPFd0NN-sdJLYcpauCGBGBdAs0Nqx4YzcJ-zjgBSS_YDI7xtTrnHzCgCFh-biVtYcsMPrde0DFMe10UDZxaF6MSwg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
adview
securepubads.g.doubleclick.net/pagead/ Frame 8B28 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=C4EAc9BqsYcDzAdrBsQfbiYGICNalrZdmpsHJu_sO-9X0_QgQASDHg_wBYP3oooHwA6ABj7OOvwPIAQLgAgCoAwHIAwiqBLwCT9Asb_s8gHyBsiP6sWw27--MXFFhLLZjsERnLQOweRxZ1qNN9EyzShTAlYx-nuPA7jzSyEjmMKeLmtdE7qKQiVjxw7rCAbf9-5v3qu3wTh_lhZ7BS6GrmsLiLnwWtiKoqXtOC0TU32Ji0lsaRfKnlq0IW-K9QmEOmqVIdbSx8SD0lWSm89fc7kAKxG_NYc4dqMNurlQjEa4gOGpHDsgMMAnweHss3JLGfAOOrQC_yuGKhr0Cl9aDRtGCgznfa_A-Tfu2FxoC5hzeuCOROFDSoS5U-W4WIU1utsVELf9n13sFqjLN3LIXQ6H_9qqj66ca8me9n-luD_yOnH-a78W02nYzD33wF3hATzcmg7liG2l0vwnRn45-4Fj4icAo_Y_B7HZS7g6yDfEBl56WAB5J3q3_ehi59JgnO4PIdcAEyZmY8uYD4AQBoAYCgAetpL20AagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEKXUMdIIBwiAYRABGB2ACgHICwHYEwPQFQGAFwGyFx4KHAgAEhRwdWItMDkyMDg5OTMwMDM5NzgyMxi6yBc&sigh=Kn-jrk__mdc&uach_m=[UACH]&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s72-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers
truncated
/ Frame 8B28 		218 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cd1c11febb31159039d1a50581b745cc891cbaaa91ef346ee3cac794721fc3ad

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
c
c.pub.network/ 		36 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.22.5.bb52971dfb9b5279eab2bc5216744ae8edba83c2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
830b8ca5f78f00f8a0d79813f2ba95b0a7efd1ee7536567b5c25219323f3209b

Request headers

Referer
https://www.bleepingcomputer.com/
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Sun, 05 Dec 2021 01:50:44 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
clear
content-length
36
g
capi.connatix.com/rtb/ Frame 3CCD 		266 B
522 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/rtb/g?v=140482
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.130.243.57 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-130-243-57.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
127656962cb1918ebebaaab66f0af795f2aa706e9a60fd4c5240c6a6cb1003be

Request headers

Referer
Accept-Language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
multipart/form-data

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Sun, 05 Dec 2021 01:50:44 GMT
access-control-allow-credentials
true
server
Kestrel
Connection
keep-alive
Content-Length
266
content-type
multipart/form-data

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Domain
trk.vidible.tv
URL
https://trk.vidible.tv/trk/ad-engine-response.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=267b94f2-7637-43b3-9a93-ab22d2a5d8af&vvuid=e937566a-f65e-41d2-99ff-fe9ce1ebdf40&orgId=28949&plcid=1279691&vrid=0ae1c91a-6d9d-433e-b513-fd08330d91a4&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=834&aert=867&ar=no&fo=0&ft=0&h=469&cb=0.6243390779948692
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK-
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs
Domain
trk.vidible.tv
URL
https://trk.vidible.tv/trk/ad-engine-response.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=d4c42b6a-9039-472f-8f40-1942c25d13ca&vvuid=936b077e-79f0-45db-8b43-9ef609f9058e&orgId=28949&plcid=1279691&vrid=48441f6f-76fe-46b3-81a0-fd0004006197&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=834&aert=408&ar=no&fo=0&ft=0&h=469&cb=0.9493673070819799
Domain
trk.vidible.tv
URL
https://trk.vidible.tv/trk/ad-engine-response.gif?bcid=603d9102810cd10001d1d12f&bid=56bcd17de4b0a5976ac0da12&pid=59947c0544a64b1a49e52a48&pt=o2unit&pv=10.2.82&r=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot%2F&s=true&sid=ff09e185-c69f-4d9f-bc7d-84b2aa11bcf2&vvuid=e95e5387-b1f5-4920-8277-3c68fcd90333&orgId=28949&plcid=1279691&vrid=57a801cf-34c5-4869-b541-b12797cf106b&at=preroll&adIdx=-1&pbl=true&ps=html5-vpaid&seq=-1&spaceid=793604934&v=593fb311c214e33ec50202f0&w=834&aert=409&ar=no&fo=0&ft=0&h=469&cb=0.8040488287290086

Verdicts & Comments Add Verdict or Comment

239 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| 25 object| 26 object| 27 object| 28 object| 29 object| 30 object| 31 object| 32 object| 33 object| 34 object| 35 object| 36 object| 37 object| 38 object| 39 object| 40 object| 41 object| 42 object| 43 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery function| cnxps object| freestar object| apd_options function| gtag object| dataLayer object| adsbygoogle function| Blazy object| fixto function| validate_comment_box_not_empty function| cz_strip_tags function| cz_br2nl function| editForm string| loginhash boolean| main_nav_hide_flag number| scrollTop string| main_nav_hide_timer function| call_main_nav_hide number| cz_header_pos number| prevScrollTop function| loadDeferredStyles function| raf object| __cfBeacon boolean| fifabAlready function| fi_fab object| google_tag_manager undefined| commonInit function| visibilityEventsManagerDOM function| visibilityEventsManager function| scrollEventsManager function| DeviceDetector object| FI object| JSON_PIWIK object| _fipaq object| FIPiwik object| AnalyticsTracker function| fiQuery function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| addthis_share object| addthis_config object| __twttrll object| twttr object| __twttr object| google_tag_data string| GoogleAnalyticsObject function| ga object| google_js_reporting_queue number| google_srt object| google_logging_queue number| tmod object| google_ad_modifications object| ggeac boolean| google_measure_js_timing object| google_reactive_ads_global_state boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots boolean| google_apltlad function| google_spfd number| google_lpabyc number| google_unique_id object| google_sv_map object| fsdata object| _comscore object| fsprebid string| google_user_agent_client_hint object| cnx_usr_storage boolean| __@@##MUH object| gaplugins object| gaGlobal object| gaData function| load_script object| googletag function| udm_ object| ns_p object| COMSCORE function| google_sa_impl object| google_persistent_state_async object| googleToken object| googleIMState boolean| _gfp_p_ function| processGoogleToken number| google_global_correlator object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages object| fiUtils object| $customVisiblity object| $waitOn object| oattr object| google_image_requests function| fsprebidChunk object| _pbjsGlobals object| mnet function| Tapad object| _atw string| addthis_exclude boolean| addthis_use_personalization string| addthis_options_default string| addthis_options_rank string| addthis_options object| __callbacks object| player_instance_fef24530f6714788825895d2dc45ae74 object| cnxEnfStorage function| cnxsetTimeout function| cnxsetInterval object| cnxPlugins object| __bt_tag_d object| __bt_intrnl boolean| __bt_already_invoked object| regeneratorRuntime function| cnxProxyTask object| apstag object| closure_lm_919216 object| _qevents object| up74tG2 function| up74tG3 object| xop boolean| apstagLOADED object| audSegDataResp string| kruxScriptId string| kruxIdScriptId string| kruxDataId string| kruxWhitelistSegments object| kruxScript function| checkMatchingSegments function| generateUUID function| getUserId function| getPageId function| getPageLog function| calculateDocumentType function| calculateReferer function| clientWindowHeight function| clientWindowWidth function| getBrowserSize function| firePageLog function| fireDataCall function| Krux function| ic_krux_getuserid string| IC_FS_PAGE_ID string| IC_FS_PAGE_REFERER undefined| nQuery number| ntvLoadStart object| ntv object| prdom object| onFocusEvents function| ntvjQueryInit function| ntvExtends function| ntvAppendStylesheet function| ntvAppendScript function| ntvArticleTracker function| ntvGetElementViewability function| ntvViewableImpressionTracker object| PostRelease object| ntvToutAds boolean| onFocus object| EE70hY2 function| EE70hY3 function| xblocker boolean| creativeVendorLibraryLoaded object| mfb1gT function| mfb1gf function| xblacklist object| google_llp object| PublisherCommonId object| ID5 undefined| moatApiInit1638669026021 object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager boolean| DFPSFMessageEnabled undefined| moatApiInit1638669030718 function| cnxAddEventListener

278 Cookies

Domain/Path Name / Value
www.bleepingcomputer.com/news/security/emotet-malware-is-back-and-rebuilding-its-botnet-via-trickbot Name: ntvSession
Value: {}
.resetdigital.co/csync Name: ckbk
Value: 0000008DA3C2A7C6
.3lift.com/sync Name: sync
Value: CgoIgQIQ262kwtgvCgoI4gEQ262kwtgvCgoI5gEQ262kwtgvCgoIhwIQ262kwtgvCgkICRDbraTC2C8KCQg6ENutpMLYLwoJCAsQ262kwtgvCgoIjAIQ262kwtgvCgoIzgEQ262kwtgvCgkIXxDbraTC2C8=
.bleepingcomputer.com/ Name: session_id
Value: 2fff61e2e4f3831f5ff460d38a8f109a
www.bleepingcomputer.com/ Name: lav
Value: 12322
www.bleepingcomputer.com/ Name: fsbotchecked
Value: true
www.bleepingcomputer.com/ Name: __atuvc
Value: 1%7C49
www.bleepingcomputer.com/ Name: __atuvs
Value: 61ac1adf658674c9000
.addthis.com/ Name: ouid
Value: 61ac1adf00015b7a5800900702bfc9062709a6dfdb6364175792
.addthis.com/ Name: di2
Value: aU~u]#%!k#$M`#!AgP2TIPv7LW6Lj6Hq#34Q#1:R#19w#.'j
.addthis.com/ Name: bt2
Value: 61ac1adf001Fs0002
.addthis.com/ Name: um
Value: j.'2021120501502324000020604811'
.addthis.com/ Name: uid
Value: 61ac1adf4d83b7c8
.addthis.com/ Name: na_id
Value: 2021120501502324000020604811
.addthis.com/ Name: vc
Value: 2
.bleepingcomputer.com/ Name: _ga
Value: GA1.2.748970943.1638669023
.bleepingcomputer.com/ Name: _gid
Value: GA1.2.1454516622.1638669023
.bleepingcomputer.com/ Name: _gat_gtag_UA_91740_1
Value: 1
www.bleepingcomputer.com/ Name: _fssid
Value: 033befdd-8068-4890-9090-74772675e3d7
cdn.firstimpression.io/ Name: OAID
Value: 488027da975526a2e2164ddaea23747b
.addthis.com/ Name: uvc
Value: 1%7C49
.scorecardresearch.com/ Name: UID
Value: 15RJD91GU4CTM9QYBE79Q6g1638669023
.addthis.com/ Name: loc
Value: MDAwMDBOQUNBT04yMjUzMTA0MzUwNTAwMDBDSA==
capi.connatix.com/ Name: cnx_userId
Value: 38868d4c88eb47018e4265d2b8cd3a09
www.bleepingcomputer.com/ Name: cnx_userId
Value: 38868d4c88eb47018e4265d2b8cd3a09
.reddit.com/ Name: csv
Value: 2
.adsrvr.org/ Name: TDID
Value: 0a060ae1-17dc-465b-b9b3-37e0e67725c6
.technoratimedia.com/ Name: tads_uid
Value: 11CC0AD6C88B446C9139DC1BA85CB120
.technoratimedia.com/ Name: tads_uid_cd
Value: 20211204205023-0500
.technoratimedia.com/ Name: tads_zora
Value: 2
.technoratimedia.com/ Name: tads_uidp_70
Value: 38868d4c88eb47018e4265d2b8cd3a09
.springserve.com/ Name: ssid
Value: 129cf41e-ccf9-4e46-b482-df31169c3b95
.springserve.com/ Name: sst
Value: 1638669023986
www.bleepingcomputer.com/ Name: _pbjs_userid_consent_data
Value: 3524755945110770
.pubmatic.com/ Name: KADUSERCOOKIE
Value: 6B5103A8-1986-4A80-BC68-1BDBA8628E47
.rubiconproject.com/ Name: khaos
Value: KWSL87CK-1M-EIIR
.bleepingcomputer.com/ Name: _pubcid
Value: 23ab3b00-8d24-4048-bf37-b882fba90a8f
.openx.net/ Name: i
Value: 23ab3b00-8d24-4048-bf37-b882fba90a8f|1638669024
.yahoo.com/ Name: A3
Value: d=AQABBOAarGECELKlAL91_hfSs0Td7cYZ2PgFEgEBAQFsrWG1YQAAAAAA_eMAAA&S=AQAAAnS9kLM_J9zd04I17nzzOfs
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~Yawa4AAJpMVYSwBG
.rubiconproject.com/ Name: rsid
Value: 1|AIfsdBUH+v3fWCPuzNowDE/cu41hKaStkydRTZb1Pwh3wYWROmqPGcfOdLvaiI/PRhnCqTioDwugFijIXUmqGzTE/2wGlVwK8BMqZcvhERk6pwW1CaJBOKyTTM+KZgD/ANSf
.doubleclick.net/ Name: IDE
Value: AHWqTUnvHnDPBQEYXglUztTlg8DRHP38UmwIHuEyH4XOStmppEkb8Goody2Kz2JWhSE
.adform.net/ Name: C
Value: 1
.adgrx.com/ Name: ADGRX_UID
Value: b6b28f1a-556d-11ec-a2e0-2e68efb6964a
.deepintent.com/ Name: CDIUSER
Value: di_fe5a87ec034349adb9d1d
.adform.net/ Name: uid
Value: 1452678799778604270
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-c6cc29d6-8eb8-4e81-4e01-9bf7ee87da65.kaNef4kf2D%2Fv%2BAGXh7AKPjA26DdLnX0dMlVFxc%2Foex4
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3A0-c6cc29d6-8eb8-4e81-4e01-9bf7ee87da65%24ip%2437.120.205.180.ylgv79CKRgNhxIyIrMYB9jlWmSwScWZvKRSayv48I2M
.advertising.com/ Name: APID
Value: UPb6b4c899-556d-11ec-9f09-0e98ce530e37
.adgrx.com/ Name: ADGRX_CM_PUBMATIC_BRIDGED
Value: 1
.acuityplatform.com/ Name: auid
Value: 627776628284
.acuityplatform.com/ Name: aum
Value: "OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqANvqNdXNlck1hdGNoaW5nSWTMkWxhc3REcm9wVGltZU1pbGxpcyUBPmIJD22gmGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAT5iCQ9toI90aGlyZFBhcnR5VXNlcklkIfv7hnZlcnNpb27C+w=="
.owneriq.net/ Name: p2
Value: pmc
.owneriq.net/ Name: si
Value: Q6919554241026313953P
.owneriq.net/ Name: pmc
Value: 1
.w55c.net/ Name: wfivefivec
Value: DyLVqr8t1MTGFy5
.mathtag.com/ Name: uuid
Value: 17d961ac-1ae0-4000-b6db-9706d9b036cb
.w55c.net/ Name: matchpubmatic
Value: 5
.bidr.io/ Name: bito
Value: AADRPU7DWDYAAC1tRSs1sA
.bidr.io/ Name: bitoIsSecure
Value: ok
.adnxs.com/ Name: uuid2
Value: 7205020425431634120
.inmobi.com/ Name: idsp_c
Value: 3e303838-ca53-42df-8019-95c7b3b85253
.pubmatic.com/ Name: KRTBCOOKIE_218
Value: 4056-Yawa4AAJpMVYSwBG&KRTB&22978-Yawa4AAJpMVYSwBG&KRTB&23194-Yawa4AAJpMVYSwBG&KRTB&23209-Yawa4AAJpMVYSwBG
.pubmatic.com/ Name: PUBMDCID
Value: 2
.pubmatic.com/ Name: KRTBCOOKIE_469
Value: 8273-627776628284
.pubmatic.com/ Name: KRTBCOOKIE_860
Value: 16335-xswp1o64ToFOAZv37ofaZSV4zbQ
.pubmatic.com/ Name: KRTBCOOKIE_107
Value: 1471-uid:DyLVqr8t1MTGFy5
.pubmatic.com/ Name: KRTBCOOKIE_1003
Value: 22761-b6b28f1a-556d-11ec-a2e0-2e68efb6964a
.pubmatic.com/ Name: KRTBCOOKIE_377
Value: 6810-0a060ae1-17dc-465b-b9b3-37e0e67725c6&KRTB&22918-0a060ae1-17dc-465b-b9b3-37e0e67725c6&KRTB&23031-0a060ae1-17dc-465b-b9b3-37e0e67725c6
.pubmatic.com/ Name: KRTBCOOKIE_80
Value: 16514-CAESEDEgAIYuA8A0YTTZ8reLelQ&KRTB&22987-CAESEDEgAIYuA8A0YTTZ8reLelQ&KRTB&23025-CAESEDEgAIYuA8A0YTTZ8reLelQ
.simpli.fi/ Name: suid
Value: C65D11E4B81E46FF927733811942FFDC
.pubmatic.com/ Name: KRTBCOOKIE_1233
Value: 23223-3e303838-ca53-42df-8019-95c7b3b85253&KRTB&23266-3e303838-ca53-42df-8019-95c7b3b85253&KRTB&23285-3e303838-ca53-42df-8019-95c7b3b85253
.pubmatic.com/ Name: KRTBCOOKIE_286
Value: 5193-Q6919554241026313953&KRTB&22521-Q6919554241026313953
.postrelease.com/ Name: visitor
Value: 0cacb15f-044f-4edf-a172-33798446c9bc
.postrelease.com/ Name: status
Value: 0
.investingchannel.com/ Name: ic_uid
Value: af946ccd-d105-4d5c-b216-fc71fdc51eb5
.turn.com/ Name: uid
Value: 2848199581176410271
.ipredictive.com/ Name: cu
Value: b6d19fed-556d-11ec-9a2f-0ff9f1b4f0e7|1638669024863
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005%22%7D
.pubmatic.com/ Name: KRTBCOOKIE_594
Value: 17107-RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005
.pubmatic.com/ Name: KRTBCOOKIE_27
Value: 16735-uid:473961ac-1ae0-4c00-8c08-33debe008775&KRTB&16736-uid:473961ac-1ae0-4c00-8c08-33debe008775&KRTB&23019-uid:473961ac-1ae0-4c00-8c08-33debe008775&KRTB&23114-uid:473961ac-1ae0-4c00-8c08-33debe008775
.sitescout.com/ Name: ssi
Value: a48c0117-3963-461b-83ef-96e2c9bd2263#1638669025099
.mxptint.net/ Name: mxpim
Value: R1D531_E7995223_281F66E4D.1.000000000000000061AC1AE1
www.bleepingcomputer.com/ Name: cto_bidid
Value: bZIb519oRzMlMkZ2T29ySGdOZ0pJVlgyNFNOUENIN2glMkZJakptTmpmclBCJTJCQSUyRnRSU2lLQU5qajlib1laUXJEZkRsQWg2Mnh5JTJGakZTeCUyQnowd2d4VXFETHhGQkZaV21ud3JmTFlKOFV0OUJuN2c4JTJCZlFBJTNE
www.bleepingcomputer.com/ Name: cto_bundle
Value: G5ON-F8zZDByaDZpT1hyekxZWXR4Y0tBNU5rZDJQS3FJYSUyRjFNaTZVVFJVb1N5OUhPJTJGcXNjVVEwRFhUM3pEVFhxVHpReU84ZHB4SkFRNW1DZm94Um1xbEp3N1UlMkZadHg5JTJGc09DMHhBaiUyQk9JYjE2VmJtalhydXZiUDI0WWd6aHc1TkpFS2k
.pubmatic.com/ Name: KRTBCOOKIE_148
Value: 19421-uid:C65D11E4B81E46FF927733811942FFDC
.quantserve.com/ Name: mc
Value: 61ac1ae1-27841-94e57-ae49c
.pubmatic.com/ Name: KRTBCOOKIE_279
Value: 22890-b6d19fed-556d-11ec-9a2f-0ff9f1b4f0e7&KRTB&23011-b6d19fed-556d-11ec-9a2f-0ff9f1b4f0e7
.pubmatic.com/ Name: KRTBCOOKIE_22
Value: 14911-2848199581176410271
.yahoo.com/ Name: APID
Value: UPb6b4c899-556d-11ec-9f09-0e98ce530e37
.pippio.com/ Name: did
Value: of55VFzqkL2gGsqv
.pippio.com/ Name: didts
Value: 1638669025
.pippio.com/ Name: nnls
Value:
.pubmatic.com/ Name: KRTBCOOKIE_57
Value: 22776-7205020425431634120
.pub.network/ Name: _fsuid
Value: 1e6404a0-9b14-4c3b-b43e-7a343e00aac0
.pubmatic.com/ Name: KRTBCOOKIE_52
Value: 22772-R1D531_E7995223_281F66E4D&KRTB&23092-R1D531_E7995223_281F66E4D
.pubmatic.com/ Name: KRTBCOOKIE_153
Value: 1923-D4eL2AjXj4oUhN2DDYfHgg3T34wU14-PANUUCyfc&KRTB&19420-D4eL2AjXj4oUhN2DDYfHgg3T34wU14-PANUUCyfc&KRTB&22979-D4eL2AjXj4oUhN2DDYfHgg3T34wU14-PANUUCyfc
.pubmatic.com/ Name: KRTBCOOKIE_32
Value: 11175-AAAGdRmaSRjYIgNw_dHNAAAAAAA&KRTB&22713-AAAGdRmaSRjYIgNw_dHNAAAAAAA&KRTB&22715-AAAGdRmaSRjYIgNw_dHNAAAAAAA
.bidswitch.net/ Name: tuuid
Value: 91fae357-6d96-49d0-85ee-50af585ffd28
.bidswitch.net/ Name: c
Value: 1638669025
.bidswitch.net/ Name: tuuid_lu
Value: 1638669025
.pubmatic.com/ Name: KRTBCOOKIE_1199
Value: 23175-0000008DA3C2A7C6
.pubmatic.com/ Name: KRTBCOOKIE_188
Value: 3189-a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341
.amazon-adsystem.com/ Name: ad-id
Value: AxZUcjb1gk7Ugk1cYaGCj_4
.amazon-adsystem.com/ Name: ad-privacy
Value: 0
www.bleepingcomputer.com/ Name: _ntv_uid
Value: 0cacb15f-044f-4edf-a172-33798446c9bc
.pippio.com/ Name: pxrc
Value: COG1sI0GEgQIAhAAEgYI7OsBEAA=
.taptapnetworks.com/ Name: SONATA_ID
Value: csonata_7cbb47e2-9baa-4929-abd4-16d57c47f86d
.linksynergy.com/ Name: rmuid
Value: 44c7da8c-5e50-4546-92e6-57ef95acf025
.linksynergy.com/ Name: icts
Value: 2021-12-05T01:50:25Z
.pubmatic.com/ Name: KRTBCOOKIE_466
Value: 16530-91fae357-6d96-49d0-85ee-50af585ffd28
.adaptv.advertising.com/ Name: migrated2y
Value: "1"
.casalemedia.com/ Name: CMID
Value: Yawa4gBzq4Mi9uUbPgLGCwAA
.casalemedia.com/ Name: CMPS
Value: 151
.sharethrough.com/ Name: stx_user_id
Value: 8169d5dd-0a59-4fc8-aa31-a786caffc331
.bleepingcomputer.com/ Name: __gads
Value: ID=e3d418217285c23d:T=1638669023:S=ALNI_MZhsysp5JVp7yRdKVmj6um0u9FwgA
.id5-sync.com/ Name: 3pi
Value:
.lijit.com/ Name: ljt_reader
Value: 1877215a80f219747d186ee2
.casalemedia.com/ Name: CMPRO
Value: 020
.3lift.com/ Name: tluid
Value: 13493460417766279847
.yieldmo.com/ Name: yieldmo_id
Value: g94700eb95166f3fb46c%7C1638669026155%7C0%7C
.lijit.com/ Name: ljtrtbexp
Value: eJyrVjI0U7IyNDO2tDC3MDMy01GyMEHjo8ubo%2FJNUeRrAaefELI%3D
.smartadserver.com/ Name: pid
Value: 3167836846926884602
.id5-sync.com/ Name: id5
Value: befa894c-ca8f-39ae-a34b-ad1903a9d871#1638669017414#2
.id5-sync.com/ Name: cf
Value:
.id5-sync.com/ Name: cip
Value:
.id5-sync.com/ Name: cnac
Value:
.id5-sync.com/ Name: car
Value:
.id5-sync.com/ Name: gdpr
Value:
.id5-sync.com/ Name: callback
Value:
.krxd.net/ Name: _kuid_
Value: OhYsC-3I
.contextweb.com/ Name: V
Value: BtO9pQA2TEDw
.contextweb.com/ Name: pb_rtb_ev
Value: 3-1auk|7TZ.0.1
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: 68b9dedfb35e25af
.mfadsrvr.com/ Name: tuuid
Value: 2c55b0ff-e26e-43d5-94da-2bb3ffc74b65
.mfadsrvr.com/ Name: c
Value: 1638669026
.mfadsrvr.com/ Name: tuuid_lu
Value: 1638669026
.adotmob.com/ Name: uid
Value: 0707220438307035bba052c2
.adotmob.com/ Name: uuid
Value: 0707220438307035bba052c2
.adotmob.com/ Name: partners
Value: IX%3A1638669026833
.creativecdn.com/ Name: u
Value: ie65HF3Q4cl5eT0MwBbs
.creativecdn.com/ Name: ts
Value: 1638669026
.sitescout.com/ Name: _ssuma
Value: eyI0NSI6MTYzODY2OTAyNTQ1MCwiNCI6MTYzODY2OTAyNjcwNywiNDgiOjE2Mzg2NjkwMjY3MDcsIjM5IjoxNjM4NjY5MDI2NzA3LCI0MSI6MTYzODY2OTAyNjkwMX0
.ads.yieldmo.com/ Name: ptrt
Value: 0a060ae1-17dc-465b-b9b3-37e0e67725c6
.ads.yieldmo.com/ Name: ptrstk
Value: xswp1o64ToFOAZv37ofaZSV4zbQ
.ads.yieldmo.com/ Name: ptrpp
Value: BtO9pQA2TEDw
.lijit.com/ Name: _ljtrtb_84
Value: c:260803f49fc670d26b7a8c97ae1c7d30
.exelator.com/ Name: EE
Value: "4178fcf8274e30acf5f005583da1b3e5"
.lijit.com/ Name: _ljtrtb_87
Value: 2c55b0ff-e26e-43d5-94da-2bb3ffc74b65
.exelator.com/ Name: ud
Value: "eJxrXxzq6XKLQcHE0NwiLTnNwsjcJNXYIDE5zTTNwMDU1MI4JdEwyTjVdHFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq0yNJsSX5RZvoiZ8fFRSlpDItKik8F7zuiCgB72CoM"
.lijit.com/ Name: _ljtrtb_86
Value: ie65HF3Q4cl5eT0MwBbs
.tapad.com/ Name: TapAd_TS
Value: 1638669027255
.tapad.com/ Name: TapAd_DID
Value: 29f9ed82-4913-42eb-955c-54e8ffbbf5a9
.ads.yieldmo.com/ Name: ptrbsw
Value: 91fae357-6d96-49d0-85ee-50af585ffd28
.eyeota.net/ Name: SERVERID
Value: 19079~DM
pool.admedo.com/ Name: tuuid
Value: d884b705-ec2e-4c88-bcb6-5002f47980a1
pool.admedo.com/ Name: c
Value: 1638669027
pool.admedo.com/ Name: tuuid_lu
Value: 1638669027
global.ib-ibi.com/ Name: ASP.NET_SessionId
Value: 5pcq5mozyp3xjxtwwzwb0wp5
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value:
.doubleclick.net/ Name: DSID
Value: NO_DATA
.lijit.com/ Name: _ljtrtb_16
Value: a48c0117-3963-461b-83ef-96e2c9bd2263-61ac1ae1-4341
ib.mookie1.com/ Name: ASP.NET_SessionId
Value: dussx5j3ujprvwrdwf4nsyin
.ib.mookie1.com/ Name: ibkukiuno
Value: s=550ac902-4d41-42c4-99cf-84e05e837de4&h=&v=0&l=-8585629378576175016&op=&hl=0&vlu=0&tcs=1&dcc=-8585629378576175016
.ib.mookie1.com/ Name: ibkukinet
Value: 628673972=-8585629378576175016
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005%22%2C%22nxtrdr%22%3Afalse%7D
.lijit.com/ Name: ljtrtb
Value: eJwVjT0OgiEQRO9C7SbsDwt8pYWxsTDxAuwCiYmdhYXx7kI7783MN6CGIzQpHhEzcFUGUTQoPCZUHeTVOtGKFZtjGwjCguEUiqymH6SxRJ5Sp2uOndRyK17zMj13jtvcH8%2Bh6Xrhu%2FgrjUe8fc723iwvRp6SxTlhkI613xNU6Q3IjOf0LKYp%2FP567ywW
.lijit.com/ Name: _ljtrtb_56
Value: RX-dcbd78ba-409c-4a89-959f-d5740b5432ce-005
.lkqd.net/ Name: lkqdid
Value: ebbTGjkTbaw
.lkqd.net/ Name: lkqdidts
Value: 1638669028
.lkqd.net/ Name: sr59
Value: 1|CAESEDkk0VHuxKqsJbB1tPVEyMg|1638669029
.insightexpressai.com/ Name: TID
Value: 00000000-0000-0027-937e-fc1638669029
.insightexpressai.com/ Name: IXAI55021
Value: FTF
.insightexpressai.com/ Name: DW_Time
Value: 1638669029
.insightexpressai.com/ Name: DW
Value: 00000000-0000-0027-937e-fc1638669029
.adnxs.com/ Name: anj
Value: dTM7k!M41.D>6NRF']wIg2E?gts0G3!]tbPl1M>e)ZlrFUfJ+tGXxomAHAJgZ.^0*Z:YeLXAMr[EUplVb#qix+lc3d*bpRz*qF1`*b`[8*7U?f
.teads.tv/ Name: tt_viewer
Value: 5db8fc72-8d80-4012-97fb-f99309790dec
.pubmatic.com/ Name: SyncRTB3
Value: 1639094400%3A216%7C1639958400%3A35%7C1641254400%3A224%7C1639872000%3A220_204_240_5_57_99_54_231_234_48_71_189_238_81_104_233_7_96_178_222_176_13_239_55_56_21_8_166_165_3_22%7C1643846400%3A69%7C1639526400%3A63%7C1639267200%3A15_223_38_2
.taboola.com/ Name: t_gid
Value: 1fda3fd9-8494-4066-aca3-a092cc97baf1-tuct8a5a066
ads.playground.xyz/ Name: connect.sid
Value: s%3AjG5HvuxrW_nYYR9L-LVDZxxmdPjvOL01.AFK8Pp30jJAjY62tjMiDDUaSLVrXdsIBIwUhVe1H7tg
.pubmatic.com/ Name: KRTBCOOKIE_391
Value: 22924-1452678799778604270&KRTB&23263-1452678799778604270
.pubmatic.com/ Name: KRTBCOOKIE_1278
Value: 23329-86761b6e-766b-4453-ab67-bab011547e12
.pubmatic.com/ Name: PugT
Value: 1638669030
beacon.lynx.cognitivlabs.com/ Name: UID
Value: 51be4f23-aef6-49ff-aea7-33d2bf749ef8
.adingo.jp/ Name: ID
Value: d3858596a99a2841bc21e7f8538711ee
.innovid.com/ Name: uuid
Value: 5ac6ee31-3c9a-4fc9-a719-1bb53635a54b-20211204 20:50:30
.mookie1.com/ Name: id
Value: 10595844025895915709
.mookie1.com/ Name: mdata
Value: 1|10595844025895915709|1638669030207
.mookie1.com/ Name: ov
Value: ac1823f3a650e58bad58b13fdbc789c1
.addthis.com/ Name: na_tc
Value: Y
.dlx.addthis.com/ Name: na_rn
Value: 0
.dlx.addthis.com/ Name: na_sr
Value: 20211205
.dlx.addthis.com/ Name: na_srp
Value: 3614
.dlx.addthis.com/ Name: na_sc_e
Value: 0
.agkn.com/ Name: ab
Value: 0001%3AmB%2FR5J13cQoS4w5ABP1JFctAyyDUo7%2F7
.agkn.com/ Name: u
Value: C|0CEApPtdmKT7XZgAAAAAAAQ13AQCAAQpAAAAAAA
.c.appier.net/ Name: _auid
Value: 2DE6u0asAquivNV75hqsYQ
.pubmatic.com/ Name: KRTBCOOKIE_904
Value: 16787-2DE6u0asAquivNV75hqsYQ&KRTB&23130-2DE6u0asAquivNV75hqsYQ
www.bleepingcomputer.com/ Name: _lr_retry_request
Value: true
www.bleepingcomputer.com/ Name: _lr_env_src_ats
Value: false
.v.ssp.yahoo.com/ Name: adaptv_unique_user_cookie
Value: "4904610070270641268__TIME__2021-12-04+17%3A50%3A30"
.openx.net/ Name: pd
Value: v2|1638669031|vMbwgag2gKvPhEkWgyiK
.casalemedia.com/ Name: CMST
Value: Yawa4mGsGucA
.crwdcntrl.net/ Name: _cc_dc
Value: 0
.crwdcntrl.net/ Name: _cc_id
Value: 71b1a4a507cbbdd9ba86c76fc94fdd49
.crwdcntrl.net/ Name: _cc_cc
Value: "ACZ4XmNQMDdMMkw0STQ1ME9OSkpJsUxKtDBLNjdLS7Y0SUtJMbFkAILENVLPQTQUAABxaQu2"
.crwdcntrl.net/ Name: _cc_aud
Value: "ABR4XmNgYGBIXCP1HEhBAQAZQQIP"
.33across.com/ Name: 33x_ps
Value: u%3D1749377677925%3As1%3D1638669031200%3Ats%3D1638669031200
.media.net/ Name: visitor-id
Value: 2816706317397284000V10
.bleepingcomputer.com/ Name: panoramaId_expiry
Value: 1638755431178
.bleepingcomputer.com/ Name: _cc_id
Value: 71b1a4a507cbbdd9ba86c76fc94fdd49
.tynt.com/ Name: uid
Value: Ko4iVGGsGucyKSonHT5v0w==
.tynt.com/ Name: pids
Value: %5B%7B%22p%22%3A%227daaa56bb0%22%2C%22f%22%3A1%2C%22ts%22%3A1638669031325%7D%2C%7B%22p%22%3A%2224c05c7b76%22%2C%22f%22%3A1%2C%22ts%22%3A1638669031325%7D%2C%7B%22p%22%3A%22bac1bc34e2%22%2C%22f%22%3A1%2C%22ts%22%3A1638669031325%7D%2C%7B%22p%22%3A%22d26852f088%22%2C%22f%22%3A1%2C%22ts%22%3A1638669031325%7D%2C%7B%22p%22%3A%2222833ea406%22%2C%22f%22%3A1%2C%22ts%22%3A1638669031325%7D%2C%7B%22p%22%3A%22f9a4a8fd15%22%2C%22f%22%3A1%2C%22ts%22%3A1638669031325%7D%5D
.c.bing.com/ Name: MR
Value: 0
.bing.com/ Name: MUID
Value: 02E1067F086C609A267D177B09BA6119
.yahoo.com/ Name: APIDTS
Value: 1638669031
beacon.lynx.cognitivlabs.com/ Name: ss
Value: 8juMXkQUMnAgRgm1VL8M9FurxPFfv1lrdiViludLnbAGZzaJU%2FgwHtuhcbXg0TOsAkRd%2FLQmhtpreMWH8dLV%2Bw%3D%3D
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: lidc
Value: "b=VGST07:s=V:r=V:a=V:p=V:g=2228:u=1:x=1:i=1638669031:t=1638755431:v=2:sig=AQEx-h7vEkCYwAFZbuQ_oZg0-A0-8Z6f"
.linkedin.com/ Name: li_sugr
Value: 8528f9ba-61f2-49a6-8781-6631118dab13
.linkedin.com/ Name: bcookie
Value: "v=2&13fdfe84-fbbf-4abf-898a-2dd25d7a72ab"
id.sharedid.org/ Name: sharedid
Value: 01FP44J5YK9CZ5A0VW4N1WBNVE
.w55c.net/ Name: matchmedianet
Value: 5
.mfadsrvr.com/ Name: ssh
Value: !medianet,1638669031!sovrn,1638669026
.criteo.com/ Name: uid
Value: 36f7a3cb-90f4-4a98-9dde-87e0b14996bf
.rlcdn.com/ Name: rlas3
Value: 53xNUwSG/7U5ggJ8m8IIYQoGhRd/+iK27dr6mzi+088=
www.bleepingcomputer.com/ Name: cookie
Value: %7B%22id%22%3A%2201FP44J5YK9CZ5A0VW4N1WBNVE%22%2C%22ts%22%3A1638669031489%7D
.openx.net/ Name: univ_id
Value: 537072971|0a060ae1-17dc-465b-b9b3-37e0e67725c6|1638669031485520
.zemanta.com/ Name: zuid
Value: MOcTeHahRHcu11lsoSet
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNrIwNDA2NDM1NTAyNbMwNLW0NBXiM9Q1Ds_0iXQtD3ctcs4GAJdECH0lAAAA
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNrIwNDA2NDM1NTAyNbMwNLW0NBXiM9Q1Ds_0iXQtD3ctcs6W4jU0M7YwM7MEKjQxswAAsq9mijQAAAA
.adsby.bidtheatre.com/ Name: __kuid
Value: 9219cd41-64a7-41a6-9776-2ff0599ff330.407883031
.media.net/ Name: data-rk
Value: 2810316550256815995~~8
.deepintent.com/ Name: CDIPARTNERS
Value: %7B%22113%22%3A%2220211205%22%2C%22129%22%3A%2220211205%22%7D
.quantserve.com/ Name: d
Value: ECQBFQHxJIEO-TC_vLEA
.media.net/ Name: data-c-ts
Value: 1638669031
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAAAFvFwmtoZmxhZmZpYGxoamDcJIjMNzcCALaBgk4gAAAA
.media.net/ Name: data-c
Value: 36f7a3cb-90f4-4a98-9dde-87e0b14996bf~~1
.media.net/ Name: data-mm
Value: 17d961ac-1ae0-4000-b6db-9706d9b036cb~~8
.media.net/ Name: data-ttd
Value: 0a060ae1-17dc-465b-b9b3-37e0e67725c6~~1
.media.net/ Name: data-g
Value: CAESEClov87a3B7yE4YtjXppqj8~~8
.media.net/ Name: data-xu
Value: DyLVqr8t1MTGFy5~~8
.media.net/ Name: data-mf
Value: 2c55b0ff-e26e-43d5-94da-2bb3ffc74b65~~1
.creative-serving.com/ Name: tuuid
Value: 70a2554c-2118-4ebb-9f52-225af99a73ea
.creative-serving.com/ Name: c
Value: 1638669031
.creative-serving.com/ Name: tuuid_lu
Value: 1638669031
.tribalfusion.com/ Name: ANON_ID
Value: a4nu7qSZdIiiSTnMSYhkbIeWVjZaFgYow5K4KSZdHZasO80nrkXCIRSInHS2GiWFLnXNjZbDLo1w1Nnwux4fM6qODop2dZaZcS2MWPaJQZcHxDOv
.media.net/ Name: data-amb
Value: 2848199581176410271~~8
.media.net/ Name: data-co
Value: AAAGdXSNZEPasQMAgdc2AAAAAAA~~8
.admixer.net/ Name: am-uid
Value: 1de77307d007487fbf82d47b61a3cc6d
.adsymptotic.com/ Name: U
Value: d074e30a4ca1c37d1d2cc2837eff8fd0
.dotomi.com/ Name: DotomiTest
Value: 230a0eb50584122d
ads.avct.cloud/ Name: uuid
Value: 4a315f5b-792e-42e5-94f2-3f23d680431b
.media.net/ Name: data-ze
Value: MOcTeHahRHcu11lsoSet~~8
.rubiconproject.com/ Name: audit
Value: 1|jBiBxffLxiwAbVUkpoxA3eIUKPfHLCwX6JEM8hp+araB+d55h43RBivVLP3k32vu269ix+tr/4UiZ07GJqnMno4BjqNRGrmz
.demdex.net/ Name: demdex
Value: 70979057434270277790619597293448924580
.analytics.yahoo.com/ Name: IDSYNC
Value: "18z8~21wp:187s~21wp:175w~21wp:18za~21wp:190u~21wp:191l~21wp:18ym~21wp:173n~21wp"
.casalemedia.com/ Name: CMRUM3
Value: 0d61ac1ae205a00&2761ac1ae227600a060ae1-17dc-465b-b9b3-37e0e67725c6&da61ac1ae72760&3961ac1ae705a0&6961ac1ae205a00&4161ac1ae705a0AAAGdc-Aay49lQMcVRAGAAAAAAA&2d61ac1ae52760CAESEEv7vNCflkDDFkQXzGixrMs&ce61ac1ae205a0&0461ac1ae727602848199581176410271&b061ac1ae72760di_fe5a87ec034349adb9d1d&c361ac1ae22760av-a24e3de0-2028-4cfb-a8c7-c735d7200895&8361ac1ae7276018072662301221777215&5a61ac1ae705a0&2e61ac1ae705a0&5161ac1ae705a0&0361ac1ae705a0&4961ac1ae705a0&f161ac1ae205a0&0861ac1ae705a0&e661ac1ae72760&5861ac1ae705a0&8261ac1ae7a8c0
.media.net/ Name: data-bs
Value: 91fae357-6d96-49d0-85ee-50af585ffd28~~1
.dpm.demdex.net/ Name: dpm
Value: 70979057434270277790619597293448924580
.rlcdn.com/ Name: pxrc
Value: COG1sI0GEgUI6AcQABIFCOhHEAASBgi66gEQBg==
.districtm.io/ Name: _dm_uid
Value: eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAwLCJ1c3IiOiJxZ2FRQTdJR0d6SXhjVmRMUTNOWVIxWndibmxvTlc0NFZIWjBZMGhXUVV4VmJMb0dJQWlYVGhJYlFVRkJSMlJwY0hwbFpVSldhMmRPT0hZMmNITkJRVUZCUVVGQnVnWVZDS0JPRWhCWllYZGhORUZCU25CTlZsbFRkMEpIdWdZYkNLbE9FaFpCUVVSU1VGVTNSRmRFV1VGQlF6RjBVbE56TVhOQnVnWWdDS3BPRWh0NGMzZHdNVzgyTkZSdlJrOUJXbll6TjI5bVlWcFRWalI2WWxHNkJoa0lxMDRTRkdsbE5qVklSak5STkdOc05XVlVNRTEzUW1KenVnWURDSzVPdWdZRENMQk91Z1pRQ01OT0VrdDVMWFkyYVVFNU5FWkZNblZIWjB4SU5VMTJOVEJQWkhwTU5GSnhRbk16TTNSemZrRitWVkJpTm1JMFl6ZzVPUzAxTlRaa0xURXhaV010T1dZd09TMHdaVGs0WTJVMU16QmxNemU2QmhnSXlFNFNFekk0TVRBek1UWTFOVEF5TlRZNE1UVTVPVFc2QmpFSXlVNFNMSGt0WTE5RWNtWjJVa1V5ZFVkcFRuaDZjbUl4VDJaeGQwbGZURFJSV2xWT1RrMDBXalU0VlhwckxYNUJ1Z1lwQ010T0VpUTRNVFk1WkRWa1pDMHdZVFU1TFRSbVl6Z3RZV0V6TVMxaE56ZzJZMkZtWm1Nek16RT0iLCJpYXQiOjE2Mzg2NjkwMzF9.XUbtbKH_PMypEy0vISOZ6fd0zznCNLmbVpeWmqlDyYgbOZvsUfcS2pKbTgxFi6DS1QwpzAX9LB7yB80_hWURvw
.pubmatic.com/ Name: SPugT
Value: 1638669032
.ads.pubmatic.com/ Name: KCCH
Value: YES
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 3
.pubmatic.com/ Name: pi
Value: 156696:4
.pubmatic.com/ Name: DPSync3
Value: 1639872000%3A219_221_228_236_197_201%7C1639267200%3A164%7C1638748800%3A174
.ads.pubmatic.com/ Name: pubsyncexp
Value: 1638690634362
.onaudience.com/ Name: done_redirects147
Value: 1
.onaudience.com/ Name: cookie
Value: 8cad49ac1da69e7c
.fiftyt.com/ Name: cs
Value: MTYzODY2OTAzNHxEdi1CQkFFQ180SUFBUkFCRUFBQUJQLUNBQUE9fCD-9hN5zvOg9Fov3DxSFlHNmtPflrmYOk_GI60LIUli
.fiftyt.com/ Name: fifid
Value: 556e8bcc-7f96-480f-6469-40b2f13f8071
.adsrvr.org/ Name: TDCPM
Value: CAESFwoIcHVibWF0aWMSCwiK0dSy9OabOhAFEhYKB3J1Ymljb24SCwjGro2z9OabOhAFEhMKBGtydXgSCwj88ZPK9OabOhAFEhQKBW9wZW54EgsIloLc8vTmmzoQBRgBIAEoAjILCOLJn72L55s6EAU4AVoHeGtzdzlsYWAC
.onaudience.com/ Name: done_redirects219
Value: 1
io.narrative.io/ Name: io.narrative.guid.v2
Value: bc8d5d20-556d-11ec-96af-0e9f37bd45a9
.fiftyt.com/ Name: fppm
Value: 20211205015034
.zeotap.com/ Name: zc
Value: 737d0c9c-3993-490c-40e2-583e4e214dbf
.zeotap.com/ Name: zsc
Value: %3E%F5%C2%1F%3A%98%BA%B8T%2FZ%DD%C0q%90%EA%B60%BF%E4%2Cs%89%18%DF%91n%A3%8F%5D%E2%BFgu%A1%C8%F2W%40%21%AF%3E%A1%88%EB%F5%AC%F9%E9%EE%E9%146%8D%C4%D0%14fW%04%8B%9E%E1%C6%F1%249%5Bd%D22%00%FE%DD%2B%7F%FCMB%A8%C8%E0M

16 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
network error URL: https://id5-sync.com/i/882/8.gif?id5id=ID5*dWFAwFY04z_mUPxzUoTYiNX0tzwFFpM_VF37igydwjwA5QhPLSD5o1Swnj08Tk6UAOh9aiVnveTVVCsBXDpuZgDpHSEGeGBDjBgTBiC7caQA6olNF9n_KskrpSCHOAQXAOu7wa6YAvaE6r4dOmeh9QDtFQX-qPqtAef0DFG5fq0A92cgDjw_kZZsNLm_ReZrAPlIqvfbKm0DsaGNtJaIwgD7GOUGa99XsKwZnAZG_DEA_uBbUJVVsEzFSg01jWzTAQHwa2AumL7_E8EqYlptpwEEsFGdLXq5e0Q-23lAx2YBCPmw7yxYgmG1s6Okf_HvAQs6IOkEGxGYI-di1tLVxgEOfweOP2j6m0ts3kNke70BEeoIg2f2NZ_BVB_yO_1PARQXubUMoIgdD3jCa-cqhgFC6XkFdBrSh5wMHs4tOAkBRGJaAOuIjE8DzHDSFK75AUeRkulYLZSzlzkvdsIt2gFOglo7kIEDimTlus2Ev8MBURu6W0SkzWmOv23m2IS7&o=api&gdpr_consent=undefined&gdpr=0
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=7205020425431634120&pn_id=an
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
other warning URL: https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs(Line 2)
Message:
Unrecognized feature: 'attribution-reporting'.
other warning URL: https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs(Line 2)
Message:
Unrecognized feature: 'attribution-reporting'.
other warning URL: https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs(Line 2)
Message:
Unrecognized feature: 'attribution-reporting'.
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs&google_cver=1&google_push=AYg5qPIDSZFf3CgEOYwaM61WL_s14Rg4D6N2JUXTFmYa362SEZszmQB4Uu-AavOwkDfumRTSlj-uOf-UeMuz0uK_DDa61HILsmK-
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network error URL: https://api.rlcdn.com/api/identity/envelope?pid=1258
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AYg5qPJXY5ekQTNDRrI-6UVLzszgfHPDEPrJuzw-mAAsTJiyXeNNiemBCJIM3IQzrxYSgwhyW820n42juZKMZs06lBvfSsijYak&google_hm=d3858596a99a2841bc21e7f8538711ee
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yawa4gBzq4Mi9uUbPgLGCwAAABQAAAAB&google_push=AYg5qPKMo8FKatbhM67WcYRYlXTVizyQpRUEqsDbtGQkPPbmGniiwhQsPR2_vjPUwVEhIJILIweo4scvjAdHpm8bzGZfeQ0L5vM&google_cver=1&google_gid=CAESEPajvq0yqZmcpldUpZkoKPs
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
other warning URL: https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs(Line 2)
Message:
Unrecognized feature: 'attribution-reporting'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

05f8ffb7d9c96a871571cb363138f245.safeframe.googlesyndication.com
33across-match.dotomi.com
a.pub.network
a.tribalfusion.com
aa.agkn.com
abs-0.twimg.com
acdn.adnxs.com
acds.prod.vidible.tv
ad-delivery.net
ad.doubleclick.net
ad.turn.com
ads-ec.v.ssp.yahoo.com
ads.adaptv.advertising.com
ads.avct.cloud
ads.creative-serving.com
ads.playground.xyz
ads.pubmatic.com
ads.yieldmo.com
adservice.google.ca
adservice.google.com
ag.innovid.com
aktrack.pubmatic.com
amazon-tam-match.dotomi.com
aorta.clickagy.com
ap.lijit.com
api-public.addthis.com
api.btloader.com
api.floors.dev
api.rlcdn.com
b1sync.zemanta.com
bc-ssb-cle.springserve.com
beacon.krxd.net
beacon.lynx.cognitivlabs.com
beacon.walmart.com
bh.contextweb.com
biddr.brealtime.com
btloader.com
btlr.sharethrough.com
c.amazon-adsystem.com
c.bing.com
c.pub.network
c1.adform.net
c21lg-d.media.net
c2shb.ssp.yahoo.com
capi.connatix.com
casale-match.dotomi.com
cd.connatix.com
cdn-ssl.vidible.tv
cdn.ampproject.org
cdn.districtm.io
cdn.firstimpression.io
cdn.id5-sync.com
cdn.krxd.net
cdn.syndication.twimg.com
cds.connatix.com
ce.lijit.com
ck.connatix.com
cks.connatix.com
cm.adgrx.com
cm.g.doubleclick.net
cms-xch-chicago.33across.com
cms-xch.33across.com
cms.quantserve.com
consumer.krxd.net
contextual.media.net
core.iprom.net
creativecdn.com
cs.lkqd.net
cs.media.net
csync.loopme.me
d.adroll.com
d.agkn.com
d.pub.network
de.tynt.com
dggaenaawxe8z.cloudfront.net
dis.criteo.com
districtm-match.dotomi.com
dmx.districtm.io
dmx.us-east-34.districtm.io
dpm.demdex.net
dsum-sec.casalemedia.com
dsum.casalemedia.com
e.dlx.addthis.com
eb2.3lift.com
ecdn.analysis.fi
ecdn.firstimpression.io
eus.rubiconproject.com
fastlane.rubiconproject.com
fei.pro-market.net
fonts.googleapis.com
fonts.gstatic.com
freestar-d.openx.net
freestar-io.videoplayerhub.com
global.ib-ibi.com
gocm.c.appier.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
grid.bidswitch.net
gum.criteo.com
hb.emxdgt.com
hbopenbid.pubmatic.com
hbx.media.net
htlb.casalemedia.com
ib.adnxs.com
ib.mookie1.com
id.crwdcntrl.net
id.rlcdn.com
id.sharedid.org
id5-sync.com
idsync.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
imasdk.googleapis.com
img.connatix.com
inv-nets.admixer.net
io.narrative.io
jadserve.postrelease.com
js-sec.indexww.com
loadm.exelator.com
m.addthis.com
match.adsby.bidtheatre.com
match.adsrvr.org
match.bnmla.com
match.deepintent.com
match.prod.bidr.io
match.sharethrough.com
match.taboola.com
medianet-match.dotomi.com
mug.criteo.com
mweb.ck.inmobi.com
mwzeom.zeotap.com
nep.advangelists.com
odr.mookie1.com
p.adsymptotic.com
p.rfihub.com
pagead2.googlesyndication.com
partner.googleadservices.com
partners.tremorhub.com
pbs.twimg.com
pghub.io
pippio.com
pixel-sync.sitescout.com
pixel-us-east.rubiconproject.com
pixel.advertising.com
pixel.onaudience.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.tapad.com
platform.twitter.com
pm.w55c.net
pmp.mxptint.net
pool.admedo.com
pr-bh.ybp.yahoo.com
prebid.media.net
ps.eyeota.net
pubmatic-match.dotomi.com
px.ads.linkedin.com
px.moatads.com
px.owneriq.net
rtb.adentifi.com
rtb.gumgum.com
rtb.mfadsrvr.com
rtb.openx.net
rules.quantcount.com
s.amazon-adsystem.com
s.ntv.io
s.tribalfusion.com
s0.2mdn.net
s7.addthis.com
s9.addthis.com
sb.scorecardresearch.com
secure-assets.rubiconproject.com
secure.adnxs.com
secure.cdn.fastclick.net
secure.insightexpressai.com
secure.quantserve.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
sonata-notifications.taptapnetworks.com
spl.zeotap.com
ssbsync-us.smartadserver.com
ssc-cms.33across.com
ssc.33across.com
ssum-sec.casalemedia.com
ssum.casalemedia.com
stags.bluekai.com
static.cloudflareinsights.com
storage.googleapis.com
sync-amz.ads.yieldmo.com
sync-pp.ads.yieldmo.com
sync-tm.everesttech.net
sync.1rx.io
sync.adotmob.com
sync.inmobi.com
sync.ipredictive.com
sync.mathtag.com
sync.resetdigital.co
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
sync.teads.tv
sync.technoratimedia.com
syndication.twitter.com
tag.escalated.io
tagan.adlightning.com
tags.rd.linksynergy.com
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
trc.taboola.com
trk.vidible.tv
uat5-a.investingchannel.com
um.simpli.fi
ums.acuityplatform.com
ups.analytics.yahoo.com
us-u.openx.net
us.creativecdn.com
usermatch.krxd.net
v1.addthisedge.com
vid-io-cle.springserve.com
vid.connatix.com
vid.springserve.com
visitor.fiftyt.com
vpaid.springserve.com
widgets.outbrain.com
www.bleepingcomputer.com
www.bleepstatic.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.reddit.com
x.bidswitch.net
z.moatads.com
cm.g.doubleclick.net
s7.addthis.com
trk.vidible.tv
104.16.190.66
104.17.120.107
104.18.99.194
104.20.60.209
104.244.42.136
104.244.43.131
104.26.13.6
104.36.115.109
104.36.115.111
104.36.115.113
104.36.115.114
104.45.178.220
107.178.246.49
107.178.254.65
129.159.70.95
13.225.205.105
13.225.214.70
13.225.63.15
13.226.37.62
130.211.23.194
142.250.65.194
142.250.81.230
142.251.41.2
146.20.128.205
151.101.129.140
151.101.130.133
151.101.193.108
151.101.2.137
151.101.2.49
151.101.65.44
151.101.66.133
151.101.66.137
156.154.202.36
159.65.196.12
169.197.150.8
172.105.232.22
173.231.178.116
18.157.70.90
18.159.151.182
18.213.185.73
184.29.128.213
184.29.129.73
184.50.205.90
185.167.164.39
185.184.10.30
185.184.8.65
195.5.165.20
198.148.27.139
199.127.204.142
199.187.193.179
199.38.167.129
20.72.149.136
20.88.207.242
2001:438:65:11::1690
2001:4998:14:800::1001
204.62.13.72
207.198.113.169
209.54.176.128
23.199.204.79
23.208.216.126
23.211.130.59
23.219.95.182
23.5.238.78
23.52.161.180
23.52.162.163
23.52.162.190
23.52.162.21
23.52.163.40
23.52.167.93
23.73.244.44
23.88.75.186
2600:1400:d:593::1ec4
2600:1901:0:8eee::
2600:1f18:445b:901:5dde:90cc:842c:e1f
2600:1f18:4e9:5a02:1f9d:78fd:b4f5:2185
2600:1f18:612b:4200:787a:99c3:22c2:11ca
2600:9000:21da:5400:19:fc2c:a140:93a1
2600:9000:21dd:4200:6:44e3:f8c0:93a1
2600:9000:21dd:8400:15:6f6c:b180:93a1
2602:803:c002:200::41
2606:2800:220:131d:1d30:1f1d:238b:1e56
2606:2800:220:1410:489:141e:20bb:12f6
2606:4700:10::6816:1957
2606:4700:20::681a:246
2606:4700:20::681a:78b
2606:4700:20::681a:8b
2606:4700:3039::6815:c076
2606:4700::6810:5e41
2606:4700::6812:c05
2607:f8b0:4006:806::2001
2607:f8b0:4006:806::2010
2607:f8b0:4006:807::200e
2607:f8b0:4006:808::2002
2607:f8b0:4006:80b::200a
2607:f8b0:4006:80c::2002
2607:f8b0:4006:80e::2003
2607:f8b0:4006:816::2002
2607:f8b0:4006:81c::2001
2607:f8b0:4006:81c::2002
2607:f8b0:4006:81d::2002
2607:f8b0:4006:822::2008
2607:f8b0:4006:822::200a
2607:f8b0:4006:823::2003
2607:f8b0:4006:823::2006
2607:f8b0:4006:824::2004
2620:100:a001::c
2620:109:c002::6cae:a0e
2620:112:f000:bbbb::11
2620:116:800b:21:61c0:eb61:c438:2f4e
2620:116:800b:21:ea23:7677:128a:8c9c
2620:1ec:c11::200
2a04:4e42:600::300
3.128.80.187
3.130.243.57
3.142.30.148
3.16.251.19
3.19.190.206
3.215.189.212
3.218.90.66
3.222.130.154
3.224.175.57
3.231.253.205
3.81.191.231
34.102.253.54
34.107.148.139
34.117.239.71
34.120.155.137
34.149.20.76
34.200.159.147
34.200.184.86
34.205.221.238
34.225.34.171
34.231.251.31
34.236.83.94
34.73.194.24
34.98.64.218
34.98.67.3
35.168.56.65
35.174.6.234
35.186.253.211
35.190.60.146
35.190.90.30
35.201.71.192
35.201.96.126
35.207.24.140
35.210.53.219
35.211.165.199
35.227.238.208
35.241.45.217
35.71.131.137
38.27.122.101
38.67.14.233
45.35.192.162
46.105.202.126
50.16.197.56
51.195.5.231
51.222.80.231
52.116.221.248
52.14.21.152
52.20.92.17
52.205.151.180
52.205.58.132
52.21.125.8
52.223.22.214
52.23.124.50
52.45.215.106
52.5.237.191
52.7.51.190
52.73.153.177
54.146.124.230
54.149.241.156
54.159.94.231
54.166.52.96
54.166.81.178
54.175.198.118
54.192.160.42
54.218.247.33
54.226.174.129
54.230.162.9
54.86.74.19
54.87.41.176
54.90.48.240
63.251.114.182
63.251.86.50
64.58.232.176
64.58.232.177
67.202.105.22
67.202.105.33
68.67.160.132
68.67.179.173
69.173.151.100
69.90.254.78
70.42.32.159
74.119.119.139
74.119.119.150
74.121.140.14
8.28.7.83
8.28.7.84
8.43.72.97
0172189e50951241e88f46ac748223e09805978ea91d6182ec81df40a92464ff
01c03b8eb0f7f27dd5ec8e28f4fe83079c56521e05b05e5099675154c7f10458
01ff66c4767396e089a4b2bd0923db9f01c23e52dc07682c3fd4b26a56605782
0265daca84edfc7afa2af71bc29d2c01afd7146b56f6a8987aa959a25ac91171
03b0b4ea7bd75f32536e7c0cad82a35dacd449b1f626ef7ffe06591b210363de
041a94f744701dd78e5a939b8b4aa778a534d53ce094b6a6b5389aec664615e8
04b722c670faf50123f03075e9cca12fe701d81d72fa7cc67b5dd000d313511e
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
05230fa1f83647d43dcb7632b136c71e49ae04f6d86a9e26563eef6de18ee9ee
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06ecc1573d3bd555fe29b67a1f5f9a4f560413c5d3a979eb7ad1960866ddbad8
080d3929d4c6f0ca45ddef3f56e45b6372b9b00b03ade7fc36c959f94ef8baff
08253d87a709e4edc03a486de4e4c50c343bcc88d87e6e6aa06473b41f274586
0b37f3d8aa5e1f298bf71477c945f576745020ce44f048ec67e19a93cd285372
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bdba55f50b3eb06309082e875d6987a4a89f4776b9746f131a592b90e125d7a
0c0248c11ea32b5473ed1e5e23797342cb05f360f3078eab3231fae6f550e036
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0cd951de444b20e3102dc1ab4c73a679ecfbb0cd5b0ea921839911d12c11ffa2
0cdce68d55ff0acea805c6354fafdddf6cafc1b111a9ece1f891acf3e5a5dc6d
0d2e02881c93e55cf5feefac46b87ff0493155e7f5b07a90de2b09d0655ba6b1
0e245aedb39f92ab38edf92e964ca45d847aca318c79758080622a1c8a652129
0e4c8708a7a07f2f3a664d1de55518a463f159f7f6b70ca45c4471fa26045f8f
0e8670554443313b972c10ae1a34baeb408d060fc5e82c6a358f77d7e98dd15e
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0f35719d73ced9e0bc4385a027050b3ecf4fe24b70fe1e7b6337422e342e633a
0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f
0f43d6dfd24b62e95baf46356acc669f8a0d75f10daea9778d1798410b84dd62
127656962cb1918ebebaaab66f0af795f2aa706e9a60fd4c5240c6a6cb1003be
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
140852976f26386afd24e8b07c5fd1c4f43c4bf004236d3bd3a704ee154e99f9
149439fa84a78de93ee928240b6a46f0c8d5da15eb366d91be0d891dfb8be558
14dd32c871105de3ad507e90898b20438e3e4b46bf1492b608b4f042ee1f4247
157248036947872e0484a5744b9a483c1267e4804dd3a96acc7585ea2549435c
159d540f536547514b9d4f47cd80b9deed921a73dcf11b0512a2acab501cf20d
15bd4e840e8331b9bb7ce0b92976dea62e54431f2a2e5f5b29092e519d5fac97
16923f9fcc118f6870a574a73697c19eb79210b2ce401e5e1b92a2a5fcda080a
17ae37864657a8edd224972d360c9ebe2c3d10fb9933e168526070ef4829f9da
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
187eb2b62d3893ba4ae9736a65cbe16b85a20d966e0d734199e8f5da1484ba21
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1
19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019
1bf67ddd4ac63675d2dd65b5a3e619a158ce5defdca73301641a8db052b8e4f4
1bfc2c2ee9af9b35c72c475c8c25d1004f5b43e34b2da6bfd4d99798afe12c9d
1c2529c4a862e2aeb90919c7185507f674d87b517c404964d4ce831e13bca0dd
1d71682fbb31fc64ba19097a9eb389593ba1bf9f9f913bef6eaf563eb08c2a7a
1da31085512b343f2de6f64bcdbeeb3bc50a54859a5fb7878c434fde47510405
1def4b0cf51bb00e842332a76640b8f7449d724fa5ee8e5ae1a80dfbc5dc392f
20d4862129ad5615afc5b29dd246b14835eb2cd4fe745c8685a2c54fb0449d75
222e34a90789c24c76384279358846781b332116af4bc26e5c04439a44c55250
22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba
22e1299474bc27ea501a2ea192fc8de44a72d6be7947c75dd08aedbba683c91b
22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b
2383416635c3508794c060f27958892f5d093d8c58c9484f968fd4e1d0c27857
263b5c14ea0c8dba145eaa30a0e60b7f9e0d3cb3c8f2356f59832ff329fa6d38
2709bdddaa0ad619fce3d4890ec33135b629c4d9cb5db5e1efd9b9312d9f0dbe
27a172eb814cce5a689f3b94b43fdac851e702f540233515e8280bfb84f6b10d
2816082c025f64540b613fde3096d814ae21ac75279461ec1d6bcb5c07099fdd
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2adfa45e20ea5b1db632dd3cea892dac22e371708e8c2cef673e6d9dd462a971
2af10b9c9dd4d6b4239687a27938947a38179a67c80498d29069b23ee95d0c16
2b2d2472f310f3a4c880947f473b8de3e58662291206e24a5426ee2bd64684ca
2b4d031954748e7f374abdfec4a7c1e2f83f7fadf0542058010250c0024970d1
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04
2ce34eb03cbabe0fa191964e0837ad386097f8207f6f82a19bbb566a9cfb1a82
2d74ea00c0e8d18b22d73aa5ec7a393f1c14490f5a202f59c7ab7d0be7044e23
2f3a8f05d656eeda40560f2829b186ec5e166626bac9a16a49499a99b443e477
2f4b66e4051d9fed10569b3fbc24f652d2d464beebfbf1a4d4f291b10f20401c
31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7
32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9
33051e81a7a7411895e690a3dac013f80d48abc32fb3d11c4386225a29b700e6
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590
343820fe93600fe8f7c40f75ee944a13501edbff6a7cdb6cd1ef515d4ccd2462
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
37ec84bbddcd7f889bfb1f8c28cad5311c6fe78bb5679d9586d8f37ebb312983
3a2a44d6d645afa6dd329ef0d6e7c92ebf624e49bf20fc301e59d69d9a59c87d
3b7c7d6643053e78c799bbf5dbadb05e66477a788da19dba5789bb2e46f1ee71
3bcfa04dbc2db44af54bd72a0f7b98912368f16f525729a1b9b673f62ca7e5c9
3cc026fab39eaf6f1bc4d81bc70075ecd8898f63a269be52c1ef00f5729527a1
3ceece0239e6870f6cd23047c8a35316027b35d0b7865315299e43a6b3b34bee
3d510e16e6e569e573980fd67a55221795d539fd56688ecaca8d284255e86ee6
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3d76ab4ac854cafef51bbbb5177ea75816df90e3c775294991a016404f2b6bb5
3e1497e9026c5320a9a6c90b10017f5eb930d18056d4236c6fc54caedd5dad4a
3e16e3fa1182656e77270ea7c961eb6a022d2e4ecf14e2c289d6d0c7c82a0b50
3e6aee43ce232f5c967d532d699c8dd2366873b4a61a6d6cbebb3606174a4a61
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
3fef19e536824cf94f0a91aa3c591c5cce3a2324b0cb39b2a848ec4ea8ff642c
415522d8ed63727924c2a9dcfe8ee62e86d97f0860aa9d73103efccef9e6c969
41578770d740012d57be1d400db47fdba90631e27363a4877af6cc54a032ad10
42b601bc0d93dfca6e350b46d113bf8e7ff9e40a87a0c57ab9b3c9c219062423
42c5d1ff6266b93bad630f3aa7c50546c78d6af2580f4c15b02ecc31c1887f3d
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
448a333dfdb98768c6308de7aeb073d319ec34bef67636b30fdf97abba0683b7
46e8439d0cff6acd4b246b26b7ccd4b668f5bf35aff26ea33d01f0bc953e7ceb
487fce51fd801415c362f3f9f2df43c445a4b9ba38f9b6d49dfc898dc85ede94
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4901b094a91ea6d5aba73774bb9803fdca22599cfca597ef81249225b5ed01b4
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4937adcc7dcaf8896352bc39065f7bdf60cb876095f04609ff1eac0befb0d05e
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4be2095a1a1043b3de6b7726927c81c0406534705b23ffee70abf9ccfeae315c
4beda28dcae03d0a09cf69fca1ebf4479111dd8479ac6657815888be6841a194
4d395f336edc3e775494ded7d2713c96dca83a9cc84bbab7c031aad36023cb67
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4ea3b3d39eee99715c64650cf694bcca527eae19db309bdcbf8dc8cbeac5bdf9
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0
4ffb3c059a52703436b925b5625f0f035e500656dba60bf6fd900e209497967e
503747b9c54acc1a1731ff2f479ef5ad06b22240a06c9b9c13d51f01b61af954
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50a427a86edd270a769be6b028c0513a241e39b623e44774b9fa7ad4aeb6b084
5195609afbc1fca03f3200b50d97a90a8eb0e4652108db990a1aa9a1c9f7a0af
51ae4c5642051d85bcfb8ed5d7ce619a0fd7cd201723c823f7495a829eefaa72
541a22e85f3238899f2589d44b9390a8d6d6e193a5d436c10e8ec9ce7b256e76
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
555c76ffcebb70f2c31d10cebc64edba66846cfee5755ce7fd8cf195ea1c4d0b
556132fe40232600f6915aa58108384098ca87d0465286287a088452fd727451
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
55b198b5ed1bd02e77f84c6971a69d5c2160c0c32fd770ce33405e194750f5fd
5690b289c02e28c255f52e917dc2ebd80dfbb5cdd3c23b68d20b220a6946f2dd
587d41f06f7469a073f09bc77ffbd126d4882cdb3c35cd7449e1d3d7110e83f8
58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4
59d6a1ad252c9993eeb7899bbf9fe12b0942588987aaf144d0a11f20463f8d98
5a15ddc370c3422a67623432e8fc11183f35ab4dfda84740f3e1d221cec5bbdd
5a49ffdeec0e61058ab6cdd783275b84a2c27a7a26b95a644f7764a78b510a7a
5bf0a170ae91f1bb8d0c94381a74ab8b85f938bf31bf18a9c8e3b835250d3be6
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c98fe33f2b609572fd74d0d40984ea007e47010b13815720de4fc857a75347f
5cbd8dc729043efb7fe66a51d9d5eda549dec7321059f03f3be5665d1e9ea027
5d1a890763a9c7419d6e9b5c45c114a36ec8ac3c8742173ba89d9610c4492d5b
5e89733d8a8e055100cda68bf7a712ab0e1b24fefee7e39792b47cb5ff7c3cb1
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
615050cfd7cd77d6941c6c0b4551d20c4d5ad825bc9fd7acc61a0bdca7783d26
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6257e792f9aef240d1954956a6ea7982c0268035f15a79931a110ed6344c8c4c
63658ec7937e89f8d7c4fe8c66d3eaba82ecf95b38d7989ae6b5ee8e7b90290a
6395e6f9f6fbcd953f0ffa40615094c565d86c265fb5028e64dd2dc872b5ce69
655e1b1c2df2d432818e7b88a43034255279b0b75d20a08cbca8ff6ccbf85330
65f6185cfe1cf88fa7981160dd6fa443e111887215b72953718ea70f8e2ba9f2
6610f6e5ebf811f47e5c53f5f536df0e8f431dc31af4618cd5c0e53ef5443374
67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2
68a6e4df2c9b52e1e00f74e1dfd8a3f1ed971630f2145db2ed6017d7c0f47991
68bb3cbd1ae3ee1da75a097f778ede2b79079634ca983b42977a7277cd567298
695d75b731572abe5163400f749ae449ac550488b1b0bf946c592244470e5db3
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b065f38eaed75574515532e2d687fd23450a662a972d044626b848d6e9d1045
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bb2fb707e140928d063074922d43052eb0e71cfb0b792b5335e7615c6f6c846
6cbf3d5198e3c67803ca9868b5ee9c2c464f2e6ddcce9cef64ed608c5c57949f
6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11
6df1827608a96dd3fa744c7761b93b60e29466be2e5b5f2180f4c92ffe4fd823
6e5968ac1dd065886764d838eb95108a423e152ce9ee903e3553e4525fb5901b
6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144
6f4f564d2412b732e0f672f4454c7a03fc8acf3405d7ecf6331ac66f1f6ee2f7
712e541dd878bef4c1b8775dd20054ada7da73b11af40bafec8dad0c7241b683
714d7c5f332e64c98e94a312e3c0f0957380efb646993bd66b77d0ffb9a53781
72781a6218413155d1b24c1a8ebc2c406556748de82bd0d7b131fa963ce1a74e
72bbfc75b32a9d6d8cf8abe7c8e121c983338000ef69a072c8ba2618f0677841
74079c1cde82d6cd3c0d6ae99bbefb7cb0d7d42ecb76979c4fdd5aa4125d928e
755af9e996edb7ac0fb05eeb681a187e51f8b5e9f11fcb3249228c7cfcff99fd
7647ad7d85bb73f5df6a939db40fad7cd0ad32054f0eaaddf4e0a3d17c909eb0
791717086abb6ea94a5e97b7dc8b2e63924f8350f075a137fae1e5c4226c28ce
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7abdd47254800f35ffef0fc434fa7fcf432e13651b27670b2e6f8e08143d4b00
7b48a74fa0f94d83ae6d60c772f5e7aa66e7be1b63ccf223ca14e34d3d7b0d22
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a
7c626d8c98f776ae253db4c6eab13bcfe67115a233d2b34cbcaec8bd53780baf
7ca703a20171d4d4440daefb529292d7720e3bb2b0aa1aa6d797228bcd3b762c
7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39
7ebce8c74b46ec153078cfba6d91071f6277204e5f1955918abd515b6445cc20
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c
7f3b6990b1bdb2d2341d8b2be3dbd4496fb2d853834f4ff403bee2923f107184
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8049032115cf969bbac7204a640f9319e59809cc73ef88e307c6e4df27158404
827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991
829471fae4063e334bfd47ba2c8508a2da9ee24d66974c731c65188fa0d40934
830b8ca5f78f00f8a0d79813f2ba95b0a7efd1ee7536567b5c25219323f3209b
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
844d16730113c50876b1ea84b4ba3a56a4c0f115d04b8a25da0d558f1d799b00
8569f8a54b841f9b5cbfbf1f340a1c29ee63e52b2fbf042d1b54bd9f5bcbbb07
85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b
85af3052d288ffd9157258dfe4daf5309f0b64d0067ab8221cd0c62909c18419
8627bbb29fb2d60d2746e532d38bc82a583df733c33d929677855167e3bb2c83
868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202
8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f
8784352d3d9a95ec8bff3ede98a66f89f629d7fc68c9723897d6e27dbd47d06b
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
8b55fc568cb954d4d8a798daed724d4c04728d17c64c7102274b120d147c71ff
8c59a910812fee6f23b648fcc223b90ed307fb11f885787a52df0190460ff245
8e60f604f0ca5f472149b3e3a02c184ae1082ad59b54ce7eb26c1b6ff51ccfc4
8f49abba729d1077d395402cb30bb187260cb200d5331ae85efa2e430552bcf6
8f4b8b1fbed8f5f76d32683e623f547601c09a3e682ebffde528d614f5431c75
90542f9de6cab010087ab4bcab0e3b0a2ec1e449e445434dc1bb5c852033f046
907f582e6ba023546ea075b2522ea84e692709567237e4f38929ceff1fb61c9a
92e21e86224e0c6c3a68d26a25667d910b4190567dcf634074b318314b2c82f0
92e649098eefaf82db65282d7cbb4e65c738aca33c3fc8073a9c770fbcb0623d
92e7acf4ea8ad8442db61a7022ad3ad9091d199b21513602563f1c17f9d3a111
933ac6a55f4c6ec598583c0679f1c1780ae730dd3e8366eb914148061d995c8c
942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339
943a4737d869145e2b755e99a3be24f4ab1ce524b92aade8476cd8a939997f60
947dd8624842a892adc7ecc70ec3270e5792bb3cc509dd1ff5720f2f8fe66419
952ff494a4f911577bd010f4a1e393e93cb090ce1976f464442cc8aa1ac6b12b
956035a88a8424f2d36b292231cd4cd7ed705d412b47a7aa929f7b537196c1cb
95c423bf8171e23d66d1b74a7f5bd90ad1806e8a3bea717280f9d71577389230
962d6dea088b031cd44d33f937adb5ba241a9435aa32a8be667d57482b8bbe1a
973cb6ccf3daaa415a40fc466276a835fb7b61c1f5225bf01da320f8be395996
97719c71e44494e537beba8d51c6bb268a34dcd867fdefc431229225ca734b46
9863c7532e26b3e9a2e1ac1d7ee7d96bc03db512a2af9174aa5c1d07046376cd
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
98ba8f881333898d751dabe4f8b4cacc4489a9f5b6b4fd1fc67c571dbfec95cf
995c49ccf09dc914eb2693d46c54dc9fd97bc2e5ac4ceaf17add5ea3d6fece6b
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a630b852e94f20cb8140704fd830bf40bfea0a2effaa67d06a0eadafbf3d508
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9abe6b1f8f8e8903d93e62630394568dbbd09e4fdad84026e2374f3935d5d25f
9b13f85dfc7be258d7cd95879c88b3938d3f507a2202b3239f641f8f49538fc3
9cbe77b69625e17d5ae4d7dd160bea4e0044c5b85ae3edaea370fc7067457c4e
9cd1b5630bcc34ecc71dbcbdfe45ddb9ed3cb4c0464a2abeb76bcc490635e376
9cdb6bfef8d4212d9bf634ca6724a28e85dfa69cd404e6f9d3760d70a7873949
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
9e21a21d6b098168808f2c5550c6480a4a32a58f96fad2b35dc9e1ea23e8280e
9e97fc43ecd2f16948c3a8d2de65e0e5483db4ed5ab174058c178ca1c8665d0b
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0d7bcd34dfaa69f178ae55434f3657ca7ecd1dad47195056050fda980b6b7a6
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a20ccaf6978bd71c43456b6bc78288abdc57c3b6fa987eecb2e9f59b69d384e1
a21060b05b4e4a70e3f9d26413bd3ee7222944ecb0ea68c3b137c209ff4986b5
a239be1a45bd5867274446da4bfb80892da21905979e53629f411b3cb26fc831
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a7b5f5f96f81dea4efc53e1d4dae8b37c28bec27a45b42ccf604ee759e20caec
a7e921e799d9b82a18e0d41aae0898f911d917899fe7bed4865dcadba0649fca
a8a54f8ae03295fefda03ec9f46a249426971b0f638cc5efb7e40ce1ad1b65f8
a8b7069299acb7cecdf2bd4f42505d2cd5e08783754ef2a79d30f1f886f38a75
ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
ace5c7a57a33a8c21d81ff1ab27c6e2fb71d14c98f007bc9e990880063a32b42
ad5179d4701c1063d3e4a4bc6bbafdf044d87a2cfc173296b2f602009858212f
aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50
b100e4ba08c53b0a7aaa749fdaf83ff4ceeefd054ee1273b13c6d19102923a76
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1
b401c214e29350159ceee10376ab42ec7b44b4db5962a07eeb01cc54843859fc
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
b60f65161ce3517c2794eecab25981c51ffbcbc951a781270403e2f3572d0290
b630bfefb18b047f36806ca3d09555730a686f944adedef8ef6fabc3751b58f9
b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad
b73857582989f2602487dc4de28f9e84ec0f34dad3857a405137e60150e4bfa4
baf857ec7b510958a50bfef8a3ec9cdf45d1909c7b1df9da7252d27b1da14791
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bc740c3112caddaec0203f975f014756ba0aad2b52b76029e0752193bfa2829d
be86a52f2acab160a1cf798efc6518336779f05b415d03478ea6e2fc2fa98a29
befa27fe12a5ea2cf69198a1a717c4d8dffc53ef4d71b4f6a426f2f67d8b81ac
bf051f3ee7aa85b70fbdb5a9c4dbe61dc57372814f700b1b23ecb4f7dfb9ce63
bf1f337991b6ffd7afff952440f4a93dfc4fbe21b3a223b6efae13e8d7d6b194
bfb080d58f027d962eaaa9d437e72faab804291483f4b40c29c9aa0aaeca72bc
c13d034eaf2fa73680d0abdbe02ac23b73e3128b5c7f0ee7018eb7b3fbe84a72
c1643c27ced6443bbfeddac4404c8c0f373729c1eda97da555b76938ac8609b2
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c37cdb0d5fdb474353422b0fd5bdbc9ab271aaaf490087badbedad29facfdcd9
c37f4f9bf734ba728e2326c01a504fe6cccd209a9aed499237ad6dd7409df516
c39238598cc03d4fbaab44e7f0b3d4552f8c2617e0203cf6c5f74ce5ada647a9
c399981a6bcd319b139bdce81ba6ff1f34528c7026c147d70edc6e560ef45d6e
c39f38776508cc2a307bc5b09b86446fb7ed06e2d0e77f0ba25639ed35cab1cd
c3f1108df7bbfe540c77dbde63875debd023b17b9fdcee9a9e44e4cf7c1d3b3a
c4c8d6c66cf7bb5cf29e1a2cda44dcbed9df8bd54fb633aa5a4afb9933b73156
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
c8092940d0da633c702f549149732cc636a04efd05b0bb72ae1b7a38b4a106aa
ca22345f969dd8077c21281572a34d4a51bc6a5ad9d764bd1338b2c12a68c3e3
cabdf43589214ad0231af8ec71b0ba10b72b5541a6a3238ac1b2d58cdac68329
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cd1c11febb31159039d1a50581b745cc891cbaaa91ef346ee3cac794721fc3ad
cecddc842a97425d7e3f179c4312564acc05c3c06357b31e1b10e42ec2cfb469
cf13909e69973de02d10a27b45e2822a566a81c5bc681bc209c9083e1b65d4d9
cf26bdbf5ff75c910f2127a46e8d6feb959eeb10eaa979e58112dd0bc0f8a16e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfac05f501d6d4d62e29fff1049569c3c2aa8732af8db3a36e8fa252f05f5861
d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
d0f65b99494d15cd4f8aaa6e7d7d6904145e6295446f83ce909d562a5565f34a
d2abe9d5f7eec7dfc53021326811dd6770437e66cd21623e7f92eac2bf95aa5a
d43c1b31c0d4fbbefe63a9983b96d675b6124244b3049c350e7996ad1021bfec
d68909c7a4c3c8190619ff7bf96c8292d37a03db3c58dc04ee40ba99b7c57a0f
d700b57f2d2a20509c05ba3130977df9b7ca52f89aa886a5d7e49c7a7a44b91a
d7038bb26a1de77b35dbf2b30731cc0fb12223262581356d8823c62509357c86
d70a6a620f3f39a178a167bafb9033b6043269d332b4be0ce15ee9b41d748a1f
d83c42234fa1909988fa322bbd921e3d3ebd1da93aa404f0279c8e1d2fe3a793
d8a34aeacc4054bd4e119e538c7eb4956421014f48a9b603d3f9314a7435b5a6
d8c62b0d4ac621bedd0ca5a4e96b12a77118338d4166f94d65c15bb154d455aa
d94553d767a3a35d03c216544f9b20ad2cad8e257b7f7c0a9992bd3357a0e8c0
d9473dc254914f26f7000bc3eacc42988538946d23e38b6a98f7648f22e13378
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
d9795324d204a94340a892e55fcdbf8f830614148f2be33435bbaea3aac66695
dc7009c97e4029c77cdb58ff5508dd8f504099c9d6c41375ceb5ba89f75d437f
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de13411ecb248055399e449614ccd4dec1917b3b2ddde23abc86cf2e0f02cc5f
de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096
df888bff9ec6e7f70b4e273ccbbcc1adb8dd8b4c725ae2860ca434f51ff36bbf
e1023fc5b7b2cb762dd4ad14fcf4787fa945fca4a37518cd0d6b411c248dc201
e19bbbcdf3b184181f642711f265c00e60d36347d075d6ccab56c66a10d4ceba
e246d0ac54efd560be566168845070b764c03b307099961a626a7f65614e5efc
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
e281529d43f5a8f2615392f7092ce45b34c2baa407ad74be49485438f0be0c5e
e2cdec10db9a0a224e9f5e49b6f004c5426564fb8d857ad3df480e9c916bafe6
e33b0e88e98b044bb7339fe15b58a8da3cdbb95ae3c5e5fec466f642ec7cc1a1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4a783177bbd97d5981bdc4b33b9bf4692fb715864e15dd9a693f339e7d01867
e50c2a67d8078f234e1e442f2de7c36ec934fb16cafe6426b871a39c6e4e8e25
e5b72db51b7bf9f92e37d4f4ff0607c8d582dfa180eb82057d81e75f4d012303
e77d232c6654987822f0f5bb073e5c15f210420715a2dea085bec290ea72f545
e7aa6af87d3cd8f6339d05ce2327c7471f626ac2473c5cf06e5f76a3c9376ce6
e8a0f1b344943369c2c5be278754a85602e3c7688fc857e3edf715c3be2771f1
e9642f5fbeff6a11fd1e8d29f62481cc23514472fb51d0d1e4ee4f257dbc8af3
eb2c939431e6250150a8cde81a5203d320e4e83df92c11a11e90b16074581e0e
eb6883bc39782219d9eb3868c4e21acbdf949cc1a13bd35fb86bcb447488a977
ecaa9d4a3ef5a8cd47ec2bf3747762739543591a34bf62360368df99e4b9e918
ecc7cc576c45b7d75e632b408e7e3eb63ec6c9bdeed91e9b4e4afc539b667d2e
ee1aefa691ed27b92a4d2ba2612931d156456f77afcd8f3d389efeeb08ab4199
ee2d0daef461b1efaf8fc5787127e202cf7b3d40aca343bcdaf474c6948c2168
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f154c9cd99e4d0f2dd4682195fd665b861bd7696cd1a44547821f7837980e642
f2af1d078e181893a9db7bafac60a67bd5969e371396ea80599af15563d21ae3
f2d93c219f91a38a44ec42951184d4a1d9a655597f908acf2daab59e1f6be99c
f3385adf33b15d77200af558761f6a92bbeeab7254fa981f16089d6ea81db1dd
f5e007cd8ff828404cc0e37ef6ac52dab7652109c184da41cc16f112b8e1e47b
f703078e42761b82133b652601a12e6d990bb8559e608782b9a992b3cb5db849
f725e4cdf64877ee7b8e5b87b811889661a5417fd791c814faebdd8e0d1a05e6
f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e
f77f47058428a1c21dad5a75ac13fbfdeb9858947218fee2112fded5972a0b5d
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f84b469a69ccfaad0bb1b8fbc57ad100b1972b849b7c897af7ca2cabf879efe8
f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3
fa8ed057f3d5158fa61380204083312f507221f670ee325e6c6f50ecad99918e
faa1ac04570af7f7acc7ea28d18aff407c880890d321309188b51de1c36747e2
fb845bc1998e818ffd1ebeacd695e0a60e479e5993e5f0053e34bff96b8d4c53
ff420b26b8a33e1bcae39c4d165c2cc259681bbb7b32565dbd7644c1d84cbfa8
ffabd3e0e054bec572a1df233ad9636fe9b70ba9af31bda68270edfbfb2ed4b2