www-bleepingcomputer-com.cdn.ampproject.org Open in urlscan Pro
172.253.63.132 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-...
Submission: On September 06 via manual (September 6th 2023, 4:58:45 pm UTC) from CA — Scanned from CA

Summary HTTP 110 Redirects Links 45 Behaviour Indicators

Summary

This website contacted 22 IPs in 5 countries across 48 domains to perform 110 HTTP transactions. The main IP is 172.253.63.132, located in United States and belongs to GOOGLE, US. The main domain is www-bleepingcomputer-com.cdn.ampproject.org. The Cisco Umbrella rank of the primary domain is 708722.
TLS certificate: Issued by GTS CA 1C3 on August 7th 2023. Valid for: 3 months.

This is the only time www-bleepingcomputer-com.cdn.ampproject.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
28	172.253.63.132 172.253.63.132	15169 (GOOGLE) (GOOGLE)
2	142.251.163.141 142.251.163.141	15169 (GOOGLE) (GOOGLE)
1	104.18.38.199 104.18.38.199	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.160.128.112 34.160.128.112	15169 (GOOGLE) (GOOGLE)
2	3.161.212.32 3.161.212.32	16509 (AMAZON-02) (AMAZON-02)
2	74.119.119.129 74.119.119.129	19750 (AS-CRITEO) (AS-CRITEO)
12	34.107.140.113 34.107.140.113	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	34.107.148.139 34.107.148.139	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3 3	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
1 14	172.64.146.152 172.64.146.152	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 4	35.211.178.172 35.211.178.172	19527 (GOOGLE-2) (GOOGLE-2)
1 1	52.45.151.151 52.45.151.151	14618 (AMAZON-AES) (AMAZON-AES)
5	172.253.115.156 172.253.115.156	15169 (GOOGLE) (GOOGLE)
2 2	192.40.36.238 192.40.36.238	27381 (CASALE-MEDIA) (CASALE-MEDIA)
14	104.18.41.104 104.18.41.104	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	52.20.216.116 52.20.216.116	14618 (AMAZON-AES) (AMAZON-AES)
1 1	50.116.194.21 50.116.194.21	6336 (TURN-US-ASN) (TURN-US-ASN)
2 2	35.71.139.29 35.71.139.29	16509 (AMAZON-02) (AMAZON-02)
2 2	68.67.160.114 68.67.160.114	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	198.148.27.131 198.148.27.131	19189 (PULSEPOINT) (PULSEPOINT)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
1 1	35.214.196.82 35.214.196.82	15169 (GOOGLE) (GOOGLE)
1 2	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
1	207.198.113.203 207.198.113.203	13768 (COGECO-PEER1) (COGECO-PEER1)
1 1	18.213.190.50 18.213.190.50	14618 (AMAZON-AES) (AMAZON-AES)
1 1	3.222.163.84 3.222.163.84	14618 (AMAZON-AES) (AMAZON-AES)
1 1	38.98.139.150 38.98.139.150	26558 (FREEWHEEL) (FREEWHEEL)
1	209.192.253.44 209.192.253.44	7979 (SERVERS-COM) (SERVERS-COM)
2 2	18.214.123.150 18.214.123.150	14618 (AMAZON-AES) (AMAZON-AES)
1 1	159.89.252.170 159.89.252.170	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1 1	142.234.204.77 142.234.204.77	396362 (LEASEWEB-...) (LEASEWEB-USA-NYC)
2 2	69.166.1.35 69.166.1.35	27630 (AS-XFERNET) (AS-XFERNET)
1 1	52.204.19.136 52.204.19.136	14618 (AMAZON-AES) (AMAZON-AES)
1	37.157.6.237 37.157.6.237	198622 (ADFORM) (ADFORM)
1	104.20.59.209 104.20.59.209	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.251.167.102 142.251.167.102	15169 (GOOGLE) (GOOGLE)
1 2	3.162.3.40 3.162.3.40	16509 (AMAZON-02) (AMAZON-02)
1	172.253.62.132 172.253.62.132	15169 (GOOGLE) (GOOGLE)
1 1	142.251.111.103 142.251.111.103	15169 (GOOGLE) (GOOGLE)
4	142.251.167.132 142.251.167.132	15169 (GOOGLE) (GOOGLE)
2 2	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
1 1	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
1 1	34.216.140.43 34.216.140.43	16509 (AMAZON-02) (AMAZON-02)
1	172.253.115.94 172.253.115.94	15169 (GOOGLE) (GOOGLE)
110	22

28 172.253.63.132 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f132.1e100.net

www-bleepingcomputer-com.cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www-bleepstatic-com.cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.163.141 (United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f141.1e100.net

csp.withgoogle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.38.199 (None, )

ASN13335 (CLOUDFLARENET, US)

amp.cntxcdm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.160.128.112 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 112.128.160.34.bc.googleusercontent.com

api.floors.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.161.212.32 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-161-212-32.yul62.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.119.119.129 (United States)

ASN19750 (AS-CRITEO, US)
PTR: bidder.va1.vip.prod.criteo.com

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 34.107.140.113 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 113.140.107.34.bc.googleusercontent.com

static.s2s.t13.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s2s.t13.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.107.148.139 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 139.148.107.34.bc.googleusercontent.com

amprtc.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.223.40.198 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 172.64.146.152 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cd.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cds.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cks.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ins.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.211.178.172 (North Charleston, United States) 4 redirects

ASN19527 (GOOGLE-2, US)
PTR: 172.178.211.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.45.151.151 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-151-151.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.253.115.156 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f156.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.40.36.238 (Canada) 2 redirects

ASN27381 (CASALE-MEDIA, CA)

ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 104.18.41.104 (None, )

ASN13335 (CLOUDFLARENET, US)

cks.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.20.216.116 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-216-116.compute-1.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.116.194.21 (United States) 1 redirects

ASN6336 (TURN-US-ASN, US)
PTR: presentation-atl1.turn.com

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.139.29 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.160.114 (New York, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.148.27.131 (New York, United States) 1 redirects

ASN19189 (PULSEPOINT, US)

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

i.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.214.196.82 (Groningen, Netherlands) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 82.196.214.35.bc.googleusercontent.com

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.60.146 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 207.198.113.203 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)

pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.213.190.50 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-213-190-50.compute-1.amazonaws.com

ads.yieldmo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.222.163.84 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-222-163-84.compute-1.amazonaws.com

connatix-supply-partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 38.98.139.150 (Chicago, United States) 1 redirects

ASN26558 (FREEWHEEL, US)

ads.stickyadstv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.192.253.44 (United States)

ASN7979 (SERVERS-COM, US)

sync.colossusssp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.214.123.150 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-214-123-150.compute-1.amazonaws.com

vop.sundaysky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.89.252.170 (Clifton, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

sync.resetdigital.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.234.204.77 (Edison, United States) 1 redirects

ASN396362 (LEASEWEB-USA-NYC, US)

xsync.iqzone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.166.1.35 (United States) 2 redirects

ASN27630 (AS-XFERNET, US)

sync.go.sonobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.204.19.136 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-19-136.compute-1.amazonaws.com

sync.ipredictive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.6.237 (Denmark)

ASN198622 (ADFORM, DK)

cm.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.20.59.209 (None, )

ASN13335 (CLOUDFLARENET, US)

www.bleepingcomputer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.167.102 (United States)

ASN15169 (GOOGLE, US)
PTR: ww-in-f102.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.162.3.40 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-3-162-3-40.yul62.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.62.132 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f132.1e100.net

4019ed0cc3a988fa97d413b658bf51fd.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.111.103 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bk-in-f103.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.167.132 (United States)

ASN15169 (GOOGLE, US)
PTR: ww-in-f132.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.252.103 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.216.140.43 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-216-140-43.us-west-2.compute.amazonaws.com

visitor.omnitagjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.115.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f94.1e100.net

3p.ampproject.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
28	connatix.com 1 redirects cd.connatix.com — Cisco Umbrella Rank: 3927 capi.connatix.com — Cisco Umbrella Rank: 1819 cds.connatix.com — Cisco Umbrella Rank: 4174 cks.connatix.com — Cisco Umbrella Rank: 7588 ins.connatix.com — Cisco Umbrella Rank: 5186 vid.connatix.com Failed	336 KB
28	ampproject.org www-bleepingcomputer-com.cdn.ampproject.org — Cisco Umbrella Rank: 708722 cdn.ampproject.org — Cisco Umbrella Rank: 399 www-bleepstatic-com.cdn.ampproject.org — Cisco Umbrella Rank: 794907	415 KB
12	t13.io static.s2s.t13.io — Cisco Umbrella Rank: 39962 s2s.t13.io — Cisco Umbrella Rank: 5157	12 KB
5	googlesyndication.com 4019ed0cc3a988fa97d413b658bf51fd.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 160	47 KB
5	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 215 cm.g.doubleclick.net Failed googleads.g.doubleclick.net — Cisco Umbrella Rank: 53	46 KB
4	bidswitch.net 4 redirects x.bidswitch.net — Cisco Umbrella Rank: 369	2 KB
3	adsrvr.org 3 redirects match.adsrvr.org — Cisco Umbrella Rank: 379	1 KB
2	scorecardresearch.com 1 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 182	1 KB
2	openx.net us-u.openx.net Failed rtb.openx.net — Cisco Umbrella Rank: 796	591 B
2	sonobi.com 2 redirects sync.go.sonobi.com — Cisco Umbrella Rank: 1120	1 KB
2	sundaysky.com 2 redirects vop.sundaysky.com — Cisco Umbrella Rank: 2958	1 KB
2	rlcdn.com 1 redirects id.rlcdn.com — Cisco Umbrella Rank: 920	782 B
2	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 500	2 KB
2	3lift.com 2 redirects eb2.3lift.com — Cisco Umbrella Rank: 440	823 B
2	bidr.io 2 redirects match.prod.bidr.io — Cisco Umbrella Rank: 632	1 KB
2	casalemedia.com 2 redirects ssum.casalemedia.com — Cisco Umbrella Rank: 1435	2 KB
2	media.net amprtc.media.net — Cisco Umbrella Rank: 12416 cs.media.net Failed	498 B
2	criteo.com bidder.criteo.com — Cisco Umbrella Rank: 866	899 B
2	amazon-adsystem.com aax.amazon-adsystem.com — Cisco Umbrella Rank: 442	2 KB
2	floors.dev api.floors.dev — Cisco Umbrella Rank: 7866	742 B
2	withgoogle.com csp.withgoogle.com — Cisco Umbrella Rank: 691
1	ampproject.net 3p.ampproject.net — Cisco Umbrella Rank: 7474	5 KB
1	omnitagjs.com 1 redirects visitor.omnitagjs.com — Cisco Umbrella Rank: 1072	428 B
1	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2	256 B
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 49	367 B
1	bleepingcomputer.com www.bleepingcomputer.com — Cisco Umbrella Rank: 75061
1	adform.net cm.adform.net — Cisco Umbrella Rank: 1256	106 B
1	ipredictive.com 1 redirects sync.ipredictive.com — Cisco Umbrella Rank: 1099	522 B
1	iqzone.com 1 redirects xsync.iqzone.com — Cisco Umbrella Rank: 6169	511 B
1	resetdigital.co 1 redirects sync.resetdigital.co — Cisco Umbrella Rank: 2915	418 B
1	colossusssp.com sync.colossusssp.com — Cisco Umbrella Rank: 1481	176 B
1	stickyadstv.com 1 redirects ads.stickyadstv.com — Cisco Umbrella Rank: 605	570 B
1	tremorhub.com 1 redirects connatix-supply-partners.tremorhub.com — Cisco Umbrella Rank: 12169	422 B
1	yieldmo.com 1 redirects ads.yieldmo.com — Cisco Umbrella Rank: 752	533 B
1	sitescout.com pixel-sync.sitescout.com — Cisco Umbrella Rank: 770	187 B
1	loopme.me 1 redirects csync.loopme.me — Cisco Umbrella Rank: 1063	278 B
1	ctnsnet.com 1 redirects i.ctnsnet.com — Cisco Umbrella Rank: 6266	453 B
1	contextweb.com 1 redirects bh.contextweb.com — Cisco Umbrella Rank: 617	859 B
1	rubiconproject.com secure-assets.rubiconproject.com Failed pixel.rubiconproject.com — Cisco Umbrella Rank: 385	825 B
1	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 991	459 B
1	stackadapt.com 1 redirects sync.srv.stackadapt.com — Cisco Umbrella Rank: 773	1 KB
1	cntxcdm.com amp.cntxcdm.com — Cisco Umbrella Rank: 29018	2 KB
0	everesttech.net Failed sync-tm.everesttech.net Failed
0	googleapis.com Failed imasdk.googleapis.com Failed
0	intentiq.com Failed sync.intentiq.com Failed
0	yellowblue.io Failed cs-server-s2s.yellowblue.io Failed
0	pubmatic.com Failed ads.pubmatic.com Failed
0	33across.com Failed ssc-cms.33across.com Failed
110	48

	Domain	Requested by
21	cdn.ampproject.org	www-bleepingcomputer-com.cdn.ampproject.org cdn.ampproject.org
16	cks.connatix.com	blank
10	s2s.t13.io	cdn.ampproject.org static.s2s.t13.io www-bleepingcomputer-com.cdn.ampproject.org
7	capi.connatix.com	1 redirects amp.cntxcdm.com cds.connatix.com blank
6	www-bleepstatic-com.cdn.ampproject.org	www-bleepingcomputer-com.cdn.ampproject.org
4	tpc.googlesyndication.com	cdn.ampproject.org
4	securepubads.g.doubleclick.net	cdn.ampproject.org cds.connatix.com
4	x.bidswitch.net	4 redirects
3	match.adsrvr.org	3 redirects
2	rtb.openx.net	2 redirects
2	sb.scorecardresearch.com	1 redirects
2	ins.connatix.com	cds.connatix.com
2	sync.go.sonobi.com	2 redirects
2	vop.sundaysky.com	2 redirects
2	id.rlcdn.com	1 redirects blank
2	secure.adnxs.com	2 redirects
2	eb2.3lift.com	2 redirects
2	match.prod.bidr.io	2 redirects
2	ssum.casalemedia.com	2 redirects
2	cds.connatix.com	cd.connatix.com cds.connatix.com
2	amprtc.media.net	cdn.ampproject.org
2	static.s2s.t13.io	cdn.ampproject.org static.s2s.t13.io
2	bidder.criteo.com	cdn.ampproject.org
2	aax.amazon-adsystem.com	cdn.ampproject.org
2	api.floors.dev	cdn.ampproject.org
2	csp.withgoogle.com	www-bleepingcomputer-com.cdn.ampproject.org
1	3p.ampproject.net	tpc.googlesyndication.com
1	visitor.omnitagjs.com	1 redirects
1	pixel.rubiconproject.com	1 redirects
1	googleads.g.doubleclick.net
1	www.google.com	1 redirects
1	4019ed0cc3a988fa97d413b658bf51fd.safeframe.googlesyndication.com	cdn.ampproject.org
1	www.google-analytics.com	cdn.ampproject.org
1	www.bleepingcomputer.com	cdn.ampproject.org
1	cm.adform.net
1	sync.ipredictive.com	1 redirects
1	xsync.iqzone.com	1 redirects
1	sync.resetdigital.co	1 redirects
1	sync.colossusssp.com	cds.connatix.com
1	ads.stickyadstv.com	1 redirects
1	connatix-supply-partners.tremorhub.com	1 redirects
1	ads.yieldmo.com	1 redirects
1	pixel-sync.sitescout.com	cds.connatix.com
1	csync.loopme.me	1 redirects
1	i.ctnsnet.com	1 redirects
1	bh.contextweb.com	1 redirects
1	ad.turn.com	1 redirects
1	sync.srv.stackadapt.com	1 redirects
1	cd.connatix.com	amp.cntxcdm.com
1	amp.cntxcdm.com	cdn.ampproject.org
1	www-bleepingcomputer-com.cdn.ampproject.org
0	sync-tm.everesttech.net Failed
0	vid.connatix.com Failed	cds.connatix.com
0	imasdk.googleapis.com Failed	cds.connatix.com
0	sync.intentiq.com Failed
0	cm.g.doubleclick.net Failed
0	cs.media.net Failed
0	us-u.openx.net Failed
0	cs-server-s2s.yellowblue.io Failed	cds.connatix.com
0	ads.pubmatic.com Failed	cds.connatix.com
0	ssc-cms.33across.com Failed	cds.connatix.com
0	secure-assets.rubiconproject.com Failed	cds.connatix.com
110	62

This site contains links to these domains. Also see Links.

Domain
www.bleepingcomputer.com
deals.bleepingcomputer.com
www.group-ib.com

Subject Issuer	Validity	Valid
misc-sni.google.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.appspot.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-03-15` - `2024-03-14`	a year	crt.sh
api.floors.dev GTS CA 1D4	`2023-07-19` - `2023-10-17`	3 months	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-16` - `2024-03-08`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-19` - `2023-10-18`	3 months	crt.sh
static.s2s.t13.io GTS CA 1D4	`2023-07-21` - `2023-10-19`	3 months	crt.sh
s2s.t13.io GTS CA 1D4	`2023-07-16` - `2023-10-14`	3 months	crt.sh
*.media.net Sectigo RSA Domain Validation Secure Server CA	`2023-04-10` - `2024-05-02`	a year	crt.sh
connatix.com GTS CA 1P5	`2023-09-05` - `2023-12-04`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.sitescout.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2023-01-09` - `2024-02-02`	a year	crt.sh
*.colossusssp.com Go Daddy Secure Certificate Authority - G2	`2022-09-08` - `2023-10-10`	a year	crt.sh
*.adform.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-25` - `2024-06-18`	a year	crt.sh
bleepingcomputer.com Sectigo RSA Domain Validation Secure Server CA	`2023-05-04` - `2024-05-03`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Frame ID: 7CE42ED64B54D085C6E66ADA444A1B4C
Requests: 55 HTTP requests in this frame

Frame: https://amp.cntxcdm.com/amp-embed/index.html?playerId=ps_067e5169-ece3-4ce8-87ad-c7961b8bb396&mediaId=d59f5d0c-2087-416a-821c-141798bc501e&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F
Frame ID: 9FCE066729BC6D8789718D7339F98FFC
Requests: 25 HTTP requests in this frame

Frame: https://static.s2s.t13.io/generic/load-cookie.html?source=amp
Frame ID: ABDEEEACFB399B77EAE7574D417AECED
Requests: 13 HTTP requests in this frame

Frame: https://cd.connatix.com/connatix.playspace.js
Frame ID: 7FA3E60AEC2B92860F35A9D9DA69EBFD
Requests: 16 HTTP requests in this frame

Frame: https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=19564_2&endpoint=us-east&gdpr=0
Frame ID: E8E30ADBBE027C2DB9184DCAE3770BE4
Requests: 1 HTTP requests in this frame

Frame: https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0015a00002y7TWTAA2&ru=https%3a%2f%2fcapi.connatix.com%2fcore%2fus%3fDemandPartner%3d37%26UserId%3d69aeec629e534900901a428166dd614a%26DemandPartnerName%3d_33Across%26tier%3d1%26DemandPartnerUserId%3d33XUSERID33X&gdpr=0
Frame ID: AD8FD27A9B9E5E12AE43F0E2E11A3CC8
Requests: 1 HTTP requests in this frame

Frame: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dIronSource%26api-tier%3d1%26uid%3d{partnerId}%26direct%3D1
Frame ID: 91168772510FCB5004A4F0E1C2D0C3C8
Requests: 1 HTTP requests in this frame

Frame: https://csp.withgoogle.com/csp/amp
Frame ID: 11F38EFF5254DE366B3A814941FF4966
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/b4a/b4a-runner.html
Frame ID: 3419838E55240629035E00055676D44E
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

W3LL phishing kit hijacks thousands of Microsoft 365 accounts, bypasses MFA

Detected technologies

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Page Statistics

110
Requests

62 %
HTTPS

0 %
IPv6

48
Domains

62
Subdomains

22
IPs

5
Countries

867 kB
Transfer

2676 kB
Size

45
Cookies

45 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bleepingcomputer.com/

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/
Title: Security

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/microsoft/
Title: Microsoft

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/software/
Title: Software

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/tag/ransomware/
Title: Ransomware

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/hardware/
Title: Hardware

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/technology/
Title: Technology

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/linux/
Title: Linux

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/mobile/
Title: Mobile

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/google/
Title: Google

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/tutorials/
Title: Tutorials

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/virus-removal/
Title: Virus Removal

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/forums/
Title: Forums

Search URL Search Domain Scan URL

URL: https://deals.bleepingcomputer.com/
Title: Deals

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/downloads/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/startups/
Title: Startup Database

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/uninstall/
Title: Uninstall Database

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/glossary/
Title: Glossary

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/forums/t/679076/the-bleepingcomputer-official-discord-chat-server-come-join-the-fun/
Title: Chat on Discord

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news-tip/
Title: Send us a Tip!

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/welcome-guide/
Title: Welcome Guide

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/author/ionut-ilascu/
Title: Ionut Ilascu

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/media-center/press-releases/w3ll-phishing-report/
Title: Group-IB

Search URL Search Domain Scan URL

URL: https://www.group-ib.com/resources/research-hub/w3ll-phishing/
Title: explain

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/evilproxy-phishing-campaign-targets-120-000-microsoft-365-users/
Title: EvilProxy phishing campaign targets 120,000 Microsoft 365 users

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/classiscam-fraud-as-a-service-expands-now-targets-banks-and-251-brands/
Title: Classiscam fraud-as-a-service expands, now targets banks and 251 brands

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/major-us-energy-org-targeted-in-qr-code-phishing-attack/
Title: Major U.S. energy org targeted in QR code phishing attack

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/interpol-takes-down-16shop-phishing-as-a-service-platform/
Title: Interpol takes down 16shop phishing-as-a-service platform

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/spain-warns-of-lockbit-locker-ransomware-phishing-attacks/
Title: Spain warns of LockBit Locker ransomware phishing attacks

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/tag/bec/
Title: BEC

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/tag/business-email-compromise/
Title: Business Email Compromise

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/tag/mfa/
Title: MFA

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/tag/microsoft-365/
Title: Microsoft 365

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/tag/multi-factor-authentication/
Title: Multi-Factor Authentication

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/tag/otp/
Title: OTP

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/tag/phishing/
Title: Phishing

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/tag/phishing-kit/
Title: Phishing Kit

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/tag/w3ll/
Title: W3LL

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/
Title: View Comments

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/okta-hackers-target-it-help-desks-to-gain-super-admin-disable-mfa/
Title: Okta: Hackers target IT help desks to gain Super Admin, disable MFA

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/insurer-fined-3m-for-exposing-data-of-650k-clients-for-two-years/
Title: Insurer fined $3M for exposing data of 650k clients for two years

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/about/
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/ethics-statement/
Title: Ethics Statement

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 48

https://match.adsrvr.org/track/cmf/generic?ttd_pid=l3a2x8p&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=&redir= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=l3a2x8p&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=&redir= HTTP 302
https://s2s.t13.io/setuid?bidder=ttdfsx&gdpr=0&gdpr_consent=&uid=fe8f5910-c96c-4bfd-a0c9-e6d2bcb0c838

Request Chain 52

https://x.bidswitch.net/sync?ssp=sortable&gdpr=0&gdpr_consent=&us_privacy=&redir= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=sortable&gdpr=0&gdpr_consent=&us_privacy=&redir= HTTP 302
https://sync.srv.stackadapt.com/sync?nid=50&gdpr=0&gdpr_consent=&gdpr_pd=&ssp=sortable HTTP 302
https://x.bidswitch.net/sync?dsp_id=188&user_id=gQwBUS5vW59-KvyI8l031VYwD6k&user_group=1&ssp=sortable&gdpr=0 HTTP 302
https://s2s.t13.io/setuid?bidder=bidswitch&gdpr=0&gdpr_consent=&us_privacy=&uid=d1a5a299-cf60-40ca-b5c1-b9c7677447ed

Request Chain 53

https://capi.connatix.com/core/sync?v=330092 HTTP 302
https://capi.connatix.com/core/sync?v=330092&tier=1&final=true&ImplementationType=1

Request Chain 59

https://ssum.casalemedia.com/usermatchredir?s=190549&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d17%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dIndex%26api-tier%3d1%26uid%3d&gdpr=0 HTTP 302
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D17%26ev%3D69aeec629e534900901a428166dd614a%26pname%3DIndex%26api-tier%3D1%26uid%3D&gdpr=0&s=190549&C=1 HTTP 302
https://cks.connatix.com/cks?pid=17&ev=69aeec629e534900901a428166dd614a&pname=Index&api-tier=1&uid=ZPivw0Gmjdm3XJvwCoFZjgAA%26584

Request Chain 60

https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d15%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dBeeswax%26api-tier%3d1%26uid%3d{userid}&gdpr=0 HTTP 303
https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D15%26ev%3D69aeec629e534900901a428166dd614a%26pname%3DBeeswax%26api-tier%3D1%26uid%3D%7Buserid%7D&gdpr=0&_bee_ppp=1 HTTP 303
https://cks.connatix.com/cks?pid=15&ev=69aeec629e534900901a428166dd614a&pname=Beeswax&api-tier=1&uid=AAClAk7J8WAAADjnQPDovg&gdpr=0

Request Chain 61

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gapzaid&ttd_tpi=1&gdpr=0 HTTP 302
https://cks.connatix.com/cks?pid=19&uid=fe8f5910-c96c-4bfd-a0c9-e6d2bcb0c838&ttl=1696611520

Request Chain 62

https://ad.turn.com/r/cs?pid=67&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d21%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dAmobee%26api-tier%3d1%26uid%3D%23USER_ID%23&gdpr=0 HTTP 302
https://cks.connatix.com/cks?pid=21&ev=69aeec629e534900901a428166dd614a&pname=Amobee&api-tier=1&uid=7120220350391770329

Request Chain 63

https://eb2.3lift.com/getuid?redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d25%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dTripleLift%26api-tier%3d1%26uid%3d%24UID&gdpr=0 HTTP 302
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D25%26ev%3D69aeec629e534900901a428166dd614a%26pname%3DTripleLift%26api-tier%3D1%26uid%3D%24UID HTTP 302
https://cks.connatix.com/cks?pid=25&ev=69aeec629e534900901a428166dd614a&pname=TripleLift&api-tier=1&uid=2598518279004013141717

Request Chain 64

https://secure.adnxs.com/getuid?https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d6%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dAppNexus%26api-tier%3d1%26uid%3d%24UID&gdpr=0 HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fcks.connatix.com%252fcks%253fpid%253d6%2526ev%253d69aeec629e534900901a428166dd614a%2526pname%253dAppNexus%2526api-tier%253d1%2526uid%253d%2524UID%26gdpr%3D0 HTTP 302
https://cks.connatix.com/cks?pid=6&ev=69aeec629e534900901a428166dd614a&pname=AppNexus&api-tier=1&uid=2966634651961889903&gdpr=0

Request Chain 68

https://bh.contextweb.com/bh/rtset?pid=561340&daaqp=1&ev=1&rurl=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d13%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dPulsePoint%26api-tier%3d1%26uid%3d%25%25VGUID%25%25&gdpr=0 HTTP 302
https://cks.connatix.com/cks?pid=13&ev=69aeec629e534900901a428166dd614a&pname=PulsePoint&api-tier=1&uid=Pz5P5nglalOo

Request Chain 69

https://i.ctnsnet.com/int/cm?exc=24&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d28%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dCrimtan%26api-tier%3d1%26uid%3d%5Buser_id%5D&gdpr=0 HTTP 302
https://cks.connatix.com/cks?pid=28&ev=69aeec629e534900901a428166dd614a&pname=Crimtan&api-tier=1&uid=841657a9f5f940868ac24e47d6a6735a

Request Chain 70

https://csync.loopme.me/?redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d18%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dLoopMe%26api-tier%3d1%26uid%3D%7Bdevice_id%7D%26pubid%3D11186&gdpr=0 HTTP 307
https://cks.connatix.com/cks?pid=18&ev=69aeec629e534900901a428166dd614a&pname=LoopMe&api-tier=1&uid=88dfa2f0-be78-4110-8083-bbd23fae27ed&pubid=11186&gdpr=0

Request Chain 71

https://id.rlcdn.com/712202.gif?cparams=69aeec629e534900901a428166dd614a&gdpr=0 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CIq8KxoNCMPf4qcGEgUI6AcQAEIASiA2OWFlZWM2MjllNTM0OTAwOTAxYTQyODE2NmRkNjE0YQ

Request Chain 73

https://ads.yieldmo.com/pbsync?is=smartnews&redirectUri=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d39%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dYieldMo%26api-tier%3d1%26uid%3D%24UID&gdpr=0 HTTP 302
https://cks.connatix.com/cks?pid=39&ev=69aeec629e534900901a428166dd614a&pname=YieldMo&api-tier=1&uid=3RhHuII00HIKYWtZIqD9&gdpr=0

Request Chain 74

https://connatix-supply-partners.tremorhub.com/sync?UISCX=69aeec629e534900901a428166dd614a&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d5%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dTelaria%26api-tier%3d1%26uid%3d%5bTVUSER_ID%5d&gdpr=0 HTTP 302
https://cks.connatix.com/cks?pid=5&ev=69aeec629e534900901a428166dd614a&pname=Telaria&api-tier=1&uid=6030ea8ca298403fa927adb384146d0a

Request Chain 75

https://ads.stickyadstv.com/user-matching?id=3672&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0 HTTP 302
https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=28ba1b3c8219df442f203bcb374fed28&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0

Request Chain 78

https://vop.sundaysky.com/sync/dmp?redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d1%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dSundaySky%26api-tier%3d1%26uid%3d%24{ssky_uuid}&gdpr=0 HTTP 302
https://vop.sundaysky.com/sync/dmp?redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d1%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dSundaySky%26api-tier%3d1%26uid%3d%24{ssky_uuid}&gdpr=0&_cvt=t HTTP 302
https://cks.connatix.com/cks?pid=1&ev=69aeec629e534900901a428166dd614a&pname=SundaySky&api-tier=1&uid=d6.9ca67c6d2cfe4b0a9a8a10a80802c383

Request Chain 79

https://sync.resetdigital.co/csync?pid=connatix&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d35%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dResetDigital%26api-tier%3d1%26uid%3D%24USER_ID&gdpr=0 HTTP 302
https://cks.connatix.com/cks?pid=35&ev=69aeec629e534900901a428166dd614a&pname=ResetDigital&api-tier=1&uid=0000010E8427BB75

Request Chain 80

https://xsync.iqzone.com/psync?t=s&e=376&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d42%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dIqZone%26api-tier%3d1%26uid%3D%25USER_ID%25&gdpr=0 HTTP 307
https://cks.connatix.com/cks?pid=42&ev=69aeec629e534900901a428166dd614a&pname=IqZone&api-tier=1&uid=e8795170-b7e7-4791-aa0a-1881d3257ce0

Request Chain 81

https://sync.go.sonobi.com/us?loc=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d43%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dSonobi%26api-tier%3d1%26uid%3D%5BUID%5D&gdpr=0 HTTP 302
https://cks.connatix.com/cks?pid=43&ev=69aeec629e534900901a428166dd614a&pname=Sonobi&api-tier=1&uid=56614a3c-d90c-4c8d-bfee-32b35c9dc358

Request Chain 82

https://sync.ipredictive.com/d/sync/cookie/generic?partner=connatix&cspid=25&append=0&cb=${ADELPHIC_CACHE_BUSTER}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d29%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dAdelphic%26api-tier%3d1%26uid%3D%24%7BADELPHIC_CUID%7D&gdpr=0 HTTP 302
https://cks.connatix.com/cks?pid=29&ev=69aeec629e534900901a428166dd614a&pname=Adelphic&api-tier=1&uid=7a1c33c4-1fbe-49b0-99f8-a3171baf67c7

Request Chain 85

https://capi.connatix.com/us/google/pixel?tier=1&gdpr=0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=connatix&google_hm=NjlhZWVjNjI5ZTUzNDkwMDkwMWE0MjgxNjZkZDYxNGE&extra1=69aeec629e534900901a428166dd614a&gdpr=0&google_redir=https%3a%2f%2fcapi.connatix.com%2fus%2fgoogle%2freport

Request Chain 99

https://sb.scorecardresearch.com/p?c1=2&c2=23384447&cs_ucfr=&cs_amp_consent=not_required&cs_pv=8505&c12=ncWInPt348zlqxh0t4AXvlrOAn1fg0qPJARRHGV_ocmztKIrw0dsBL8bwhumi1Wz&rn=0.6709136975080858&c8=W3LL%20phishing%20kit%20hijacks%20thousands%20of%20Microsoft%20365%20accounts%2C%20bypasses%20MFA&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&c9=&cs_c7amp=https%3A%2F%2Fwww-bleepingcomputer-com.cdn.ampproject.org%2Fc%2Fs%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&comscorekw=amp HTTP 302
https://sb.scorecardresearch.com/p2?c1=2&c2=23384447&cs_ucfr=&cs_amp_consent=not_required&cs_pv=8505&c12=ncWInPt348zlqxh0t4AXvlrOAn1fg0qPJARRHGV_ocmztKIrw0dsBL8bwhumi1Wz&rn=0.6709136975080858&c8=W3LL%20phishing%20kit%20hijacks%20thousands%20of%20Microsoft%20365%20accounts%2C%20bypasses%20MFA&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&c9=&cs_c7amp=https%3A%2F%2Fwww-bleepingcomputer-com.cdn.ampproject.org%2Fc%2Fs%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&comscorekw=amp

Request Chain 106

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 112

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24%7BUID%7D HTTP 302
https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24%7BUID%7D&ox_sc=1 HTTP 302
https://s2s.t13.io/setuid?bidder=openx&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=c8d15979-186f-4a5c-aa2f-2ee104d83f89

Request Chain 113

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-triple13&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
https://s2s.t13.io/setuid?bidder=rubicon&uid=LM7ZHGQA-16-A8OE&gdpr=0

Request Chain 114

https://visitor.omnitagjs.com/visitor/bsync?uid=19340f4f097d16f41f34fc0274981ca4&name=PrebidServer&gdpr=0&gdpr_consent=&us_privacy=&url=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dadyoulike%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5BBUYER_USERID%5D HTTP 307
https://s2s.t13.io/setuid?bidder=adyoulike&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=082c1ee49612665a6fc0b8c1b6b04a80

Request Chain 117

https://sync.go.sonobi.com/us.gif?loc=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dsonobi%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5BUID%5D HTTP 302
https://s2s.t13.io/setuid?bidder=sonobi&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=56614a3c-d90c-4c8d-bfee-32b35c9dc358

Request Chain 118

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24%7BBSW_UUID%7D HTTP 302
https://s2s.t13.io/setuid?bidder=grid&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=d1a5a299-cf60-40ca-b5c1-b9c7677447ed

110 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/ 72 KB
16 KB 151ms
58ms Document
text/html 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

ae0e6db72d62448d03206ef23949585ff1392afcfafaa92cf30df3942f7b2d84

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src 'sha256-0EzT5rjCdQIs7Zb99eHUlAOmKUanRXRrJoqJ+VYepto=' 'sha256-5CxqAdDXlHviOy7zxeRpMobzRK/JNpLvkS+k8Zj3L3A=' 'sha256-FIBGC/wl1Qfnh2Fb5NPFHmRty7BHJdDpWW1FZ8egppI=' 'sha256-UXYprBCAtnqoL5acf14iemip/+HI+gDFh92yyXkM3XI=' 'sha256-dKn2nAtwgzaaXC8ZM58hhldxNyeuu4qrzW4H9//9YMA=' 'sha256-i9nAf5M9USb+lB7ZtayKdAWymLU1MCklCTdsyXbMgCs=' 'sha256-wjUSvXYNfPUUTPZYrn4pOEcf2ecDdjd3N9Av3GDSwZw=' 'sha256-yAAlWuem9ue55JEvxkWhcWWA1Zu0p6cgbYtDWJjsdvs=' blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=60
content-encoding: br
content-length: 14342
content-security-policy: default-src * blob: data:; script-src 'sha256-0EzT5rjCdQIs7Zb99eHUlAOmKUanRXRrJoqJ+VYepto=' 'sha256-5CxqAdDXlHviOy7zxeRpMobzRK/JNpLvkS+k8Zj3L3A=' 'sha256-FIBGC/wl1Qfnh2Fb5NPFHmRty7BHJdDpWW1FZ8egppI=' 'sha256-UXYprBCAtnqoL5acf14iemip/+HI+gDFh92yyXkM3XI=' 'sha256-dKn2nAtwgzaaXC8ZM58hhldxNyeuu4qrzW4H9//9YMA=' 'sha256-i9nAf5M9USb+lB7ZtayKdAWymLU1MCklCTdsyXbMgCs=' 'sha256-wjUSvXYNfPUUTPZYrn4pOEcf2ecDdjd3N9Av3GDSwZw=' 'sha256-yAAlWuem9ue55JEvxkWhcWWA1Zu0p6cgbYtDWJjsdvs=' blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-type: text/html; charset=UTF-8
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-eng"
date: Wed, 06 Sep 2023 16:58:39 GMT
expires: Wed, 06 Sep 2023 16:58:39 GMT
last-modified: Wed, 06 Sep 2023 16:58:05 GMT
link: <https://cdn.ampproject.org/rtv/012308242321000/v0.mjs>; rel=preload; as=script; crossorigin=anonymous
nel: {"report_to":"nel","max_age":604800,"success_fraction":0.05}
report-to: {"group":"nel","max_age":604800,"endpoints":[{"url":"https://beacons.gcp.gvt2.com/nel/upload-nel"},{"url":"https://beacons.gvt2.com/nel/upload-nel"}]} {"group":"amphtml-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-eng"}]}
server: sffe
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-page-speed: 0.9.10.99-9999
x-xss-protection: 0

GET
H2 200 v0.mjs Show response
cdn.ampproject.org/rtv/012308242321000/ 222 KB
63 KB 132ms
38ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

9725ce9e98b7256b2b695b227d77376a0a8f80870f9ce43fb31cf519b499297c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:46:38 GMT
age: 83521
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63422
x-xss-protection: 0
server: sffe
etag: "ce99ac7a5dd39682"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:46:38 GMT

GET
H2 200 amp-ad-network-doubleclick-impl-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 205 KB
56 KB 152ms
60ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-ad-network-doubleclick-impl-0.1.mjs

Requested by

Host: www-bleepingcomputer-com.cdn.ampproject.org
URL: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

a61f44aae196001a02d0a7bd021053747ceec0fa7e9802bd8d348fbde53f1337

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:46:55 GMT
age: 83504
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57034
x-xss-protection: 0
server: sffe
etag: "63016a5318710629"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:46:55 GMT

GET
H2 200 amp-access-scroll-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 14 KB
5 KB 182ms
89ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-access-scroll-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

45adaee20fd66b88ac715b8b3de8287ff6cb7a14fba471c3da5cd83008b26dfe

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:59:22 GMT
age: 82757
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5233
x-xss-protection: 0
server: sffe
etag: "2a9a00dbdbef2fa4"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:59:22 GMT

GET
H2 200 amp-ad-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 74 KB
21 KB 162ms
70ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-ad-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

af6ac725473232e72ad3a929586ed3987e5facb3156db5c4e7009b6aab4cc62a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:46:55 GMT
age: 83504
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21132
x-xss-protection: 0
server: sffe
etag: "413b3a678f706e2d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:46:55 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 94 KB
28 KB 182ms
90ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-analytics-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

89ed60c2430a2b74aef19da3b9772bdc13a537913237e4c56b5e70afb44b30d4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:46:38 GMT
age: 83521
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28985
x-xss-protection: 0
server: sffe
etag: "5eddddcee353b97b"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:46:38 GMT

GET
H2 200 amp-connatix-player-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 9 KB
3 KB 180ms
89ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-connatix-player-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

89ce8636db740d22f999c227d849610f1e40f012a10240b45281281056a93c58

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:49:24 GMT
age: 83355
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3345
x-xss-protection: 0
server: sffe
etag: "ee3dbf175de29729"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:49:24 GMT

GET
H2 200 amp-consent-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 51 KB
15 KB 179ms
87ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-consent-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

a151209208d23523e749b388b7bd37f2dec2305dfdec7d82cba9b07f8b815a90

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:47:39 GMT
age: 83460
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15635
x-xss-protection: 0
server: sffe
etag: "8483ad2af1a0d74f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:47:39 GMT

GET
H2 200 amp-geo-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 9 KB
4 KB 189ms
97ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-geo-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

bc1df93393aed23299a050a7188c52ee15de8847b6ac30d3d91330e6e3251f04

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Wed, 06 Sep 2023 16:58:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3589
x-xss-protection: 0
server: sffe
etag: "b670b83e360c455d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=1800
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 06 Sep 2023 16:58:39 GMT

GET
H2 200 amp-iframe-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 20 KB
7 KB 186ms
95ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-iframe-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

9172af40aaee472d31445077de9f18f59a45c0e1929a7caf9893cadfd0f187b0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:46:38 GMT
age: 83521
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7396
x-xss-protection: 0
server: sffe
etag: "c0f5b68972d2b968"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:46:38 GMT

GET
H2 200 amp-sidebar-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 25 KB
8 KB 188ms
97ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-sidebar-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

bf6c8f7c4f7ec20371e5ccd3fb56f691be572e4ab733295aade88e529aa8b066

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:46:55 GMT
age: 83504
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8229
x-xss-protection: 0
server: sffe
etag: "8ea6156239671891"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:46:55 GMT

GET
H2 200 amp-social-share-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 12 KB
4 KB 176ms
86ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-social-share-0.1.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

d00e0c743a8c67803b3b7445a148b99d69df5602fc104ce80b3cbf1de5cefbeb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 22:43:41 GMT
age: 65698
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4244
x-xss-protection: 0
server: sffe
etag: "9e6e61ad9605205f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 22:43:41 GMT

GET
H2 200 amp-sticky-ad-1.0.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 37 KB
9 KB 186ms
96ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-sticky-ad-1.0.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

4e971822d6deda6d586ad2b02bb2e231fa7ebcdbd39cc64464a3f3b337523e8b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:46:55 GMT
age: 83504
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9371
x-xss-protection: 0
server: sffe
etag: "f49cd372a1ad9484"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:46:55 GMT

GET
H2 200 Microsoft_365Phishing.png
www-bleepstatic-com.cdn.ampproject.org/i/s/www.bleepstatic.com/content/hl-images/2023/09/06/ 39 KB
39 KB 50ms
46ms Image
image/avif 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www-bleepstatic-com.cdn.ampproject.org/i/s/www.bleepstatic.com/content/hl-images/2023/09/06/Microsoft_365Phishing.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

d9e52a2d2d2bc732d4cc75b77d1230463e77be17eee7c14a78adef587266562c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src 'none'; report-uri https://csp.withgoogle.com/csp/amp
date: Wed, 06 Sep 2023 16:58:39 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
content-disposition: attachment
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40128
x-xss-protection: 0
last-modified: Wed, 06 Sep 2023 10:39:44 GMT
server: sffe
vary: Accept, Origin
report-to: {"group":"amphtml-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-eng"}]}
content-type: image/avif
cache-control: private, max-age=3600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-eng"
expires: Wed, 06 Sep 2023 16:58:39 GMT

POST
H2 204 amp
csp.withgoogle.com/csp/ 0
0 135ms
51ms Other
text/html 142.251.163.141
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csp.withgoogle.com/csp/amp
Requested by: Host: www-bleepingcomputer-com.cdn.ampproject.org
URL: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.163.141 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f141.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: application/csp-report

Response headers

GET
DATA 200
OK truncated
/ 701 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9e9a9edb111820f664ad977b5f26616a422936e7aef262e3b6046f8b59b1bd6

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 688 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b8f89e0d82c43d3a97525d4ee168fc91946709be1094f6f388079a13f6d296b

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e494d2a8aa562f3b9a70b17189c72773423181e84d7602ff499b513d16d52ebd

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 809 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a39f8835e7bc2b24317705fc9ac91ba8687d269306196064c4aa2c837664eff2

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 845 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f17f9ae1f7467ed3b5946727c917a85749816d561312499ae93cf8158ade604

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 calendar.png
www-bleepstatic-com.cdn.ampproject.org/i/s/www.bleepstatic.com/images/site/ 126 B
223 B 59ms
59ms Image
image/webp 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www-bleepstatic-com.cdn.ampproject.org/i/s/www.bleepstatic.com/images/site/calendar.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

2eb57ddeb8664d62b0e94484989416c59f5e5c1533f028493c7e3c9f0f188a14

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src 'none'; report-uri https://csp.withgoogle.com/csp/amp
date: Wed, 06 Sep 2023 16:58:39 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
content-disposition: attachment
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 126
x-xss-protection: 0
last-modified: Sat, 26 Aug 2023 13:11:08 GMT
server: sffe
vary: Accept, Origin
report-to: {"group":"amphtml-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-eng"}]}
content-type: image/webp
cache-control: private, max-age=3600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-eng"
expires: Wed, 06 Sep 2023 16:58:39 GMT

GET
H2 200 clock.png
www-bleepstatic-com.cdn.ampproject.org/i/s/www.bleepstatic.com/images/site/ 270 B
367 B 58ms
58ms Image
image/webp 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www-bleepstatic-com.cdn.ampproject.org/i/s/www.bleepstatic.com/images/site/clock.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

dc45e0ee9bf2f54f1c99c686ac1a9e8f127a3f1d2c84d228f04ec99d465f9411

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src 'none'; report-uri https://csp.withgoogle.com/csp/amp
date: Wed, 06 Sep 2023 16:58:39 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
content-disposition: attachment
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 270
x-xss-protection: 0
last-modified: Thu, 17 Aug 2023 05:34:17 GMT
server: sffe
vary: Accept, Origin
report-to: {"group":"amphtml-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-eng"}]}
content-type: image/webp
cache-control: private, max-age=3600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-eng"
expires: Wed, 06 Sep 2023 16:58:39 GMT

GET
H2 200 h4-bg.png
www-bleepstatic-com.cdn.ampproject.org/i/s/www.bleepstatic.com/images/site/ 44 B
150 B 57ms
57ms Image
image/webp 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www-bleepstatic-com.cdn.ampproject.org/i/s/www.bleepstatic.com/images/site/h4-bg.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

54e4f87c2eb4c031349981152407137f297024fdebce949114fabd2088d2f864

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src 'none'; report-uri https://csp.withgoogle.com/csp/amp
date: Wed, 06 Sep 2023 16:58:39 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
content-disposition: attachment
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44
x-xss-protection: 0
last-modified: Sat, 12 Aug 2023 13:29:58 GMT
server: sffe
vary: Accept, Origin
report-to: {"group":"amphtml-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-eng"}]}
content-type: image/webp
cache-control: private, max-age=3600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-eng"
expires: Wed, 06 Sep 2023 16:58:39 GMT

GET
H2 200 logo.png
www-bleepstatic-com.cdn.ampproject.org/ii/w330/s/www.bleepstatic.com/images/site/ 1 KB
1 KB 46ms
45ms Image
image/webp 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www-bleepstatic-com.cdn.ampproject.org/ii/w330/s/www.bleepstatic.com/images/site/logo.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

daf5e4f25290e537de92d4d1d3f5c1063be702961b53c55d16661a0ba2082853

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src 'none'; report-uri https://csp.withgoogle.com/csp/amp
date: Wed, 06 Sep 2023 16:58:39 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
content-disposition: attachment
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1260
x-xss-protection: 0
last-modified: Sat, 12 Aug 2023 13:06:30 GMT
server: sffe
vary: Accept, Origin
report-to: {"group":"amphtml-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-eng"}]}
content-type: image/webp
cache-control: private, max-age=3600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-eng"
expires: Wed, 06 Sep 2023 16:58:39 GMT

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 W3LL_tools-BEC_attack.png
www-bleepstatic-com.cdn.ampproject.org/i/s/www.bleepstatic.com/images/news/u/1100723/ 89 KB
89 KB 50ms
50ms Image
image/avif 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www-bleepstatic-com.cdn.ampproject.org/i/s/www.bleepstatic.com/images/news/u/1100723/W3LL_tools-BEC_attack.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

ae083a74aa4f1888843f37f4bf510e072cb0e9c31ec6136d598ed977cc507dbc

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src 'none'; report-uri https://csp.withgoogle.com/csp/amp
date: Wed, 06 Sep 2023 16:58:39 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
content-disposition: attachment
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 90851
x-xss-protection: 0
last-modified: Wed, 06 Sep 2023 10:40:20 GMT
server: sffe
vary: Accept, Origin
report-to: {"group":"amphtml-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-eng"}]}
content-type: image/avif
cache-control: private, max-age=3600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-eng"
expires: Wed, 06 Sep 2023 16:58:39 GMT

GET
H2 200 amp-auto-lightbox-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 7 KB
3 KB 36ms
36ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-auto-lightbox-0.1.mjs

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

6ad13e1d009a41237cd7bae2b1ed72d4b472ac22faba25f5eae4f4c3c9582fdc

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:46:38 GMT
age: 83521
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2820
x-xss-protection: 0
server: sffe
etag: "ffc00a92cbc9928f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:46:38 GMT

GET
DATA 200
OK truncated
/ 185 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 666df6b58ed258a39995d5a62841b537e67860d4b0a11096f0b2366e661571d5

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 393 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43fdbad1e70b4ca4f893ab921a117375f407ea61cfe84f8530d44e9dc75afb28

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 394 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a4469ab0c7ce65d2198202049fd355d98f792af76a35177918585c167bbbb5e1

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 227 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf5e73ce29fe3acfe7df3893d33ce608323928a2643dfc84725a3b0217baa1f5

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 amp-loader-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 12 KB
4 KB 37ms
37ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-loader-0.1.mjs

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

5429828ab58913835e65d2dddad3838b488f7ab32f57787208fc20b6ee27bff4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:46:55 GMT
age: 83505
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3915
x-xss-protection: 0
server: sffe
etag: "ec53bcecbc1d6f0f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:46:55 GMT

GET
H2 200 index.html Show response
amp.cntxcdm.com/amp-embed/ Frame 9FCE 3 KB
2 KB 169ms
122ms Document
text/html 104.18.38.199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://amp.cntxcdm.com/amp-embed/index.html?playerId=ps_067e5169-ece3-4ce8-87ad-c7961b8bb396&mediaId=d59f5d0c-2087-416a-821c-141798bc501e&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0/amp-connatix-player-0.1.mjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.38.199 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b95095c2cc3c21094dfac58fa1c0d4fc95b7b5e544d8bce3d16c8a74a40c7b8

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 802842106a1b3739-YYZ
content-encoding: gzip
content-type: text/html
date: Wed, 06 Sep 2023 16:58:40 GMT
last-modified: Wed, 15 Mar 2023 12:16:04 GMT
server: cloudflare
x-amz-id-2: nHjiNdMoYti77NxxCbjwYqRMgiGDlfwg8YQzwA28UItzQZ1spjAPgVQrnElKx0/n2y7Ydkw6Xqc=
x-amz-request-id: 3C3RSGYXRV76MBYT
x-amz-server-side-encryption: AES256

GET
H2 200 floors Show response
api.floors.dev/sgw/v1/amp/ 55 B
630 B 85ms
48ms Fetch
application/json 34.160.128.112
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.floors.dev/sgw/v1/amp/floors?k=QBNaieBwWeBYMRGsreCNdCsuWLTtmZ&sid=22405260961&__amp_source_origin=https%3A%2F%2Fwww.bleepingcomputer.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.128.112 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

112.128.160.34.bc.googleusercontent.com

Software

Resource Hash

bebcf1da92ed796addec689fc3568d9686611a6ee8a1ddcc90e5f769bae9aa79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains;preload;

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:40 GMT
strict-transport-security: max-age=31536000;includeSubDomains;preload;
via: 1.1 google
cache-status: miss
access-control-max-age: 3600
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
content-type: application/json
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 229 B
794 B 296ms
245ms Fetch
application/json 3.161.212.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&pubid=16268e26-dabe-4bf4-a28f-b8f4ee192ed3&amp=1&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&slots=%5B%7B%22sd%22%3A%22%2F15188745%2C1006593%2FFS-BleepingComputer%2FAMP-1%22%2C%22s%22%3A%5B%22336x280%22%5D%2C%22ms%22%3A%22300x250%2C250x250%22%7D%5D&pj=%7B%22amp%22%3A%221%22%7D&gdprc=&__amp_source_origin=https%3A%2F%2Fwww.bleepingcomputer.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.212.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-212-32.yul62.r.cloudfront.net

Software

Server /

Resource Hash

5c683a7e36d351813e3a4919f1d3f0b7a4bef45be3dc4caa5cf69b5d1d13e7f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 82411d437ee2d2355a407b78473e6156.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
x-cache: Miss from cloudfront
content-length: 229
amp-access-control-allow-source-origin: https://www.bleepingcomputer.com
server: Server
x-amz-rid: T0Z4NJARTBED7HSE8TY6
vary: Accept-Encoding,User-Agent
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials: true
timing-allow-origin: *
x-amz-cf-id: J3OUK0meP07UBEwfO6KAKgQ9UJouuWRF-PFIz_L435MD2uEsozhyBQ==

GET
H2 200 rtc Show response
bidder.criteo.com/amp/ 16 B
450 B 116ms
51ms Fetch
application/json 74.119.119.129
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/amp/rtc?zid=1382491&nid=4905&psubid=FS-BleepingComputer-AMP-1&lir=LINE_ITEM_RANGES&w=336&h=280&ow=&oh=&ms=300x250%2C250x250&slot=%2F15188745%2C1006593%2FFS-BleepingComputer%2FAMP-1&timeout=1000&curl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&href=https%3A%2F%2Fwww-bleepingcomputer-com.cdn.ampproject.org%2Fc%2Fs%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&cst=3&cst_str=&cst_type=&cst_gdpr_applies=&__amp_source_origin=https%3A%2F%2Fwww.bleepingcomputer.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.129 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

bidder.va1.vip.prod.criteo.com

Software

Kestrel /

Resource Hash

d399f9c8c92526fb78b76514e4071a337e24370882e9a3dbf1b649f5cc289716

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:39 GMT
content-encoding: br
amp-access-control-allow-source-origin: https://www.bleepingcomputer.com
server: Kestrel
strict-transport-security: max-age=31536000; preload;
vary: Origin, Accept-Encoding, Origin
content-type: application/json
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

GET
H2 200 floors Show response
api.floors.dev/sgw/v1/amp/ 55 B
112 B 108ms
75ms Fetch
application/json 34.160.128.112
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.floors.dev/sgw/v1/amp/floors?k=QBNaieBwWeBYMRGsreCNdCsuWLTtmZ&sid=22405267756&__amp_source_origin=https%3A%2F%2Fwww.bleepingcomputer.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.128.112 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

112.128.160.34.bc.googleusercontent.com

Software

Resource Hash

bebcf1da92ed796addec689fc3568d9686611a6ee8a1ddcc90e5f769bae9aa79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains;preload;

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:40 GMT
strict-transport-security: max-age=31536000;includeSubDomains;preload;
via: 1.1 google
cache-status: miss
access-control-max-age: 3600
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
content-type: application/json
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 227 B
795 B 192ms
146ms Fetch
application/json 3.161.212.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&pubid=16268e26-dabe-4bf4-a28f-b8f4ee192ed3&amp=1&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&slots=%5B%7B%22sd%22%3A%22%2F15188745%2C1006593%2FFS-BleepingComputer%2FAMP-Sticky%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22ms%22%3A%22300x50%22%7D%5D&pj=%7B%22amp%22%3A%221%22%7D&gdprc=&__amp_source_origin=https%3A%2F%2Fwww.bleepingcomputer.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.212.32 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-212-32.yul62.r.cloudfront.net

Software

Server /

Resource Hash

f2a4849348226f39d59a86cf16f20b5a775e41a0d609762b2bef8a1db21b7370

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 82411d437ee2d2355a407b78473e6156.cloudfront.net (CloudFront)
x-amz-cf-pop: YUL62-P1
x-cache: Miss from cloudfront
content-length: 227
amp-access-control-allow-source-origin: https://www.bleepingcomputer.com
server: Server
x-amz-rid: SG3CYJ3WJ9JJG53B7DNJ
vary: Accept-Encoding,User-Agent
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials: true
timing-allow-origin: *
x-amz-cf-id: IPCFgawBXQCBhQUkIfSZXXyNhUnWlqqePe8VxbkzFXAlSd6wA5SHNg==

GET
H2 200 rtc Show response
bidder.criteo.com/amp/ 16 B
449 B 122ms
61ms Fetch
application/json 74.119.119.129
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/amp/rtc?zid=1382490&nid=4905&psubid=FS-BleepingComputer-AMP-Sticky&lir=LINE_ITEM_RANGES&w=320&h=50&ow=&oh=&ms=300x50&slot=%2F15188745%2C1006593%2FFS-BleepingComputer%2FAMP-Sticky&timeout=1000&curl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&href=https%3A%2F%2Fwww-bleepingcomputer-com.cdn.ampproject.org%2Fc%2Fs%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&cst=3&cst_str=&cst_type=&cst_gdpr_applies=&__amp_source_origin=https%3A%2F%2Fwww.bleepingcomputer.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.129 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

bidder.va1.vip.prod.criteo.com

Software

Kestrel /

Resource Hash

d399f9c8c92526fb78b76514e4071a337e24370882e9a3dbf1b649f5cc289716

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:39 GMT
content-encoding: br
amp-access-control-allow-source-origin: https://www.bleepingcomputer.com
server: Kestrel
strict-transport-security: max-age=31536000; preload;
vary: Origin, Accept-Encoding, Origin
content-type: application/json
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin

GET
H2 200 load-cookie.html Show response
static.s2s.t13.io/generic/ Frame ABDE 6 KB
7 KB 57ms
17ms Document
text/html 34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.s2s.t13.io/generic/load-cookie.html?source=amp
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0/amp-iframe-0.1.mjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 46a3f17f8cb68df9b20927ab47da4fcc45cf5540174fb3d5964fc43ddb6008ae

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: *
age: 615
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 6602
content-type: text/html
date: Wed, 06 Sep 2023 16:48:25 GMT
etag: "0a8543827b033daefc9859fbe19ff0fb"
last-modified: Mon, 24 Apr 2023 15:48:06 GMT
server: UploadServer
x-client-geo-location: CA,Toronto
x-goog-generation: 1682351286569980
x-goog-hash: crc32c=+eG8Hw== md5=CoVDgnsDPa78mFn74Z/w+w==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 6602
x-guploader-uploadid: ADPycdvV5ZF3okclZT-W7hmOQBziYOaFujcOEjlGKrUG1OLYewV88BUr9Cv6pb0wDcgnIkEZlQZ5W4kQJkl5c_n8GkWomg

POST
H2 204 amp
csp.withgoogle.com/csp/ Frame 9FCE 0
0 55ms
55ms Other
text/html 142.251.163.141
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csp.withgoogle.com/csp/amp
Requested by: Host: www-bleepingcomputer-com.cdn.ampproject.org
URL: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.163.141 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f141.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: application/csp-report

Response headers

POST amp
csp.withgoogle.com/csp/ Frame ABDE 0
0

GET
H2 200 amp Show response
s2s.t13.io/openrtb2/ 305 B
256 B 198ms
161ms Fetch
application/json 34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://s2s.t13.io/openrtb2/amp?tag_id=9462f8a6-a460-4532-a36c-fc6a68f59b72&w=336&h=280&ow=&oh=&ms=300x250%2C250x250&slot=%2F15188745%2C1006593%2FFS-BleepingComputer%2FAMP-1&targeting=&curl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&timeout=1000&adc=yLDV87uzx3GToAcRGujNv3fZl5BQNuNv15ObkO01zEvZ-utUl3WqxEFFs-0DUwyH&purl=https%3A%2F%2Fwww-bleepingcomputer-com.cdn.ampproject.org%2Fc%2Fs%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&consent_string=&account=9a3c6c23-453a-4cba-b419-30b908f39a50&gdpr_applies=&addtl_consent=&consent_type=&__amp_source_origin=https%3A%2F%2Fwww.bleepingcomputer.com
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: df73fdecc6d97c51e7addfdd8743ebd2d77e93a306c1d11aad408ca0212284e6

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: gzip
via: 1.1 google
amp-access-control-allow-source-origin: https://www.bleepingcomputer.com
x-prebid: pbs-java/1.125.0
content-type: application/json
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 186
expires: 0

GET
H2 200 getrtc Show response
amprtc.media.net/rtb/ 42 B
392 B 403ms
115ms Fetch
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://amprtc.media.net/rtb/getrtc?cid=8CU8ZT2C4&w=336&h=280&ow=&oh=&ms=300x250%2C250x250&slot=%2F15188745%2C1006593%2FFS-BleepingComputer%2FAMP-1&tgt=&curl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&to=1000&purl=https%3A%2F%2Fwww-bleepingcomputer-com.cdn.ampproject.org%2Fc%2Fs%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&cste=3&cstr=&adcid=yLDV87uzx3GToAcRGujNv3fZl5BQNuNv15ObkO01zEvZ-utUl3WqxEFFs-0DUwyH&dmsv=false&ep=2122&st=0&ph=12557&bks=visible&ref=&dj=&cst_type=&gdpr_applies=&__amp_source_origin=https%3A%2F%2Fwww.bleepingcomputer.com
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: c3b388904d770590bd781fc54e1d3ec7c2f7c7032141a823a8b3c94a6c0a3106

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:40 GMT
via: 1.1 google
amp-access-control-allow-source-origin: https://www.bleepingcomputer.com
server: nginx
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
access-control-expose-headers: Amp-Access-Control-Allow-Source-Origin
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Wed, 06 Sep 2023 16:58:40 GMT

GET
H2 200 amp Show response
s2s.t13.io/openrtb2/ 407 B
456 B 180ms
144ms Fetch
application/json 34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://s2s.t13.io/openrtb2/amp?tag_id=7c14674e-a20e-4370-9681-7e0282602665&w=320&h=50&ow=&oh=&ms=300x50&slot=%2F15188745%2C1006593%2FFS-BleepingComputer%2FAMP-Sticky&targeting=&curl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&timeout=1000&adc=yLDV87uzx3GToAcRGujNv3fZl5BQNuNv15ObkO01zEvZ-utUl3WqxEFFs-0DUwyH&purl=https%3A%2F%2Fwww-bleepingcomputer-com.cdn.ampproject.org%2Fc%2Fs%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&consent_string=&account=9a3c6c23-453a-4cba-b419-30b908f39a50&gdpr_applies=&addtl_consent=&consent_type=&__amp_source_origin=https%3A%2F%2Fwww.bleepingcomputer.com
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: b307fc7d89529c99d73cfd64ed7b4c360d6314ed5286d7f9bbc0954822b94bc4

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: gzip
via: 1.1 google
amp-access-control-allow-source-origin: https://www.bleepingcomputer.com
x-prebid: pbs-java/1.125.0
content-type: application/json
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 227
expires: 0

GET
H2 200 getrtc Show response
amprtc.media.net/rtb/ 42 B
106 B 423ms
136ms Fetch
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://amprtc.media.net/rtb/getrtc?cid=8CU8ZT2C4&w=320&h=50&ow=&oh=&ms=300x50&slot=%2F15188745%2C1006593%2FFS-BleepingComputer%2FAMP-Sticky&tgt=&curl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&to=1000&purl=https%3A%2F%2Fwww-bleepingcomputer-com.cdn.ampproject.org%2Fc%2Fs%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&cste=3&cstr=&adcid=yLDV87uzx3GToAcRGujNv3fZl5BQNuNv15ObkO01zEvZ-utUl3WqxEFFs-0DUwyH&dmsv=&ep=1150&st=0&ph=12557&bks=visible&ref=&dj=&cst_type=&gdpr_applies=&__amp_source_origin=https%3A%2F%2Fwww.bleepingcomputer.com
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: c3b388904d770590bd781fc54e1d3ec7c2f7c7032141a823a8b3c94a6c0a3106

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:40 GMT
via: 1.1 google
amp-access-control-allow-source-origin: https://www.bleepingcomputer.com
server: nginx
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
access-control-expose-headers: Amp-Access-Control-Allow-Source-Origin
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Wed, 06 Sep 2023 16:58:40 GMT

GET
H3 200 amp-lightbox-gallery-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 56 KB
17 KB 36ms
36ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-lightbox-gallery-0.1.mjs

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

c1b348bdf4b929ce74128fd462539ce9290b75098e30422efedfac8678165112

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:47:31 GMT
age: 83469
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16913
x-xss-protection: 0
server: sffe
etag: "f8d227ca17c13d16"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:47:31 GMT

GET
H2 200 fsxiiq.js Show response
static.s2s.t13.io/core/ Frame ABDE 2 KB
3 KB 19ms
18ms Script
text/javascript 34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.s2s.t13.io/core/fsxiiq.js
Requested by: Host: static.s2s.t13.io
URL: https://static.s2s.t13.io/generic/load-cookie.html?source=amp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 7b8f6f9410206de2e649174673868658a8f8358c4cb87ed3cda1448c5cd0fda4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://static.s2s.t13.io/generic/load-cookie.html?source=amp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:21:29 GMT
age: 2231
x-client-geo-location: CA,Toronto
x-guploader-uploadid: ADPycdstNPztfK4ycrDQ7SQdNn2h4KqfSphg5yC9lok4a3JMs2lL2DmU9NFNDBWJAiEtHyui1taSWfNvDZn5H2az6YCyWg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2536
last-modified: Thu, 27 Apr 2023 15:03:59 GMT
server: UploadServer
etag: "21318457d1f4747a2c8219833b7085b5"
x-goog-generation: 1682607839430388
x-goog-hash: crc32c=1h8BQw==, md5=ITGEV9H0dHosghmDO3CFtQ==
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public,max-age=3600
x-goog-stored-content-length: 2536
accept-ranges: bytes
content-type: text/javascript

POST
H2 200 cookie_sync Show response
s2s.t13.io/ Frame ABDE 3 KB
891 B 42ms
41ms XHR
application/json 34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://s2s.t13.io/cookie_sync
Requested by: Host: static.s2s.t13.io
URL: https://static.s2s.t13.io/generic/load-cookie.html?source=amp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: f42c1a716a90460aab166aecd314753f0a9fa273c4a8120378fd50813c109482

Request headers

Referer: https://static.s2s.t13.io/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: gzip
via: 1.1 google
content-type: application/json
access-control-allow-origin: https://static.s2s.t13.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 668
expires: 0

GET
H2

200

setuid
s2s.t13.io/ Frame ABDE
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=l3a2x8p&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=&redir=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=l3a2x8p&ttd_tpi=1&gdpr=0&gdpr_consent=&us_privacy=&redir=
https://s2s.t13.io/setuid?bidder=ttdfsx&gdpr=0&gdpr_consent=&uid=fe8f5910-c96c-4bfd-a0c9-e6d2bcb0c838

86 B
383 B

40ms
40ms

Image
image/png

34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2s.t13.io/setuid?bidder=ttdfsx&gdpr=0&gdpr_consent=&uid=fe8f5910-c96c-4bfd-a0c9-e6d2bcb0c838
Requested by: Host: www-bleepingcomputer-com.cdn.ampproject.org
URL: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Protocol: H2
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://static.s2s.t13.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: gzip
via: 1.1 google
content-type: image/png
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

Redirect headers

location: https://s2s.t13.io/setuid?bidder=ttdfsx&gdpr=0&gdpr_consent=&uid=fe8f5910-c96c-4bfd-a0c9-e6d2bcb0c838
date: Wed, 06 Sep 2023 16:58:40 GMT
server: Kestrel
content-length: 233

GET
H2 200 connatix.playspace.js Show response
cd.connatix.com/ Frame 7FA3 8 KB
4 KB 74ms
29ms Script
application/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cd.connatix.com/connatix.playspace.js
Requested by: Host: amp.cntxcdm.com
URL: https://amp.cntxcdm.com/amp-embed/index.html?playerId=ps_067e5169-ece3-4ce8-87ad-c7961b8bb396&mediaId=d59f5d0c-2087-416a-821c-141798bc501e&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83c6eadaf115f9ca16b4d1976d984e03e901af6eb0784724de167b3418933001

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 802842119ccba1f2-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

GET
H2 200 si
capi.connatix.com/tr/ Frame 9FCE 0
87 B 310ms
59ms Image
application/json 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/tr/si?token=067e5169-ece3-4ce8-87ad-c7961b8bb396
Requested by: Host: amp.cntxcdm.com
URL: https://amp.cntxcdm.com/amp-embed/index.html?playerId=ps_067e5169-ece3-4ce8-87ad-c7961b8bb396&mediaId=d59f5d0c-2087-416a-821c-141798bc501e&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/json
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 80284212eeb1a1f2-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 connatix.playspace.js Show response
cds.connatix.com/p/330092/ Frame 7FA3 1 MB
300 KB 50ms
41ms Script
application/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/330092/connatix.playspace.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a309430af06228da4bfdff81aa58e65c45ef62e27b85044726ae765bc0e0f169

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
x-amz-version-id: lljDEraJr9iuw7qJMKfIF026LNvIY8tl
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 06 Sep 2023 08:52:36 GMT
server: cloudflare
etag: W/"c4c44ebe29dada87ccebcfd40c2f5b8b"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 80284211dd1ea1f2-YYZ
access-control-allow-headers: range
expires: Thu, 05 Sep 2024 16:58:40 GMT

GET
H3

200

setuid
s2s.t13.io/ Frame ABDE
Redirect Chain

https://x.bidswitch.net/sync?ssp=sortable&gdpr=0&gdpr_consent=&us_privacy=&redir=
https://x.bidswitch.net/ul_cb/sync?ssp=sortable&gdpr=0&gdpr_consent=&us_privacy=&redir=
https://sync.srv.stackadapt.com/sync?nid=50&gdpr=0&gdpr_consent=&gdpr_pd=&ssp=sortable
https://x.bidswitch.net/sync?dsp_id=188&user_id=gQwBUS5vW59-KvyI8l031VYwD6k&user_group=1&ssp=sortable&gdpr=0
https://s2s.t13.io/setuid?bidder=bidswitch&gdpr=0&gdpr_consent=&us_privacy=&uid=d1a5a299-cf60-40ca-b5c1-b9c7677447ed

86 B
117 B

84ms
84ms

Image
image/png

34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2s.t13.io/setuid?bidder=bidswitch&gdpr=0&gdpr_consent=&us_privacy=&uid=d1a5a299-cf60-40ca-b5c1-b9c7677447ed
Protocol: H3
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://static.s2s.t13.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: gzip
via: 1.1 google
content-type: image/png
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

Redirect headers

Location: //s2s.t13.io/setuid?bidder=bidswitch&gdpr=0&gdpr_consent=&us_privacy=&uid=d1a5a299-cf60-40ca-b5c1-b9c7677447ed
Date: Wed, 06 Sep 2023 16:58:40 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

sync Show response
capi.connatix.com/core/ Frame 7FA3
Redirect Chain

https://capi.connatix.com/core/sync?v=330092
https://capi.connatix.com/core/sync?v=330092&tier=1&final=true&ImplementationType=1

5 KB
2 KB

72ms
71ms

XHR
application/json

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/sync?v=330092&tier=1&final=true&ImplementationType=1
Requested by: Host: amp.cntxcdm.com
URL: https://amp.cntxcdm.com/amp-embed/index.html?playerId=ps_067e5169-ece3-4ce8-87ad-c7961b8bb396&mediaId=d59f5d0c-2087-416a-821c-141798bc501e&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F
Protocol: H2
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 463e8998c5c739800a726925a426c9a8990452e13ddda9497946f16fdad62ca7

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://amp.cntxcdm.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 80284213affaa1f2-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Wed, 06 Sep 2023 16:58:40 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-protobuf
location: https://capi.connatix.com:443/core/sync?v=330092&tier=1&final=true&ImplementationType=1
access-control-allow-origin: https://amp.cntxcdm.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 802842130ed8a1f2-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 connatix.playspace.css
cds.connatix.com/p/330092/ Frame 9FCE 117 KB
18 KB 33ms
31ms Stylesheet
text/css 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/330092/connatix.playspace.css
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/330092/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2843e03ac951f0c5bb836f80c1cfd7550a56f33f95f117a9a08f8820e104f008

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
x-amz-version-id: eaPO3HctrE44Vn5LIfMV0O.jSbYNMeQS
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 06 Sep 2023 08:52:36 GMT
server: cloudflare
etag: W/"e6862002aa68fea85f3f7e5ba7e32b4c"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: text/css
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 802842130edfa1f2-YYZ
access-control-allow-headers: range
expires: Thu, 05 Sep 2024 16:58:40 GMT

POST
H2 200 ucl Show response
capi.connatix.com/tr/ Frame 7FA3 0
58 B 64ms
63ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ucl?v=330092
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/330092/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: multipart/form-data

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-protobuf
access-control-allow-origin: https://amp.cntxcdm.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 80284213a804a1f2-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

POST
H2 200 story Show response
capi.connatix.com/core/ Frame 7FA3 33 KB
8 KB 140ms
140ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/story?v=330092
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/330092/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5070cd1642e2a06dee34b7a245e89765efa495e99f4e92cb81701ee2e0cddebb

Request headers

Referer
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: multipart/form-data

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-protobuf
access-control-allow-origin: https://amp.cntxcdm.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 80284213b811a1f2-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 40 KB
17 KB 502ms
427ms Fetch
text/html 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F15188745%2C1006593%2FFS-BleepingComputer%2FAMP-1&adk=3442153961&sz=336x280%7C300x250%7C250x250&output=html&impl=ifr&ifi=1&msz=920x-1&psz=920x-1&fws=4&scp=floors_id%3Dlearning%26floors_hour%3D16%26floors_test%3D4%26t13%3Dr%26floors_user%3D0%26amzniid%3DJIcndW7e7WkjVVHiydaAHbEAAAGKa26HMgEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCUWIve%26amznsz%3D250x250%26amznp%3D1bd2rcw%26amznbid%3Damp_dpxzpc%26amznhost%3Dhttps%253A%252F%252Faax-us-east.amazon-adsystem.com%26mnetDNB%3D1%26mnetCT%3D0&adf=2136609110&nhd=0&adx=632&ady=2122&oid=2&aexp=1002!1102&ptt=13&gdfp_req=1&sfv=1-0-37&u_sd=1&artc=101%2C230%2C304%2C124%2C561&ati=2%2C2%2C2%2C2%2C2&ard=api.floors.dev%2Fsgw%2Fv1%2Famp%2Ffloors%2Ct13%2Caps%2Ccriteo%2Cmedianet&is_amp=3&amp_v=2308242321000&d_imp=1&c=150130008505&ga_cid=yLDV87uzx3GToAcRGujNv3fZl5BQNuNv15ObkO01zEvZ-utUl3WqxEFFs-0DUwyH&ga_hid=8505&dt=1694019520027&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=-420&u_his=2&vis=1&scr_x=0&scr_y=0&bc=7&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&loc=https%3A%2F%2Fwww-bleepingcomputer-com.cdn.ampproject.org%2Fc%2Fs%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&bdt=320&dtd=564&__amp_source_origin=https%3A%2F%2Fwww.bleepingcomputer.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f156.1e100.net

Software

cafe /

Resource Hash

47de2b4d9f31bd5e085075486a5fcc4ccc925e380480c0f2a9a81220df84d6ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:41 GMT
content-encoding: br
x-content-type-options: nosniff
x-ampsafeframeversion: 1-0-40
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
x-ampanalytics: {"url":["https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuQkT2L_TODOt4yqo_Z1-8lHG-HV3ToxJQ8Z9PoIA8Sw5vJxGU43CakbgnmJp3Fy0cwMjtwKnIJrtxzrX_GnxnMMTJ6yFBmR4MRo3hpjyKGmWvzYf3-Cxyscvjs2iYp9qTs00hVw3BfYQ\u0026sai=AMfl-YQyc9UsU0LX9YXefQDJwbudsclZFxfPSacbtWrXrWGj4OaGxqRHzxCJFzyweV1OMLocpxaLnXc5CTM4\u0026sig=Cg0ArKJSzFjosG0yQydLEAE\u0026cid=CAQSGwBpAlJWCfESTS3QDG5pkSVAXnvIOYIr9XYU2RgB\u0026id=ampim\u0026o=${elementX},${elementY}\u0026d=${elementWidth},${elementHeight}\u0026ss=${screenWidth},${screenHeight}\u0026bs=${viewportWidth},${viewportHeight}\u0026mcvt=${maxContinuousVisibleTime}\u0026mtos=0,0,${maxContinuousVisibleTime},${maxContinuousVisibleTime},${maxContinuousVisibleTime}\u0026tos=0,0,${totalVisibleTime},0,0\u0026tfs=${firstSeenTime}\u0026tls=${lastSeenTime}\u0026g=${minVisiblePercentage}\u0026h=${maxVisiblePercentage}\u0026tt=${totalTime}\u0026r=v\u0026avms=ampa\u0026uap=${uach(platform)}\u0026uapv=${uach(platformVersion)}\u0026uaa=${uach(architecture)}\u0026uam=${uach(model)}\u0026uafv=${uach(uaFullVersion)}\u0026uab=${uach(bitness)}\u0026uafvl=${uach(fullVersionList)}\u0026uaw=${uach(wow64)}\u0026adk=3442153961"],"btrUrl":[]}
x-ampadrender: safeframe
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15288
x-xss-protection: 0
amp-fast-fetch-signature: google:1:OSk5oU/6DG7nwWAatau7kfcyPUf1zg+g50iupi9i1ISPWt5FbDkXRm0jUg7QXaUkuC3rYYhbMQInvQilB4/f/HOMdapI8xa4259HYhhHbhu5K1nNVKlcp0GldRXeqxbsJ6tl/R6GEjkLOjntBck45zjVKSZqvclsmhmM3iEElOaWUQzLSAM0EjQwm4tZOl+/54otjwc+Bs8V2bTJ7BLhxA5xGEBLtgfwhPRLZchyrPvQtIYpR989DId9u6i47WvDdZkvQE/OpOjN6M3PCcUAFeawNIEBCL773wmVAyOc9BmKx8ffkZrKYbX/YsHXnAdJWqJFaCPMJq/enBmBzX3G/A==
google-lineitem-id: -1
x-qqid: COOqmb66loEDFQXdswodESEGeQ
amp-access-control-allow-source-origin: https://www.bleepingcomputer.com
server: cafe
google-creative-id: -1
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
access-control-expose-headers: Google-Creative-Id,Google-LineItem-Id,AMP-Access-Control-Allow-Source-Origin,X-AmpAnalytics,X-QQID,amp-ff-sandbox,X-AmpSafeFrameVersion,X-AmpAdRender,x-google-amp-ad-validated-version,AMP-Fast-Fetch-Signature
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
amp-ff-sandbox: true
expires: Wed, 06 Sep 2023 16:58:41 GMT

GET
H2 200 ads
securepubads.g.doubleclick.net/gampad/ 0
0 735ms
661ms Fetch
text/html 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F15188745%2C1006593%2FFS-BleepingComputer%2FAMP-Sticky&adk=1172422905&sz=320x50%7C300x50&output=html&impl=ifr&ifi=2&msz=0x-1&psz=0x-1&fws=4&scp=floors_id%3Dlearning%26floors_hour%3D16%26floors_test%3D10%26t13%3Dr%26floors_user%3D0%26amzniid%3DJFEmXCcWxqjv1X4_q8JKoAwAAAGKa26GygEAAAJYAQBhcHNfdHhuX2JpZDEgICBhcHNfdHhuX2ltcDEgICCYIeFV%26amznsz%3D320x50%26amznp%3Dxk4ykg%26amznbid%3Damp_dpxzpc%26amznhost%3Dhttps%253A%252F%252Faax-us-east.amazon-adsystem.com%26mnetDNB%3D1%26mnetCT%3D0&adf=2336969238&nhd=0&adx=640&ady=1150&oid=2&act=sa&aexp=1002!1102&ptt=13&gdfp_req=1&sfv=1-0-37&u_sd=1&artc=109%2C202%2C195%2C125%2C553&ati=2%2C2%2C2%2C2%2C2&ard=api.floors.dev%2Fsgw%2Fv1%2Famp%2Ffloors%2Ct13%2Caps%2Ccriteo%2Cmedianet&is_amp=3&amp_v=2308242321000&d_imp=1&c=150130008505&ga_cid=yLDV87uzx3GToAcRGujNv3fZl5BQNuNv15ObkO01zEvZ-utUl3WqxEFFs-0DUwyH&ga_hid=8505&dt=1694019520037&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=-420&u_his=2&vis=1&scr_x=0&scr_y=0&bc=7&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&loc=https%3A%2F%2Fwww-bleepingcomputer-com.cdn.ampproject.org%2Fc%2Fs%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&bdt=330&dtd=557&__amp_source_origin=https%3A%2F%2Fwww.bleepingcomputer.com

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

amp-ff-empty-creative: true
date: Wed, 06 Sep 2023 16:58:41 GMT
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
google-lineitem-id: -2
x-qqid: CI_TmL66loEDFVbVswodZWoE9w
amp-access-control-allow-source-origin: https://www.bleepingcomputer.com
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
access-control-expose-headers: Google-Creative-Id,Google-LineItem-Id,AMP-Access-Control-Allow-Source-Origin,X-QQID,amp-ff-empty-creative
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 06 Sep 2023 16:58:41 GMT

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=190549&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d17%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dIndex%26api-tier%3d1%26uid%3d&gdpr=0
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D17%26ev%3D69aeec629e534900901a428166dd614a%26pname%3DIndex%26api-tier%3D1%26uid%3D&gdpr=0&s=190549&C=1
https://cks.connatix.com/cks?pid=17&ev=69aeec629e534900901a428166dd614a&pname=Index&api-tier=1&uid=ZPivw0Gmjdm3XJvwCoFZjgAA%26584

138 B
253 B

31ms
31ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=17&ev=69aeec629e534900901a428166dd614a&pname=Index&api-tier=1&uid=ZPivw0Gmjdm3XJvwCoFZjgAA%26584
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0fd784cfd27a72fe7146482277c566c7c626e877835fe8ffe0d2be2bc46c1f38

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:43 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 802842280bfc3702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

Pragma: no-cache
Date: Wed, 06 Sep 2023 16:58:43 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cks.connatix.com/cks?pid=17&ev=69aeec629e534900901a428166dd614a&pname=Index&api-tier=1&uid=ZPivw0Gmjdm3XJvwCoFZjgAA%26584
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H2

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d15%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dBeeswax%26api-tier%3d1%26uid%3d{userid}&gdpr=0
https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D15%26ev%3D69aeec629e534900901a428166dd614a%26pname%3DBeeswax%26api-tier%3D1%26uid%3D%7Buserid%7D&g...
https://cks.connatix.com/cks?pid=15&ev=69aeec629e534900901a428166dd614a&pname=Beeswax&api-tier=1&uid=AAClAk7J8WAAADjnQPDovg&gdpr=0

132 B
151 B

30ms
29ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=15&ev=69aeec629e534900901a428166dd614a&pname=Beeswax&api-tier=1&uid=AAClAk7J8WAAADjnQPDovg&gdpr=0
Protocol: H2
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 431e4c061f3c040f9e2d17772ab6393d983ffa2a920199b4bf2b5f63d422e402

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 802842154a71a1f2-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=15&ev=69aeec629e534900901a428166dd614a&pname=Beeswax&api-tier=1&uid=AAClAk7J8WAAADjnQPDovg&gdpr=0
Date: Wed, 06 Sep 2023 16:58:40 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gapzaid&ttd_tpi=1&gdpr=0
https://cks.connatix.com/cks?pid=19&uid=fe8f5910-c96c-4bfd-a0c9-e6d2bcb0c838&ttl=1696611520

146 B
163 B

40ms
32ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=19&uid=fe8f5910-c96c-4bfd-a0c9-e6d2bcb0c838&ttl=1696611520
Protocol: H2
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83eb75817ee5ab6dabd335ad513c5895118723630f3e273d58545073499c8d38

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 80284214695fa1f2-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=19&uid=fe8f5910-c96c-4bfd-a0c9-e6d2bcb0c838&ttl=1696611520
date: Wed, 06 Sep 2023 16:58:40 GMT
server: Kestrel
content-length: 213

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://ad.turn.com/r/cs?pid=67&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d21%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dAmobee%26api-tier%3d1%26uid%3D%23USER_ID%23&gdpr=0
https://cks.connatix.com/cks?pid=21&ev=69aeec629e534900901a428166dd614a&pname=Amobee&api-tier=1&uid=7120220350391770329

129 B
241 B

29ms
29ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=21&ev=69aeec629e534900901a428166dd614a&pname=Amobee&api-tier=1&uid=7120220350391770329
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8705985e3b15e3a6eeb76645e22e17ebb00e3af4e508995a632d9775c535bb61

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:41 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 8028421b6eef3702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=21&ev=69aeec629e534900901a428166dd614a&pname=Amobee&api-tier=1&uid=7120220350391770329
pragma: no-cache
date: Wed, 06 Sep 2023 16:58:41 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d25%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dTripleLift%26api-tier%3d1%26uid%3d%24UID&gdpr=0
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D25%26ev%3D69aeec629e534900901a428166dd614a%26pname%3DTripleLift%26api-tier%3D1%26uid%...
https://cks.connatix.com/cks?pid=25&ev=69aeec629e534900901a428166dd614a&pname=TripleLift&api-tier=1&uid=2598518279004013141717

132 B
243 B

27ms
27ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=25&ev=69aeec629e534900901a428166dd614a&pname=TripleLift&api-tier=1&uid=2598518279004013141717
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e6fbe80e77b4229fc276374fa63aee522e03fcade7452eb33539f5a0a580da37

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:43 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 802842280bfa3702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=25&ev=69aeec629e534900901a428166dd614a&pname=TripleLift&api-tier=1&uid=2598518279004013141717
date: Wed, 06 Sep 2023 16:58:43 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://secure.adnxs.com/getuid?https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d6%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dAppNexus%26api-tier%3d1%26uid%3d%24UID&gdpr=0
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fcks.connatix.com%252fcks%253fpid%253d6%2526ev%253d69aeec629e534900901a428166dd614a%2526pname%253dAppNexus%2526api-tier%253d1%2526uid%...
https://cks.connatix.com/cks?pid=6&ev=69aeec629e534900901a428166dd614a&pname=AppNexus&api-tier=1&uid=2966634651961889903&gdpr=0

128 B
241 B

64ms
63ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=6&ev=69aeec629e534900901a428166dd614a&pname=AppNexus&api-tier=1&uid=2966634651961889903&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dab6dd6a5ba8cfec3fcc8047a52906661bb0b13c8b5e3671e5bc47c0b29a9012

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:41 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 8028421b5ecc3702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:41 GMT
an-x-request-uuid: f0d94f28-7b38-4897-b2a8-ddcfee5de647
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cks.connatix.com/cks?pid=6&ev=69aeec629e534900901a428166dd614a&pname=AppNexus&api-tier=1&uid=2966634651961889903&gdpr=0
x-proxy-origin: 86.48.15.169; 86.48.15.169; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET multi-sync.html
secure-assets.rubiconproject.com/utils/xapi/ Frame E8E3 0
0

GET /
ssc-cms.33across.com/ps/ Frame AD8F 0
0

GET userSync.js
ads.pubmatic.com/AdServer/js/ Frame 7FA3 0
0

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=561340&daaqp=1&ev=1&rurl=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d13%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dPulsePoint%26api-tier%3d1%26uid%3d%...
https://cks.connatix.com/cks?pid=13&ev=69aeec629e534900901a428166dd614a&pname=PulsePoint&api-tier=1&uid=Pz5P5nglalOo

122 B
237 B

27ms
26ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=13&ev=69aeec629e534900901a428166dd614a&pname=PulsePoint&api-tier=1&uid=Pz5P5nglalOo
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f050f17713ac55ca5d48a94e05828678d6c2d4dea0458c7d1b9b5cb0bb160a7a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:43 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 80284227bb813702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
location: https://cks.connatix.com/cks?pid=13&ev=69aeec629e534900901a428166dd614a&pname=PulsePoint&api-tier=1&uid=Pz5P5nglalOo
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-cdb79dd64-68zs8
expires: -1

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://i.ctnsnet.com/int/cm?exc=24&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d28%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dCrimtan%26api-tier%3d1%26uid%3d%5Buser_id%5D&gdpr=0
https://cks.connatix.com/cks?pid=28&ev=69aeec629e534900901a428166dd614a&pname=Crimtan&api-tier=1&uid=841657a9f5f940868ac24e47d6a6735a

142 B
251 B

28ms
28ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=28&ev=69aeec629e534900901a428166dd614a&pname=Crimtan&api-tier=1&uid=841657a9f5f940868ac24e47d6a6735a
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c8fa5459084acaf97ab652ac510e648b75b7734bcfe340af2f6df0a968ee966

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:43 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 80284227dbaa3702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:43 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cks.connatix.com/cks?pid=28&ev=69aeec629e534900901a428166dd614a&pname=Crimtan&api-tier=1&uid=841657a9f5f940868ac24e47d6a6735a
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://csync.loopme.me/?redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d18%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dLoopMe%26api-tier%3d1%26uid%3D%7Bdevice_id%7D%26pubid%3D11186&gdpr=0
https://cks.connatix.com/cks?pid=18&ev=69aeec629e534900901a428166dd614a&pname=LoopMe&api-tier=1&uid=88dfa2f0-be78-4110-8083-bbd23fae27ed&pubid=11186&gdpr=0

146 B
253 B

28ms
28ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=18&ev=69aeec629e534900901a428166dd614a&pname=LoopMe&api-tier=1&uid=88dfa2f0-be78-4110-8083-bbd23fae27ed&pubid=11186&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7394e878d8420c3d8df892e183e662eaf38f0762cd719946322ac99dfa84272d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:44 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 802842295db13702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=18&ev=69aeec629e534900901a428166dd614a&pname=LoopMe&api-tier=1&uid=88dfa2f0-be78-4110-8083-bbd23fae27ed&pubid=11186&gdpr=0
date: Wed, 06 Sep 2023 16:58:43 GMT
server: _
content-length: 0

GET
H2

200

1000.gif Show response
id.rlcdn.com/ Frame 9FCE
Redirect Chain

https://id.rlcdn.com/712202.gif?cparams=69aeec629e534900901a428166dd614a&gdpr=0
https://id.rlcdn.com/1000.gif?memo=CIq8KxoNCMPf4qcGEgUI6AcQAEIASiA2OWFlZWM2MjllNTM0OTAwOTAxYTQyODE2NmRkNjE0YQ

42 B
311 B

41ms
41ms

Script
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://id.rlcdn.com/1000.gif?memo=CIq8KxoNCMPf4qcGEgUI6AcQAEIASiA2OWFlZWM2MjllNTM0OTAwOTAxYTQyODE2NmRkNjE0YQ
Requested by: Host: blank
URL: about:blank
Protocol: H2
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:43 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Wed, 06 Sep 2023 16:58:43 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://id.rlcdn.com/1000.gif?memo=CIq8KxoNCMPf4qcGEgUI6AcQAEIASiA2OWFlZWM2MjllNTM0OTAwOTAxYTQyODE2NmRkNjE0YQ
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 204 pixelSync Show response
pixel-sync.sitescout.com/dmp/ Frame 9FCE 0
187 B 145ms
49ms Script
text/plain 207.198.113.203
COGECO-PEER1

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=105&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d9%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dCentro%26api-tier%3d1%26uid%3d{userId}&gdpr=0
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/330092/connatix.playspace.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 207.198.113.203 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Wed, 06 Sep 2023 16:58:40 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://ads.yieldmo.com/pbsync?is=smartnews&redirectUri=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d39%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dYieldMo%26api-tier%3d1%26uid%3D%24UID&gdpr=0
https://cks.connatix.com/cks?pid=39&ev=69aeec629e534900901a428166dd614a&pname=YieldMo&api-tier=1&uid=3RhHuII00HIKYWtZIqD9&gdpr=0

130 B
245 B

30ms
30ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=39&ev=69aeec629e534900901a428166dd614a&pname=YieldMo&api-tier=1&uid=3RhHuII00HIKYWtZIqD9&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dac24dcb32742b27227b084baa7e576e4d945704706b35f9324c95e7aa928448

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:44 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 802842296dca3702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:44 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cks.connatix.com/cks?pid=39&ev=69aeec629e534900901a428166dd614a&pname=YieldMo&api-tier=1&uid=3RhHuII00HIKYWtZIqD9&gdpr=0
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://connatix-supply-partners.tremorhub.com/sync?UISCX=69aeec629e534900901a428166dd614a&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d5%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dTel...
https://cks.connatix.com/cks?pid=5&ev=69aeec629e534900901a428166dd614a&pname=Telaria&api-tier=1&uid=6030ea8ca298403fa927adb384146d0a

141 B
286 B

33ms
32ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=5&ev=69aeec629e534900901a428166dd614a&pname=Telaria&api-tier=1&uid=6030ea8ca298403fa927adb384146d0a
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1defb84a28e78172b9e21eee7b504776d0c5ec719ad5ed63bc97a5a0ed4ebb2a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:41 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 8028421738bf3702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=5&ev=69aeec629e534900901a428166dd614a&pname=Telaria&api-tier=1&uid=6030ea8ca298403fa927adb384146d0a
date: Wed, 06 Sep 2023 16:58:41 GMT
server: nginx
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'

GET
H3

200

us Show response
capi.connatix.com/core/ Frame 9FCE
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3672&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0
https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=28ba1b3c8219df442f203bcb374fed28&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0

0
231 B

53ms
52ms

Script
application/json

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=28ba1b3c8219df442f203bcb374fed28&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:41 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/json
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 802842199d0439f5-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

Redirect headers

Pragma: no-cache
Date: Wed, 06 Sep 2023 16:58:41 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=28ba1b3c8219df442f203bcb374fed28&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1694019521489068-636

GET sync-iframe
cs-server-s2s.yellowblue.io/ Frame 9116 0
0

GET
H/1.1 204
No Content 1a1c07e870d45c05896c3f9e9973d4b4.gif Show response
sync.colossusssp.com/ Frame 9FCE 0
176 B 163ms
55ms Script
text/plain 209.192.253.44
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

https://sync.colossusssp.com/1a1c07e870d45c05896c3f9e9973d4b4.gif?puid=69aeec629e534900901a428166dd614a&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d34%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dColossus%26api-tier%3d1%26uid%3D%5BUID%5D&gdpr=0

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/330092/connatix.playspace.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

209.192.253.44 , United States, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Date: Wed, 06 Sep 2023 16:58:41 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Server: nginx
Connection: keep-alive

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://vop.sundaysky.com/sync/dmp?redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d1%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dSundaySky%26api-tier%3d1%26uid%3d%24{ssky_uuid}&gdpr=0
https://vop.sundaysky.com/sync/dmp?redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d1%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dSundaySky%26api-tier%3d1%26uid%3d%24{ssky_uuid}&gdpr=0&_...
https://cks.connatix.com/cks?pid=1&ev=69aeec629e534900901a428166dd614a&pname=SundaySky&api-tier=1&uid=d6.9ca67c6d2cfe4b0a9a8a10a80802c383

144 B
252 B

31ms
30ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=1&ev=69aeec629e534900901a428166dd614a&pname=SundaySky&api-tier=1&uid=d6.9ca67c6d2cfe4b0a9a8a10a80802c383
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21a413d0ce3f3ef83cefdf6c92dcf47a4d1283a8c52db9a4b1e4ae27e9a314a8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:42 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 80284222196d3702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=1&ev=69aeec629e534900901a428166dd614a&pname=SundaySky&api-tier=1&uid=d6.9ca67c6d2cfe4b0a9a8a10a80802c383
date: Wed, 06 Sep 2023 16:58:42 GMT
x-content-type-options: nosniff
content-length: 0
x-frame-options: DENY
x-xss-protection: 1; mode=block

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://sync.resetdigital.co/csync?pid=connatix&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d35%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dResetDigital%26api-tier%3d1%26uid%3D%24USER_I...
https://cks.connatix.com/cks?pid=35&ev=69aeec629e534900901a428166dd614a&pname=ResetDigital&api-tier=1&uid=0000010E8427BB75

126 B
240 B

29ms
29ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=35&ev=69aeec629e534900901a428166dd614a&pname=ResetDigital&api-tier=1&uid=0000010E8427BB75
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04722325575c6c791a2c50671735905ab15d191e724fc233a9d418b7d06758c5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:41 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 8028421c480f3702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

location: https://cks.connatix.com/cks?pid=35&ev=69aeec629e534900901a428166dd614a&pname=ResetDigital&api-tier=1&uid=0000010E8427BB75
date: Wed, 06 Sep 2023 16:58:41 GMT
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 0
content-type: text/html

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://xsync.iqzone.com/psync?t=s&e=376&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d42%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dIqZone%26api-tier%3d1%26uid%3D%25USER_ID%25&gdpr=0
https://cks.connatix.com/cks?pid=42&ev=69aeec629e534900901a428166dd614a&pname=IqZone&api-tier=1&uid=e8795170-b7e7-4791-aa0a-1881d3257ce0

146 B
254 B

30ms
29ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=42&ev=69aeec629e534900901a428166dd614a&pname=IqZone&api-tier=1&uid=e8795170-b7e7-4791-aa0a-1881d3257ce0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eed06ea1e832a7ab152736f2cb2c8d6a25e79a304a6c5a5582a13253d1ddbc04

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:42 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 8028421d89ee3702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

Date: Wed, 06 Sep 2023 16:58:42 GMT
Server: nginx
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, OPTIONS
Location: https://cks.connatix.com/cks?pid=42&ev=69aeec629e534900901a428166dd614a&pname=IqZone&api-tier=1&uid=e8795170-b7e7-4791-aa0a-1881d3257ce0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d43%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dSonobi%26api-tier%3d1%26uid%3D%5BUID%5D&gdpr=0
https://cks.connatix.com/cks?pid=43&ev=69aeec629e534900901a428166dd614a&pname=Sonobi&api-tier=1&uid=56614a3c-d90c-4c8d-bfee-32b35c9dc358

146 B
253 B

29ms
28ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=43&ev=69aeec629e534900901a428166dd614a&pname=Sonobi&api-tier=1&uid=56614a3c-d90c-4c8d-bfee-32b35c9dc358
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec17cdb15031116538ae0981f3a6b05f9bc921adebca8330ec2cfe665aabfe62

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:42 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 8028421d191b3702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:42 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-5-197
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cks.connatix.com/cks?pid=43&ev=69aeec629e534900901a428166dd614a&pname=Sonobi&api-tier=1&uid=56614a3c-d90c-4c8d-bfee-32b35c9dc358
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3

200

cks Show response
cks.connatix.com/ Frame 9FCE
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=connatix&cspid=25&append=0&cb=${ADELPHIC_CACHE_BUSTER}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d29%26ev%3d69aeec629e534900901...
https://cks.connatix.com/cks?pid=29&ev=69aeec629e534900901a428166dd614a&pname=Adelphic&api-tier=1&uid=7a1c33c4-1fbe-49b0-99f8-a3171baf67c7

146 B
253 B

27ms
26ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=29&ev=69aeec629e534900901a428166dd614a&pname=Adelphic&api-tier=1&uid=7a1c33c4-1fbe-49b0-99f8-a3171baf67c7
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9af8cbcc2c3f207e43d1195172ce7cab184bad02b130ef8afb551c7869e9c6a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:42 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 8028421fbd683702-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

Location: https://cks.connatix.com/cks?pid=29&ev=69aeec629e534900901a428166dd614a&pname=Adelphic&api-tier=1&uid=7a1c33c4-1fbe-49b0-99f8-a3171baf67c7
Date: Wed, 06 Sep 2023 16:58:42 GMT
Connection: keep-alive
X-CI-RTID: bf262008-8191-4f80-af71-748e5c3a9080
Content-Length: 177
Content-Type: text/html; charset=utf-8

GET cm
us-u.openx.net/w/1.0/ Frame 7FA3 0
0

GET cksync
cs.media.net/ Frame 7FA3 0
0

GET

pixel
cm.g.doubleclick.net/ Frame 7FA3
Redirect Chain

https://capi.connatix.com/us/google/pixel?tier=1&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=connatix&google_hm=NjlhZWVjNjI5ZTUzNDkwMDkwMWE0MjgxNjZkZDYxNGE&extra1=69aeec629e534900901a428166dd614a&gdpr=0&google_redir=https%3a%2f%2fcapi.connatix....

0
0

GET
H2 200 insights.bin Show response
ins.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ef0a8c23-2915-46a5-b880-02976aca3dec/ Frame 7FA3 612 B
674 B 83ms
36ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/ef0a8c23-2915-46a5-b880-02976aca3dec/insights.bin
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/330092/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e9f92fc25080451bf728c119a99c6398ad328e5a93075a7462b2869ac424556

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 06 Sep 2023 15:34:26 GMT
server: cloudflare
etag: W/"3d88d0eead8345e9f2f3b11f3f679d4e"
access-control-max-age: 86400
access-control-allow-methods: GET, HEAD
content-type: application/x-protobuf
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
vary: Accept-Encoding
cf-ray: 802842150e5d38e2-YYZ
alt-svc: h3=":443"; ma=86400
expires: Thu, 05 Sep 2024 16:58:40 GMT

GET
H2 200 insights.bin Show response
ins.connatix.com/15bf949211513e70fb3d23f56a942e55/ Frame 7FA3 468 B
363 B 85ms
40ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.connatix.com/15bf949211513e70fb3d23f56a942e55/insights.bin
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/330092/connatix.playspace.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6466fcce02832fca0af84888085bf51e2d800913f27ed1e2aa3656b503923fb3

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 06 Sep 2023 10:40:18 GMT
server: cloudflare
etag: W/"8683b8446b42c06f38c7a5994e5455ed"
access-control-max-age: 86400
access-control-allow-methods: GET, HEAD
content-type: application/x-protobuf
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
vary: Accept-Encoding
cf-ray: 802842150e6138e2-YYZ
alt-svc: h3=":443"; ma=86400
expires: Thu, 05 Sep 2024 16:58:40 GMT

POST
H3 200 us Show response
capi.connatix.com/core/ Frame 7FA3 0
324 B 91ms
71ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/us?v=330092&tier=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/330092/connatix.playspace.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: multipart/form-data

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-protobuf
access-control-allow-origin: https://amp.cntxcdm.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 80284214eb5d39f6-YYZ
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

POST ucl
capi.connatix.com/tr/ Frame 7FA3 0
0

GET ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame 7FA3 0
0

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 9FCE 98 KB
29 KB 65ms
65ms Script
text/javascript 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/330092/connatix.playspace.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f156.1e100.net

Software

cafe /

Resource Hash

7599499f361cd81f44fc71449803f4e53ee9d8ceb6119d2b6d99ae0a05bd90fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://amp.cntxcdm.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:40 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28988
x-xss-protection: 0
server: cafe
etag: 857 / 19606 / m202308310101 / config-hash: 17969177496405432228
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 06 Sep 2023 16:58:40 GMT

GET ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame 7FA3 0
0

GET ef0a8c23-2915-46a5-b880-02976aca3dec.bin
vid.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/ Frame 7FA3 0
0

GET
H2 200 cookie
cm.adform.net/ Frame ABDE 43 B
106 B 600ms
116ms Image
image/gif 37.157.6.237
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dadf%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://static.s2s.t13.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:37 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H3 200 googleanalytics.json Show response
cdn.ampproject.org/rtv/012308242321000/v0/analytics-vendors/ 2 KB
886 B 37ms
37ms Fetch
application/json 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/analytics-vendors/googleanalytics.json

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

6c00736e58728d82754e3e5ced15af509097d091819b27a9b72129b91d8bff3b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:48:31 GMT
age: 83410
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 856
x-xss-protection: 0
server: sffe
etag: "13417016125ec007"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:48:31 GMT

GET
H3 200 comscore.json Show response
cdn.ampproject.org/rtv/012308242321000/v0/analytics-vendors/ 559 B
311 B 37ms
37ms Fetch
application/json 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/analytics-vendors/comscore.json

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

6b913d6f06cebe5484a2bf0de91fa809e331c5b4c7885a8bb67e971f1be57c48

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:46:56 GMT
age: 83505
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
server: sffe
etag: "df2352e78d9e7bc9"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:46:56 GMT

POST
H2 200 /
www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/ 0
0 353ms
309ms Ping
text/html 104.20.59.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/?cd=AMP&referrer=&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F116.0.5845.179%20Safari%2F537.36&title=W3LL%20phishing%20kit%20hijacks%20thousands%20of%20Microsoft%20365%20accounts%2C%20bypasses%20MFA
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0/amp-analytics-0.1.mjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.59.209 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H2 200 collect
www.google-analytics.com/r/ 35 B
367 B 371ms
44ms Ping
image/gif 142.251.167.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=a1&ds=AMP&aip&_s=1&dt=%7B%7Btitle%7D%7D&sr=1600x1200&_utmht=1694019521049&cid=yLDV87uzx3GToAcRGujNv3fZl5BQNuNv15ObkO01zEvZ-utUl3WqxEFFs-0DUwyH&tid=UA-91740-1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&dr=&sd=24&ul=en-us&de=UTF-8&t=pageview&jid=0.29089216856369804&_r=1&a=8505&z=0.8873380657560852

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0/amp-analytics-0.1.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f102.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: https://www-bleepingcomputer-com.cdn.ampproject.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

p2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/p?c1=2&c2=23384447&cs_ucfr=&cs_amp_consent=not_required&cs_pv=8505&c12=ncWInPt348zlqxh0t4AXvlrOAn1fg0qPJARRHGV_ocmztKIrw0dsBL8bwhumi1Wz&rn=0.6709136975080858&c8=W3L...
https://sb.scorecardresearch.com/p2?c1=2&c2=23384447&cs_ucfr=&cs_amp_consent=not_required&cs_pv=8505&c12=ncWInPt348zlqxh0t4AXvlrOAn1fg0qPJARRHGV_ocmztKIrw0dsBL8bwhumi1Wz&rn=0.6709136975080858&c8=W3...

43 B
299 B

39ms
38ms

Image
image/gif

3.162.3.40
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p2?c1=2&c2=23384447&cs_ucfr=&cs_amp_consent=not_required&cs_pv=8505&c12=ncWInPt348zlqxh0t4AXvlrOAn1fg0qPJARRHGV_ocmztKIrw0dsBL8bwhumi1Wz&rn=0.6709136975080858&c8=W3LL%20phishing%20kit%20hijacks%20thousands%20of%20Microsoft%20365%20accounts%2C%20bypasses%20MFA&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&c9=&cs_c7amp=https%3A%2F%2Fwww-bleepingcomputer-com.cdn.ampproject.org%2Fc%2Fs%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&comscorekw=amp
Protocol: H2
Server: 3.162.3.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-3-40.yul62.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 16:58:41 GMT
via: 1.1 d64e73a7e708de06492b99c7e55873b6.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: YUL62-P2
x-cache: Miss from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: GXHvz2bh9UPi43h38Wyvf-K_OAlu3UspJIS7zrCHc2LELRZKCy1AMA==

Redirect headers

date: Wed, 06 Sep 2023 16:58:41 GMT
via: 1.1 d64e73a7e708de06492b99c7e55873b6.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: YUL62-P2
x-cache: Miss from cloudfront
location: /p2?c1=2&c2=23384447&cs_ucfr=&cs_amp_consent=not_required&cs_pv=8505&c12=ncWInPt348zlqxh0t4AXvlrOAn1fg0qPJARRHGV_ocmztKIrw0dsBL8bwhumi1Wz&rn=0.6709136975080858&c8=W3LL%20phishing%20kit%20hijacks%20thousands%20of%20Microsoft%20365%20accounts%2C%20bypasses%20MFA&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2F&c9=&cs_c7amp=https%3A%2F%2Fwww-bleepingcomputer-com.cdn.ampproject.org%2Fc%2Fs%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fw3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa%2Famp%2F&comscorekw=amp
content-length: 0
x-amz-cf-id: hQNWRrg6eaCIRJFmVEbKzwmmE-3za9C2pMeerPGDckNXig6gU3V3rw==

GET
H2 200 container.html
4019ed0cc3a988fa97d413b658bf51fd.safeframe.googlesyndication.com/safeframe/1-0-40/html/ 0
0 114ms
37ms Other
text/html 172.253.62.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://4019ed0cc3a988fa97d413b658bf51fd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.62.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bc-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

GET
H3 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 15 KB
5 KB 37ms
36ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

f6a4b48a039944a1fdd0881388bd0228a108faa4b50c5f336b527afda8b3887c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:47:48 GMT
age: 83453
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5223
x-xss-protection: 0
server: sffe
etag: "a5565022dc1ab1a7"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:47:48 GMT

GET
H3 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 5 KB
2 KB 39ms
37ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-fit-text-0.1.mjs

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

bcbb6d36af6c21e8b28881298608540f80906caf3de134040d18a41153c19db7

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:48:24 GMT
age: 83417
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1910
x-xss-protection: 0
server: sffe
etag: "8dcb4686a6310824"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:48:24 GMT

GET
H3 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012308242321000/v0/ 40 KB
13 KB 39ms
38ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/amp-form-0.1.mjs

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

74a5ffb1b8a78cb525da26767a769318d3cf955c251bbccf5f342ced953c3aeb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Origin: https://www-bleepingcomputer-com.cdn.ampproject.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Sep 2023 17:47:14 GMT
age: 83487
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12957
x-xss-protection: 0
server: sffe
etag: "a4a28cc2034f2590"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:47:14 GMT

POST amp
csp.withgoogle.com/csp/ Frame 11F3 0
0

GET
DATA 200
OK truncated
/ Frame 11F3 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65800a182477c6da376d3a562a02b01077d9695b93d57784e32e4c6df524963d

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 11F3
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

51ms
50ms

Image
text/html

172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Protocol: H2
Server: 172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bg-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Redirect headers

date: Wed, 06 Sep 2023 16:58:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 8617127727135477287
tpc.googlesyndication.com/simgad/ Frame 11F3 34 KB
34 KB 1128ms
50ms Image
image/png 142.251.167.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8617127727135477287?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qlMYIQ1Q9xvc1Irhcori0bVpj3wMQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f132.1e100.net

Software

sffe /

Resource Hash

5526e738d75a0038ff5247dd07362c0e747b61acd6bafaa96d94392a4da96e2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 04 Sep 2023 13:04:22 GMT
x-content-type-options: nosniff
age: 186860
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34890
x-xss-protection: 0
last-modified: Tue, 23 May 2023 22:00:03 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 03 Sep 2024 13:04:22 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 11F3 2 KB
3 KB 1115ms
36ms Image
image/png 142.251.167.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f132.1e100.net

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 12:36:50 GMT
x-content-type-options: nosniff
server: cafe
age: 15712
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Thu, 07 Sep 2023 12:36:50 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 11F3 295 B
664 B 1113ms
35ms Image
image/png 142.251.167.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f132.1e100.net

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 12:36:50 GMT
x-content-type-options: nosniff
server: cafe
age: 15712
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Thu, 07 Sep 2023 12:36:50 GMT

GET
H3 200 bg.json Show response
cdn.ampproject.org/rtv/012308242321000/v0/analytics-vendors/ 80 B
122 B 37ms
36ms Fetch
application/json 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012308242321000/v0/analytics-vendors/bg.json

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f132.1e100.net

Software

sffe /

Resource Hash

9aef20899f51a6f102c0edd01d96899152e5c30faa50c54b52fa68208dcfc215

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
date: Tue, 05 Sep 2023 17:47:49 GMT
content-encoding: gzip
age: 83452
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92
x-xss-protection: 0
server: sffe
etag: "8237acfdc93f5852"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 04 Sep 2024 17:47:49 GMT

GET
H2 200 b4a-runner.html Show response
tpc.googlesyndication.com/b4a/ Frame 3419 23 KB
9 KB 1072ms
38ms Document
text/html 142.251.167.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/b4a/b4a-runner.html

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012308242321000/v0/amp-analytics-0.1.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f132.1e100.net

Software

sffe /

Resource Hash

fb5c14252555f28ec1ce5fc1374aafc3c4c1e2d8fec6fe68b3f62c439a4a229e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 19361
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 8910
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 06 Sep 2023 11:36:01 GMT
expires: Thu, 07 Sep 2023 11:36:01 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

setuid
s2s.t13.io/ Frame ABDE
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24%7B...
https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24%7B...
https://s2s.t13.io/setuid?bidder=openx&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=c8d15979-186f-4a5c-aa2f-2ee104d83f89

86 B
115 B

41ms
41ms

Image
image/png

34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2s.t13.io/setuid?bidder=openx&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=c8d15979-186f-4a5c-aa2f-2ee104d83f89
Protocol: H3
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://static.s2s.t13.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:41 GMT
content-encoding: gzip
via: 1.1 google
content-type: image/png
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:41 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://s2s.t13.io/setuid?bidder=openx&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=c8d15979-186f-4a5c-aa2f-2ee104d83f89
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 181

GET
H3

200

setuid
s2s.t13.io/ Frame ABDE
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-triple13&gdpr=0&gdpr_consent=&us_privacy=
https://s2s.t13.io/setuid?bidder=rubicon&uid=LM7ZHGQA-16-A8OE&gdpr=0

86 B
117 B

42ms
41ms

Image
image/png

34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2s.t13.io/setuid?bidder=rubicon&uid=LM7ZHGQA-16-A8OE&gdpr=0
Protocol: H3
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://static.s2s.t13.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:42 GMT
content-encoding: gzip
via: 1.1 google
content-type: image/png
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s2s.t13.io/setuid?bidder=rubicon&uid=LM7ZHGQA-16-A8OE&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
Expires: 0

GET
H3

200

setuid
s2s.t13.io/ Frame ABDE
Redirect Chain

https://visitor.omnitagjs.com/visitor/bsync?uid=19340f4f097d16f41f34fc0274981ca4&name=PrebidServer&gdpr=0&gdpr_consent=&us_privacy=&url=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dadyoulike%26gdpr...
https://s2s.t13.io/setuid?bidder=adyoulike&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=082c1ee49612665a6fc0b8c1b6b04a80

86 B
117 B

41ms
41ms

Image
image/png

34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2s.t13.io/setuid?bidder=adyoulike&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=082c1ee49612665a6fc0b8c1b6b04a80
Protocol: H3
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://static.s2s.t13.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:42 GMT
content-encoding: gzip
via: 1.1 google
content-type: image/png
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:42 GMT
via: kong/2.8.3
x-content-type-options: nosniff
x-kong-proxy-latency: 0
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
location: https://s2s.t13.io/setuid?bidder=adyoulike&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=082c1ee49612665a6fc0b8c1b6b04a80
x-kong-upstream-latency: 4
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, must-revalidate
content-length: 0
expires: 0

GET
H2 200 iframe-transport-client-v0.js Show response
3p.ampproject.net/2308242321000/ Frame 3419 13 KB
5 KB 114ms
36ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3p.ampproject.net/2308242321000/iframe-transport-client-v0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/b4a/b4a-runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

7151de7daaf69b1a913e5775de972f6338897398ed976b19a9e5268852153a20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 02:08:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 399012
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4371
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 08:48:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 01 Sep 2024 02:08:30 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 11F3 0
0 58ms
58ms Image
text/html 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C13bLwK_4ZOPKK4W6zwWRwpjIB8Sclrtyh9CB-uQRChABIPm-pyRg_aCZgegDoAHss_LAAcgBAuACAKgDAcgDSKoE1gJP0H56tJp7Xae69M8-6_olW429wjULFQVW7uLBGxAOj8arSxCOSQbtShdgSaDKj1PPGXz6Dv3NH6_D7v4oefBtSyX1fc0BlFkGp9a72egvqA_luIUCkZ-CZDPRzi0ZDuHyd5OxNzwhgVLLm2QlIVT1VksOvi2nVkseu94EjDvLyl2v7ljn3JqpjQZC9GngnGRGEVRAKgGmUXVhsar2eXksG9kRIxXKsPb7u_h-7BKWLSg7C8ZwfsfwaFacdoi8rRDnj4NwYOyJiULkNOt6qliW6PLrZrJvin7L47JZj334Mlo-0uBQuzh4fs81QQNyAfFXHswLCGf1y0Do4bf_0cYgeSbVkJktn1UCxhDlzvXelf3lPTaE5lUrFAdMdtIU7WP53yR65roqm5Y1oXqsxiIrpFkFD93XH25hWqTeN5SjzURmTe9FqDBmK5WAdA0BOp2vG_rpDiPABPz46JfABOAEAYgF972JmkuSBQQIBBgBkgUECAUYBKAGAoAH_MuNvwKoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBCLuBrSCBQIgGEQARgdMgKKAjoCgEBIvf3BOvIIG2FkeC1zdWJzeW4tMzgwNDIwMDIyNjQ3NTk3N5oJKWh0dHBzOi8vbWFkbXVzY2xlcy5jb20vbm8tc3VnYXItY2hhbGxlbmdlgAoDyAsB2gwRCgsQgP-G4IWByZGbARICAQPYEwzQFQGYFgGAFwGyFx4KHAgAEhRwdWItOTU0MzE5NTI2NzgxNjk3MRjZvRY&sigh=SQH8KZSzvwc&uach_m=[UACH]&ase=2&cid=CAQSGwBpAlJWCfESTS3QDG5pkSVAXnvIOYIr9XYU2RgB&cbvp=2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bg-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

GET
H3

200

setuid
s2s.t13.io/ Frame ABDE
Redirect Chain

https://sync.go.sonobi.com/us.gif?loc=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dsonobi%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%5BUID%5D
https://s2s.t13.io/setuid?bidder=sonobi&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=56614a3c-d90c-4c8d-bfee-32b35c9dc358

86 B
117 B

48ms
47ms

Image
image/png

34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2s.t13.io/setuid?bidder=sonobi&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=56614a3c-d90c-4c8d-bfee-32b35c9dc358
Protocol: H3
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://static.s2s.t13.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:42 GMT
content-encoding: gzip
via: 1.1 google
content-type: image/png
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:42 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-5-197
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://s2s.t13.io/setuid?bidder=sonobi&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=56614a3c-d90c-4c8d-bfee-32b35c9dc358
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3

200

setuid
s2s.t13.io/ Frame ABDE
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dgrid%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24%7BBSW_UUID%7D
https://s2s.t13.io/setuid?bidder=grid&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=d1a5a299-cf60-40ca-b5c1-b9c7677447ed

86 B
117 B

47ms
47ms

Image
image/png

34.107.140.113
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s2s.t13.io/setuid?bidder=grid&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=d1a5a299-cf60-40ca-b5c1-b9c7677447ed
Protocol: H3
Server: 34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 113.140.107.34.bc.googleusercontent.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://static.s2s.t13.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Sep 2023 16:58:42 GMT
content-encoding: gzip
via: 1.1 google
content-type: image/png
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

Redirect headers

Location: https://s2s.t13.io/setuid?bidder=grid&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=d1a5a299-cf60-40ca-b5c1-b9c7677447ed
Date: Wed, 06 Sep 2023 16:58:42 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET 1508
sync-tm.everesttech.net/upi/pid/ Frame ABDE 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: csp.withgoogle.com
URL: https://csp.withgoogle.com/csp/amp

Domain: secure-assets.rubiconproject.com
URL: https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=19564_2&endpoint=us-east&gdpr=0

Domain: ssc-cms.33across.com
URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0015a00002y7TWTAA2&ru=https%3a%2f%2fcapi.connatix.com%2fcore%2fus%3fDemandPartner%3d37%26UserId%3d69aeec629e534900901a428166dd614a%26DemandPartnerName%3d_33Across%26tier%3d1%26DemandPartnerUserId%3d33XUSERID33X&gdpr=0

Domain: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/userSync.js

Domain: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=0&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3d69aeec629e534900901a428166dd614a%26pname%3dIronSource%26api-tier%3d1%26uid%3d{partnerId}%26direct%3D1

Domain: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=7cf4c6c4-b915-4cbd-83cc-28c0f662a829&ph=51e220cb-8c97-4a65-b047-91c933b79b78&r=https%3a%2f%2fcapi.connatix.com%2fcore%2fus%3fDemandPartner%3d8%26UserId%3d69aeec629e534900901a428166dd614a%26DemandPartnerName%3dOpenX%26tier%3d1%26DemandPartnerUserId%3d

Domain: cs.media.net
URL: https://cs.media.net/cksync?cs=37&type=cn&redirect=https%3a%2f%2fcapi.connatix.com%2fcore%2fus%3fDemandPartner%3d31%26UserId%3d69aeec629e534900901a428166dd614a%26DemandPartnerName%3dMediaNet%26tier%3d1%26DemandPartnerUserId%3D%3Cvsid%3E&gdpr=0

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=connatix&google_hm=NjlhZWVjNjI5ZTUzNDkwMDkwMWE0MjgxNjZkZDYxNGE&extra1=69aeec629e534900901a428166dd614a&gdpr=0&google_redir=https%3a%2f%2fcapi.connatix.com%2fus%2fgoogle%2freport

Domain: capi.connatix.com
URL: https://capi.connatix.com/tr/ucl?v=330092

Domain: sync.intentiq.com
URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=372401555&pcid=69aeec629e534900901a428166dd614a

Domain: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Domain: vid.connatix.com
URL: https://vid.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/ef0a8c23-2915-46a5-b880-02976aca3dec.bin

Domain: csp.withgoogle.com
URL: https://csp.withgoogle.com/csp/amp

Domain: sync-tm.everesttech.net
URL: https://sync-tm.everesttech.net/upi/pid/1508?redir=https%3A%2F%2Fs2s.t13.io%2Fsetuid%3Fbidder%3Dadbe%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24%7BTM_USER_ID%7D

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

45 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.adsrvr.org/	1970-01-20 23:20:41	Name: TDID Value: fe8f5910-c96c-4bfd-a0c9-e6d2bcb0c838
.bidswitch.net/	1970-01-20 23:19:15	Name: tuuid Value: d1a5a299-cf60-40ca-b5c1-b9c7677447ed
.bidswitch.net/	1970-01-20 23:19:15	Name: c Value: 1694019520
.bidswitch.net/	1970-01-20 23:19:15	Name: tuuid_lu Value: 1694019520
.connatix.com/	1970-01-20 15:16:51	Name: cnx_userId Value: 69aeec629e534900901a428166dd614a
.adsrvr.org/	1970-01-20 23:20:41	Name: TDCPM Value: CAEYASABKAIyCwiOl8uIqMGXPBAFOAFaB2dhcHphaWRgAg..
sync.srv.stackadapt.com/	1970-01-20 23:19:15	Name: sa-user-id Value: s%3A0-810c0151-2e6f-5b9f-7e2a-fc88f25d37d5.J7dZvKD%2BPSUnrWWvtAQWmwA%2B6zTpYr6t6et7mtXvozs
.srv.stackadapt.com/	1970-01-20 23:19:15	Name: sa-user-id Value: s%3A0-810c0151-2e6f-5b9f-7e2a-fc88f25d37d5.J7dZvKD%2BPSUnrWWvtAQWmwA%2B6zTpYr6t6et7mtXvozs
sync.srv.stackadapt.com/	1970-01-20 23:19:15	Name: sa-user-id-v2 Value: s%3AgQwBUS5vW59-KvyI8l031VYwD6k.aytIpAl9HfRSw7oACPhmtn9ZCVFOG6ErmQbHUr8cEKE
.srv.stackadapt.com/	1970-01-20 23:19:15	Name: sa-user-id-v2 Value: s%3AgQwBUS5vW59-KvyI8l031VYwD6k.aytIpAl9HfRSw7oACPhmtn9ZCVFOG6ErmQbHUr8cEKE
sync.srv.stackadapt.com/	1970-01-20 23:19:15	Name: sa-user-id-v3 Value: s%3AAQAKIMKa0zgwUmA0T4Ho-N-fpLwh89vP1CXlwuNCfZZxfi--EHwYBCDA3-KnBjABOgT_Q_f4QgQTXHQA.5RUmXd1Fze%2BfWdaEeZuVbzUCLuKGMxni6QqwxoWYdyQ
.srv.stackadapt.com/	1970-01-20 23:19:15	Name: sa-user-id-v3 Value: s%3AAQAKIMKa0zgwUmA0T4Ho-N-fpLwh89vP1CXlwuNCfZZxfi--EHwYBCDA3-KnBjABOgT_Q_f4QgQTXHQA.5RUmXd1Fze%2BfWdaEeZuVbzUCLuKGMxni6QqwxoWYdyQ
.bidr.io/	1970-01-21 00:02:13	Name: bito Value: AAClAk7J8WAAADjnQPDovg
.bidr.io/	1970-01-21 00:02:13	Name: bitoIsSecure Value: ok
.tremorhub.com/	1970-01-20 23:19:36	Name: tvid Value: 6030ea8ca298403fa927adb384146d0a
.tremorhub.com/	1970-01-21 00:09:39	Name: tv_UISCX Value: 69aeec629e534900901a428166dd614a
.scorecardresearch.com/	1970-01-21 00:09:39	Name: UID Value: 13E5a70bf46eac2b3fafeb41694019521
.doubleclick.net/	1970-01-20 14:33:43	Name: DSID Value: NO_DATA
.openx.net/	1970-01-20 23:19:15	Name: i Value: 22a3e9ef-0877-4642-9b75-261ce1a4cef9%7C1694019521
.adnxs.com/	1970-01-20 16:43:15	Name: uuid2 Value: 2966634651961889903
.turn.com/	1970-01-20 18:52:51	Name: uid Value: 7120220350391770329
.resetdigital.co/	1970-01-20 16:43:15	Name: ckbk Value: 0000010E8427BB75
.rubiconproject.com/	1970-01-20 23:19:15	Name: khaos Value: LM7ZHGQA-16-A8OE
.rubiconproject.com/	1970-01-20 23:19:15	Name: audit Value: 1\|Ie4Lzm/GNiBh09M6odjLntVXP5EbsC+kuvQCFvw/ePdANEhL6jmjsgsMujPQweFXrpcfMsgQntwkEa5N2k7U1SEEFoCDRlfY5fvCZrsWYKpuxk7ut5c5Aqt0fYnfxuDd0RL7DNq2u9zEZkvIBrOspQKw/FTiHkcBps0k0vdRkKh3Rj/v1qqWygDDelQ01UenpmvllXEtYN4=
.go.sonobi.com/	1970-01-20 15:16:51	Name: __uis Value: 56614a3c-d90c-4c8d-bfee-32b35c9dc358
.go.sonobi.com/	1969-12-31 23:59:59	Name: HAPLB8G Value: s85197\|ZPivx
.omnitagjs.com/	1970-01-20 15:16:51	Name: ayl_visitor Value: 082c1ee49612665a6fc0b8c1b6b04a80
.doubleclick.net/	1970-01-21 00:09:39	Name: IDE Value: AHWqTUmQAYrMqgwiSruyyjqJmNXKEuOJoEshBNNV5EXe1RJvPquBgoOyH66WiW0g6js
.ipredictive.com/	1970-01-20 23:19:15	Name: cu Value: 7a1c33c4-1fbe-49b0-99f8-a3171baf67c7\|1694019522492
s2s.t13.io/	1970-01-20 16:43:15	Name: uids Value: eyJ1aWRzIjp7fSwidGVtcFVJRHMiOnsiYWR5b3VsaWtlIjp7InVpZCI6IjA4MmMxZWU0OTYxMjY2NWE2ZmMwYjhjMWI2YjA0YTgwIiwiZXhwaXJlcyI6IjIwMjMtMDktMjBUMTY6NTg6NDIuMzk0MzM0Njc0WiJ9LCJ0dGRmc3giOnsidWlkIjoiZmU4ZjU5MTAtYzk2Yy00YmZkLWEwYzktZTZkMmJjYjBjODM4IiwiZXhwaXJlcyI6IjIwMjMtMDktMjBUMTY6NTg6NDAuMzQ2NDk1MjIxWiJ9LCJncmlkIjp7InVpZCI6ImQxYTVhMjk5LWNmNjAtNDBjYS1iNWMxLWI5Yzc2Nzc0NDdlZCIsImV4cGlyZXMiOiIyMDIzLTA5LTIwVDE2OjU4OjQyLjU3MDgzMzYzMloifSwiYmlkc3dpdGNoIjp7InVpZCI6ImQxYTVhMjk5LWNmNjAtNDBjYS1iNWMxLWI5Yzc2Nzc0NDdlZCIsImV4cGlyZXMiOiIyMDIzLTA5LTIwVDE2OjU4OjQwLjg5Mzk5OTE4M1oifSwic29ub2JpIjp7InVpZCI6IjU2NjE0YTNjLWQ5MGMtNGM4ZC1iZmVlLTMyYjM1YzlkYzM1OCIsImV4cGlyZXMiOiIyMDIzLTA5LTIwVDE2OjU4OjQyLjQ3ODA2MzI0WiJ9LCJydWJpY29uIjp7InVpZCI6IkxNN1pIR1FBLTE2LUE4T0UiLCJleHBpcmVzIjoiMjAyMy0wOS0yMFQxNjo1ODo0Mi4wNzkyODYzMjlaIn0sIm9wZW54Ijp7InVpZCI6ImM4ZDE1OTc5LTE4NmYtNGE1Yy1hYTJmLTJlZTEwNGQ4M2Y4OSIsImV4cGlyZXMiOiIyMDIzLTA5LTIwVDE2OjU4OjQxLjY0MjM4MjAyNFoifX19
.sundaysky.com/	1970-01-21 00:09:39	Name: sskyu Value: d6.9ca67c6d2cfe4b0a9a8a10a80802c383
.sundaysky.com/	1970-01-21 00:09:39	Name: sskyCreationTime Value: 1694019522836
.sundaysky.com/	1970-01-20 14:43:44	Name: sskya Value: "e2N4Ont0czoiNDBicjV1Iix0OiJuaSJ9fQ=="
.contextweb.com/	1970-01-20 23:12:03	Name: V Value: Pz5P5nglalOo
.contextweb.com/	1970-01-20 23:19:15	Name: pb_rtb_ev Value: 3-1mpn\|7Xz.0.1
bh.contextweb.com/	1969-12-31 23:59:59	Name: INGRESSCOOKIE Value: d14996e15fea1879
.3lift.com/	1970-01-20 16:43:15	Name: tluid Value: 2598518279004013141717
.rlcdn.com/	1970-01-20 23:19:15	Name: rlas3 Value: e1RHKA6vqBawtyHTQqLbr1qBsQ86ma6PyLjI1FaVj2I=
.ctnsnet.com/	1970-01-20 23:19:15	Name: cid_841657a9f5f940868ac24e47d6a6735a Value: 1
.casalemedia.com/	1970-01-20 23:19:15	Name: CMID Value: ZPivw0Gmjdm3XJvwCoFZjgAA
.casalemedia.com/	1970-01-20 16:43:15	Name: CMPS Value: 584
.casalemedia.com/	1970-01-20 16:43:15	Name: CMPRO Value: 584
.rlcdn.com/	1970-01-20 16:00:03	Name: pxrc Value: CMPf4qcGEgUI6AcQAA==
.csync.loopme.me/	1970-01-20 16:44:41	Name: viewer_token Value: 88dfa2f0-be78-4110-8083-bbd23fae27ed
.yieldmo.com/	1970-01-20 23:19:15	Name: yieldmo_id Value: 3RhHuII00HIKYWtZIqD9%7C1693958400000%7C0

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: about:srcdoc Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
security	error	URL: about:blank Message: Refused to execute script from 'https://id.rlcdn.com/1000.gif?memo=CIq8KxoNCMPf4qcGEgUI6AcQAEIASiA2OWFlZWM2MjllNTM0OTAwOTAxYTQyODE2NmRkNjE0YQ' because its MIME type ('image/gif') is not executable.
javascript	warning	URL: https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/amp/ Message: The resource https://4019ed0cc3a988fa97d413b658bf51fd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src * blob: data:; script-src 'sha256-0EzT5rjCdQIs7Zb99eHUlAOmKUanRXRrJoqJ+VYepto=' 'sha256-5CxqAdDXlHviOy7zxeRpMobzRK/JNpLvkS+k8Zj3L3A=' 'sha256-FIBGC/wl1Qfnh2Fb5NPFHmRty7BHJdDpWW1FZ8egppI=' 'sha256-UXYprBCAtnqoL5acf14iemip/+HI+gDFh92yyXkM3XI=' 'sha256-dKn2nAtwgzaaXC8ZM58hhldxNyeuu4qrzW4H9//9YMA=' 'sha256-i9nAf5M9USb+lB7ZtayKdAWymLU1MCklCTdsyXbMgCs=' 'sha256-wjUSvXYNfPUUTPZYrn4pOEcf2ecDdjd3N9Av3GDSwZw=' 'sha256-yAAlWuem9ue55JEvxkWhcWWA1Zu0p6cgbYtDWJjsdvs=' blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3p.ampproject.net
4019ed0cc3a988fa97d413b658bf51fd.safeframe.googlesyndication.com
aax.amazon-adsystem.com
ad.turn.com
ads.pubmatic.com
ads.stickyadstv.com
ads.yieldmo.com
amp.cntxcdm.com
amprtc.media.net
api.floors.dev
bh.contextweb.com
bidder.criteo.com
capi.connatix.com
cd.connatix.com
cdn.ampproject.org
cds.connatix.com
cks.connatix.com
cm.adform.net
cm.g.doubleclick.net
connatix-supply-partners.tremorhub.com
cs-server-s2s.yellowblue.io
cs.media.net
csp.withgoogle.com
csync.loopme.me
eb2.3lift.com
googleads.g.doubleclick.net
i.ctnsnet.com
id.rlcdn.com
imasdk.googleapis.com
ins.connatix.com
match.adsrvr.org
match.prod.bidr.io
pixel-sync.sitescout.com
pixel.rubiconproject.com
rtb.openx.net
s2s.t13.io
sb.scorecardresearch.com
secure-assets.rubiconproject.com
secure.adnxs.com
securepubads.g.doubleclick.net
ssc-cms.33across.com
ssum.casalemedia.com
static.s2s.t13.io
sync-tm.everesttech.net
sync.colossusssp.com
sync.go.sonobi.com
sync.intentiq.com
sync.ipredictive.com
sync.resetdigital.co
sync.srv.stackadapt.com
tpc.googlesyndication.com
us-u.openx.net
vid.connatix.com
visitor.omnitagjs.com
vop.sundaysky.com
www-bleepingcomputer-com.cdn.ampproject.org
www-bleepstatic-com.cdn.ampproject.org
www.bleepingcomputer.com
www.google-analytics.com
www.google.com
x.bidswitch.net
xsync.iqzone.com
ads.pubmatic.com
capi.connatix.com
cm.g.doubleclick.net
cs-server-s2s.yellowblue.io
cs.media.net
csp.withgoogle.com
imasdk.googleapis.com
secure-assets.rubiconproject.com
ssc-cms.33across.com
sync-tm.everesttech.net
sync.intentiq.com
us-u.openx.net
vid.connatix.com
104.18.38.199
104.18.41.104
104.20.59.209
142.234.204.77
142.251.111.103
142.251.163.141
142.251.167.102
142.251.167.132
159.89.252.170
172.253.115.156
172.253.115.94
172.253.62.132
172.253.63.132
172.64.146.152
18.213.190.50
18.214.123.150
192.40.36.238
198.148.27.131
207.198.113.203
209.192.253.44
3.161.212.32
3.162.3.40
3.222.163.84
34.107.140.113
34.107.148.139
34.160.128.112
34.216.140.43
35.186.193.173
35.190.60.146
35.211.178.172
35.214.196.82
35.227.252.103
35.71.139.29
37.157.6.237
38.98.139.150
50.116.194.21
52.20.216.116
52.204.19.136
52.223.40.198
52.45.151.151
68.67.160.114
69.166.1.35
69.173.151.100
74.119.119.129
04722325575c6c791a2c50671735905ab15d191e724fc233a9d418b7d06758c5
0fd784cfd27a72fe7146482277c566c7c626e877835fe8ffe0d2be2bc46c1f38
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
1defb84a28e78172b9e21eee7b504776d0c5ec719ad5ed63bc97a5a0ed4ebb2a
21a413d0ce3f3ef83cefdf6c92dcf47a4d1283a8c52db9a4b1e4ae27e9a314a8
2843e03ac951f0c5bb836f80c1cfd7550a56f33f95f117a9a08f8820e104f008
2eb57ddeb8664d62b0e94484989416c59f5e5c1533f028493c7e3c9f0f188a14
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
431e4c061f3c040f9e2d17772ab6393d983ffa2a920199b4bf2b5f63d422e402
43fdbad1e70b4ca4f893ab921a117375f407ea61cfe84f8530d44e9dc75afb28
45adaee20fd66b88ac715b8b3de8287ff6cb7a14fba471c3da5cd83008b26dfe
463e8998c5c739800a726925a426c9a8990452e13ddda9497946f16fdad62ca7
46a3f17f8cb68df9b20927ab47da4fcc45cf5540174fb3d5964fc43ddb6008ae
47de2b4d9f31bd5e085075486a5fcc4ccc925e380480c0f2a9a81220df84d6ea
4e971822d6deda6d586ad2b02bb2e231fa7ebcdbd39cc64464a3f3b337523e8b
4f17f9ae1f7467ed3b5946727c917a85749816d561312499ae93cf8158ade604
5070cd1642e2a06dee34b7a245e89765efa495e99f4e92cb81701ee2e0cddebb
5429828ab58913835e65d2dddad3838b488f7ab32f57787208fc20b6ee27bff4
54e4f87c2eb4c031349981152407137f297024fdebce949114fabd2088d2f864
5526e738d75a0038ff5247dd07362c0e747b61acd6bafaa96d94392a4da96e2e
5c683a7e36d351813e3a4919f1d3f0b7a4bef45be3dc4caa5cf69b5d1d13e7f7
6466fcce02832fca0af84888085bf51e2d800913f27ed1e2aa3656b503923fb3
65800a182477c6da376d3a562a02b01077d9695b93d57784e32e4c6df524963d
666df6b58ed258a39995d5a62841b537e67860d4b0a11096f0b2366e661571d5
6ad13e1d009a41237cd7bae2b1ed72d4b472ac22faba25f5eae4f4c3c9582fdc
6b8f89e0d82c43d3a97525d4ee168fc91946709be1094f6f388079a13f6d296b
6b913d6f06cebe5484a2bf0de91fa809e331c5b4c7885a8bb67e971f1be57c48
6c00736e58728d82754e3e5ced15af509097d091819b27a9b72129b91d8bff3b
6e9f92fc25080451bf728c119a99c6398ad328e5a93075a7462b2869ac424556
7151de7daaf69b1a913e5775de972f6338897398ed976b19a9e5268852153a20
7394e878d8420c3d8df892e183e662eaf38f0762cd719946322ac99dfa84272d
74a5ffb1b8a78cb525da26767a769318d3cf955c251bbccf5f342ced953c3aeb
7599499f361cd81f44fc71449803f4e53ee9d8ceb6119d2b6d99ae0a05bd90fb
7b8f6f9410206de2e649174673868658a8f8358c4cb87ed3cda1448c5cd0fda4
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83c6eadaf115f9ca16b4d1976d984e03e901af6eb0784724de167b3418933001
83eb75817ee5ab6dabd335ad513c5895118723630f3e273d58545073499c8d38
8705985e3b15e3a6eeb76645e22e17ebb00e3af4e508995a632d9775c535bb61
89ce8636db740d22f999c227d849610f1e40f012a10240b45281281056a93c58
89ed60c2430a2b74aef19da3b9772bdc13a537913237e4c56b5e70afb44b30d4
8b95095c2cc3c21094dfac58fa1c0d4fc95b7b5e544d8bce3d16c8a74a40c7b8
8c8fa5459084acaf97ab652ac510e648b75b7734bcfe340af2f6df0a968ee966
9172af40aaee472d31445077de9f18f59a45c0e1929a7caf9893cadfd0f187b0
9725ce9e98b7256b2b695b227d77376a0a8f80870f9ce43fb31cf519b499297c
9aef20899f51a6f102c0edd01d96899152e5c30faa50c54b52fa68208dcfc215
a151209208d23523e749b388b7bd37f2dec2305dfdec7d82cba9b07f8b815a90
a309430af06228da4bfdff81aa58e65c45ef62e27b85044726ae765bc0e0f169
a39f8835e7bc2b24317705fc9ac91ba8687d269306196064c4aa2c837664eff2
a4469ab0c7ce65d2198202049fd355d98f792af76a35177918585c167bbbb5e1
a61f44aae196001a02d0a7bd021053747ceec0fa7e9802bd8d348fbde53f1337
ae083a74aa4f1888843f37f4bf510e072cb0e9c31ec6136d598ed977cc507dbc
ae0e6db72d62448d03206ef23949585ff1392afcfafaa92cf30df3942f7b2d84
af6ac725473232e72ad3a929586ed3987e5facb3156db5c4e7009b6aab4cc62a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b307fc7d89529c99d73cfd64ed7b4c360d6314ed5286d7f9bbc0954822b94bc4
b9af8cbcc2c3f207e43d1195172ce7cab184bad02b130ef8afb551c7869e9c6a
bc1df93393aed23299a050a7188c52ee15de8847b6ac30d3d91330e6e3251f04
bcbb6d36af6c21e8b28881298608540f80906caf3de134040d18a41153c19db7
bebcf1da92ed796addec689fc3568d9686611a6ee8a1ddcc90e5f769bae9aa79
bf5e73ce29fe3acfe7df3893d33ce608323928a2643dfc84725a3b0217baa1f5
bf6c8f7c4f7ec20371e5ccd3fb56f691be572e4ab733295aade88e529aa8b066
c1b348bdf4b929ce74128fd462539ce9290b75098e30422efedfac8678165112
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf
c3b388904d770590bd781fc54e1d3ec7c2f7c7032141a823a8b3c94a6c0a3106
c9e9a9edb111820f664ad977b5f26616a422936e7aef262e3b6046f8b59b1bd6
d00e0c743a8c67803b3b7445a148b99d69df5602fc104ce80b3cbf1de5cefbeb
d399f9c8c92526fb78b76514e4071a337e24370882e9a3dbf1b649f5cc289716
d9e52a2d2d2bc732d4cc75b77d1230463e77be17eee7c14a78adef587266562c
dab6dd6a5ba8cfec3fcc8047a52906661bb0b13c8b5e3671e5bc47c0b29a9012
dac24dcb32742b27227b084baa7e576e4d945704706b35f9324c95e7aa928448
daf5e4f25290e537de92d4d1d3f5c1063be702961b53c55d16661a0ba2082853
dc45e0ee9bf2f54f1c99c686ac1a9e8f127a3f1d2c84d228f04ec99d465f9411
df73fdecc6d97c51e7addfdd8743ebd2d77e93a306c1d11aad408ca0212284e6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e494d2a8aa562f3b9a70b17189c72773423181e84d7602ff499b513d16d52ebd
e6fbe80e77b4229fc276374fa63aee522e03fcade7452eb33539f5a0a580da37
ec17cdb15031116538ae0981f3a6b05f9bc921adebca8330ec2cfe665aabfe62
eed06ea1e832a7ab152736f2cb2c8d6a25e79a304a6c5a5582a13253d1ddbc04
f050f17713ac55ca5d48a94e05828678d6c2d4dea0458c7d1b9b5cb0bb160a7a
f2a4849348226f39d59a86cf16f20b5a775e41a0d609762b2bef8a1db21b7370
f42c1a716a90460aab166aecd314753f0a9fa273c4a8120378fd50813c109482
f6a4b48a039944a1fdd0881388bd0228a108faa4b50c5f336b527afda8b3887c
fb5c14252555f28ec1ce5fc1374aafc3c4c1e2d8fec6fe68b3f62c439a4a229e

www-bleepingcomputer-com.cdn.ampproject.org Open in urlscan Pro 172.253.63.132 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

110 Requests

62 %HTTPS

0 %IPv6

48 Domains

62 Subdomains

22 IPs

5 Countries

867 kBTransfer

2676 kBSize

45 Cookies

45 Outgoing links

Redirected requests

110 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www-bleepingcomputer-com.cdn.ampproject.org Open in urlscan Pro
172.253.63.132 Public Scan

Screenshot
Live screenshot

Full Image

110
Requests

62 %
HTTPS

0 %
IPv6

48
Domains

62
Subdomains

22
IPs

5
Countries

867 kB
Transfer

2676 kB
Size

45
Cookies

110 HTTP transactions
11 data transactions