urlscan.io logo urlscan.io
SecurityTrails logo

blog.threatstop.com Open in urlscan Pro
2606:4700::6811:7fb4  Public Scan

Go To Rescan Add Verdict Report
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Submission: On October 26 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 24 IPs in 4 countries across 21 domains to perform 78 HTTP transactions. The main IP is 2606:4700::6811:7fb4, located in United States and belongs to CLOUDFLARENET, US. The main domain is blog.threatstop.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 16th 2020. Valid for: a year.
This is the only time blog.threatstop.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
22 2606:4700::68... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
1 2606:2800:233... 15133 (EDGECAST)
2 2606:4700::68... 13335 (CLOUDFLAR...)
10 2606:4700::68... 13335 (CLOUDFLAR...)
1 172.217.18.98 15169 (GOOGLE)
4 2a03:2880:f01... 32934 (FACEBOOK)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a03:2880:f11... 32934 (FACEBOOK)
6 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
4 2606:2800:234... 15133 (EDGECAST)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 104.244.42.136 13414 (TWITTER)
1 1 2a03:2880:f01... 32934 (FACEBOOK)
78 24
22    2606:4700::6811:7fb4 (United States)

ASN13335 (CLOUDFLARENET, US)
blog.threatstop.com
3    2a00:1450:4001:824::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2606:2800:233:66b5:799a:7cd3:f74d:7071 (United States)

ASN15133 (EDGECAST, US)
platform.linkedin.com
2    2606:4700::6811:f1cc (United States)

ASN13335 (CLOUDFLARENET, US)
cdn2.hubspot.net
10    2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)
no-cache.hubspot.com
app.hubspot.com
track.hubspot.com
1    172.217.18.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f2.1e100.net
www.googleadservices.com
4    2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
connect.facebook.net
3    2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:400c:c00::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
3    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
6    2a00:1450:4001:819::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
3    2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
2    2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
3    2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
www.googleadservices.com
4    2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)
platform.twitter.com
2    2606:4700::6811:cccc (United States)

ASN13335 (CLOUDFLARENET, US)
api.hubapi.com
1    2606:4700::6811:72b0 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hsadspixel.net
1    2606:4700::6811:45b0 (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-analytics.net
1    2606:4700::6812:15bf (United States)

ASN13335 (CLOUDFLARENET, US)
js.hs-banner.com
1    2a00:1450:4001:81f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a00:1450:4001:81e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
1    2606:4700::6810:5805 (United States)

ASN13335 (CLOUDFLARENET, US)
perf.hsforms.com
1    104.244.42.136 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
1    2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)
web.facebook.com
Domain Requested by
22 blog.threatstop.com blog.threatstop.com
7 track.hubspot.com
6 www.google.com blog.threatstop.com
www.gstatic.com
4 platform.twitter.com blog.threatstop.com
platform.twitter.com
4 connect.facebook.net blog.threatstop.com
connect.facebook.net
3 www.google.de blog.threatstop.com
3 www.facebook.com blog.threatstop.com
connect.facebook.net
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 www.googletagmanager.com blog.threatstop.com
js.hsadspixel.net
www.googletagmanager.com
2 api.hubapi.com blog.threatstop.com
js.hsadspixel.net
2 googleads.g.doubleclick.net www.googleadservices.com
2 fonts.googleapis.com blog.threatstop.com
2 www.googleadservices.com blog.threatstop.com
www.googletagmanager.com
2 no-cache.hubspot.com blog.threatstop.com
2 cdn2.hubspot.net blog.threatstop.com
1 web.facebook.com 1 redirects
1 syndication.twitter.com blog.threatstop.com
1 perf.hsforms.com blog.threatstop.com
1 www.gstatic.com www.google.com
1 fonts.gstatic.com fonts.googleapis.com
1 js.hs-banner.com blog.threatstop.com
1 js.hs-analytics.net blog.threatstop.com
1 js.hsadspixel.net blog.threatstop.com
1 app.hubspot.com blog.threatstop.com
1 cdnjs.cloudflare.com blog.threatstop.com
1 stats.g.doubleclick.net www.google-analytics.com
1 platform.linkedin.com blog.threatstop.com
78 27
Subject Issuer Validity Valid
blog.threatstop.com
Cloudflare Inc ECC CA-3		 2020-08-16 -
2021-08-16		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-10-06 -
2020-12-29		 3 months crt.sh
platform.linkedin.com
DigiCert SHA2 Secure Server CA		 2019-10-10 -
2021-10-14		 2 years crt.sh
hubspot.net
Cloudflare Inc ECC CA-3		 2020-07-03 -
2021-07-03		 a year crt.sh
hubspot.com
Cloudflare Inc ECC CA-3		 2020-07-27 -
2021-07-27		 a year crt.sh
www.googleadservices.com
GTS CA 1O1		 2020-10-06 -
2020-12-29		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-09-11 -
2020-12-10		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-10-06 -
2020-12-29		 3 months crt.sh
www.google.com
GTS CA 1O1		 2020-10-06 -
2020-12-29		 3 months crt.sh
www.google.de
GTS CA 1O1		 2020-10-06 -
2020-12-29		 3 months crt.sh
upload.video.google.com
GTS CA 1O1		 2020-10-06 -
2020-12-29		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-10-21 -
2021-10-20		 a year crt.sh
*.twimg.com
DigiCert SHA2 High Assurance Server CA		 2019-11-12 -
2020-11-18		 a year crt.sh
hubapi.com
Cloudflare Inc ECC CA-3		 2020-07-03 -
2021-07-03		 a year crt.sh
*.google.com
GTS CA 1O1		 2020-10-06 -
2020-12-29		 3 months crt.sh
*.google.de
GTS CA 1O1		 2020-10-06 -
2020-12-29		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2020-10-06 -
2020-12-29		 3 months crt.sh
syndication.twitter.com
DigiCert SHA2 High Assurance Server CA		 2020-03-05 -
2021-03-02		 a year crt.sh
*.googleadservices.com
GTS CA 1O1		 2020-10-06 -
2020-12-29		 3 months crt.sh

This page contains 6 frames:

Primary Page: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Frame ID: F96F43C316435ACFCB1DC4796D991E4D
Requests: 73 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fblog.threatstop.com
Frame ID: 6183BF39784989063F334135C1B77889
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Frame ID: 0DABD9438C24FB4E9C8F5049962CE28A
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc2_RsUAAAAAAYBSd4rxsgeQz7whuL9COCsHeET&co=aHR0cHM6Ly9ibG9nLnRocmVhdHN0b3AuY29tOjQ0Mw..&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&size=invisible&badge=inline&cb=3yniy3hxgqjr
Frame ID: E0011D52E48F7DF8CD8B94CD4B15266F
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df904acf9079814%26domain%3Dblog.threatstop.com%26origin%3Dhttps%253A%252F%252Fblog.threatstop.com%252Ff3554bedfbee834%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&layout=button_count&locale=en_US&sdk=joey&share=true&show_faces=false&width=120&_rdc=1&_rdr
Frame ID: 628D3372C591F901C9970E0D270A8777
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6Lc2_RsUAAAAAAYBSd4rxsgeQz7whuL9COCsHeET&cb=uvbpn5gdger1
Frame ID: 09B6826E822BA52FC3E4E8274FA99DBA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • script /\/\/platform\.linkedin\.com\/in\.js/i
Overall confidence: 100%
Detected patterns
  • script /\/\/platform\.twitter\.com\/widgets\.js/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

78
Requests

100 %
HTTPS

92 %
IPv6

21
Domains

27
Subdomains

24
IPs

4
Countries

872 kB
Transfer

2561 kB
Size

11
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 55
  • https://web.facebook.com/plugins/like.php?action=like&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df904acf9079814%26domain%3Dblog.threatstop.com%26origin%3Dhttps%253A%252F%252Fblog.threatstop.com%252Ff3554bedfbee834%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&layout=button_count&locale=en_US&sdk=joey&share=true&show_faces=false&width=120 HTTP 302
  • https://www.facebook.com/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df904acf9079814%26domain%3Dblog.threatstop.com%26origin%3Dhttps%253A%252F%252Fblog.threatstop.com%252Ff3554bedfbee834%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&layout=button_count&locale=en_US&sdk=joey&share=true&show_faces=false&width=120&_rdc=1&_rdr

78 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request terdot-that-man-in-the-middle
blog.threatstop.com/zloader/ 		60 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / HubSpot
Resource Hash
5d715618b720d589976c75ff0d142928ac0ec6726ed740a860717dc727bd5501
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=0

Request headers

:method
GET
:authority
blog.threatstop.com
:scheme
https
:path
/zloader/terdot-that-man-in-the-middle
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Mon, 26 Oct 2020 18:21:19 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d2adbd802d276227dffcf5cd8025f0ea81603736478; expires=Wed, 25-Nov-20 18:21:18 GMT; path=/; domain=.blog.threatstop.com; HttpOnly; SameSite=Lax __cfruid=c4a23d0ffb2d6b04afe8a0421bf4c1640e14b2e9-1603736479; path=/; domain=.blog.threatstop.com; HttpOnly; Secure; SameSite=None
cache-control
s-maxage=10800, max-age=0
etag
W/"e78a156d949a1cb7cc928b98753d6638"
last-modified
Wed, 21 Oct 2020 18:05:25 GMT
link
</hs/hsstatic/keyboard-accessible-menu-flyouts/static-1.17/bundles/project.js>; rel=preload; as=script,</hs/hsstatic/AsyncSupport/static-1.89/js/comment_listing_asset.js>; rel=preload; as=script,</_hcms/forms/v2.js>; rel=preload; as=script,</hs/hsstatic/HubspotToolsMenu/static-1.79/js/index.js>; rel=preload; as=script
strict-transport-security
max-age=0
cf-cache-status
MISS
cache-tag
CT-5262664117,P-2548414,L-4457237184,L-4589740527,L-4592759837,E-4457237089,E-4457257049,MENU-4592749502,PGS-ALL,SW-1,GC-32086968078
content-security-policy
upgrade-insecure-requests
edge-cache-tag
CT-5262664117,P-2548414,L-4457237184,L-4589740527,L-4592759837,E-4457237089,E-4457257049,MENU-4592749502,PGS-ALL,SW-1,GC-32086968078
x-hs-cache-config
BrowserCache-5s-EdgeCache-180s
x-hs-combine-css
Disabled
x-hs-content-id
5262664117
x-hs-hub-id
2548414
x-powered-by
HubSpot
cf-request-id
0607bdbb170000e0075f871000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
5e86323e8d40e007-FRA
content-encoding
br
cf-h2-pushed
</hs/hsstatic/keyboard-accessible-menu-flyouts/static-1.17/bundles/project.js>,</hs/hsstatic/AsyncSupport/static-1.89/js/comment_listing_asset.js>,</_hcms/forms/v2.js>,</hs/hsstatic/HubspotToolsMenu/static-1.79/js/index.js>
project.js
blog.threatstop.com/hs/hsstatic/keyboard-accessible-menu-flyouts/static-1.17/bundles/ 		2 KB
1021 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs/hsstatic/keyboard-accessible-menu-flyouts/static-1.17/bundles/project.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb56af9f7623a55839dfb9cf019b05664a62e1b41671d925f3ed587c506443b5

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 077b94dab77b8114aebf503be197d7d9.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
25795
x-amz-server-side-encryption
AES256
cf-ray
5e863244390fe007-FRA
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
content-encoding
br
cf-request-id
0607bdbea80000e007c2237000000001
last-modified
Wed, 19 Aug 2020 22:24:11 GMT
server
cloudflare
etag
W/"ef84f26c310485299d6b75777414eddb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
gEenO44eZUewxnIWfgj9q6LB.g9OszNv
cache-control
s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-cf-pop
IAD89-C3
content-type
application/javascript; charset=utf-8
x-amz-cf-id
Y5Tlf51Ewtm-1enZYEaC6FJslF32PQV278Z1TSJvamHI4x0X1_MV3g==
comment_listing_asset.js
blog.threatstop.com/hs/hsstatic/AsyncSupport/static-1.89/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs/hsstatic/AsyncSupport/static-1.89/js/comment_listing_asset.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d1727bd82b767b5a6122bad9776dd8ccc1b765b154c0d1714275850513c19c0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 97971aa6c140e2dfc8adaee6c929eedc.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
25795
x-amz-server-side-encryption
AES256
cf-ray
5e8632443911e007-FRA
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
content-encoding
br
cf-request-id
0607bdbea90000e007ac895000000001
last-modified
Fri, 09 Oct 2020 17:06:38 GMT
server
cloudflare
etag
W/"db1aaaabe87d2cd6b23b3da27adf5142"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
_MNnC7kCCHWp983DFs3n9X9gMvwUNtF0
cache-control
s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-cf-pop
IAD89-C3
content-type
application/javascript; charset=utf-8
x-amz-cf-id
uUlANC26igaINH0z8b97mTWL-WW4r57CoFyJUf_xFsjbAFPt8NPB7w==
v2.js
blog.threatstop.com/_hcms/forms/ 		472 KB
117 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/_hcms/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
28a10c1f5d82f21d724f45b8fe8d90be175ca8b321efa5ee71888cbe540060ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 5a45573ebecfd555d93af04bbbcf0557.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
age
437
x-amz-server-side-encryption
AES256
cf-ray
5e8632443914e007-FRA
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
content-encoding
br
cf-request-id
0607bdbea90000e00747b09000000001
last-modified
Thu, 15 Oct 2020 02:32:44 UTC
server
cloudflare
etag
W/"a442134e9b64c42c15f1ed8e6a94aefd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-version-id
yjyeVe_DCYhRLr8umQt3KURdr9unA.5k
access-control-allow-origin
*
cache-control
s-maxage=600, max-age=0
x-amz-cf-pop
IAD66-C2
content-type
application/javascript; charset=utf-8
x-amz-cf-id
DVs5eciA0-Xaed1WgOVgbPpGFKL_cF_dmngPqkWV3I-xt7RfYmFf2w==
index.js
blog.threatstop.com/hs/hsstatic/HubspotToolsMenu/static-1.79/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs/hsstatic/HubspotToolsMenu/static-1.79/js/index.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dd3eb59038a5df086653388d9394fed2f2f1d72d9c01cfdc4920247a9d371e83

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 157ebd6865840045fc8b5ed1cce7e466.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
25795
x-amz-server-side-encryption
AES256
cf-ray
5e8632443917e007-FRA
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
content-encoding
br
cf-request-id
0607bdbeaa0000e0074f303000000001
last-modified
Mon, 14 Sep 2020 20:19:23 GMT
server
cloudflare
etag
W/"e669ca94e2fffafc96a88184dda30834"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
RcBG9DPSu_6ZVzKnktPJ4cTzKi_y_4VM
cache-control
s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-cf-pop
IAD89-C3
content-type
application/javascript; charset=utf-8
x-amz-cf-id
hiNdE0IIaVHlCO0mTqsjP3bjfopYeE-5BCBuBMX1LTuRoCMFEIUwsw==
jquery-1.7.1.js
blog.threatstop.com/hs/hsstatic/jquery-libs/static-1.1/jquery/ 		92 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs/hsstatic/jquery-libs/static-1.1/jquery/jquery-1.7.1.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 20f0d9cf6610f77242f5c592d2ecfd1d.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
25795
cf-ray
5e8632445950e007-FRA
x-cache
Hit from cloudfront
status
200
content-encoding
br
cf-request-id
0607bdbebb0000e007bc0db000000001
last-modified
Tue, 25 Nov 2014 17:03:30 GMT
server
cloudflare
etag
W/"ddb84c1587287b2df08966081ef063bf"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
null
cache-control
s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-cf-pop
IAD89-C3
content-type
application/javascript; charset=utf-8
x-amz-cf-id
cD_kiTUiXvqgZaLkWMGxKSY-iSu3BJyeGrOixSpGtUiIcmYMoJuBNg==
project.css
blog.threatstop.com/hs/hsstatic/BlogSocialSharingSupport/static-1.16/bundles/ 		720 B
592 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs/hsstatic/BlogSocialSharingSupport/static-1.16/bundles/project.css
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf3e0ecae28a70c5e010c24c160321243efe54f497d49a6a8f31ca12ee7eb972

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 ffa4b37ccdc94a8c62bf6b6414725210.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
25795
x-amz-server-side-encryption
AES256
cf-ray
5e8632445949e007-FRA
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
content-encoding
br
cf-request-id
0607bdbeb90000e007a7bf3000000001
last-modified
Wed, 19 Aug 2020 22:47:10 GMT
server
cloudflare
etag
W/"a81c70764750950eb72d4537c41e781f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
7bzlyDLBPgFUhJmnx6rYCRN4B2XAfbkA
cache-control
s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-cf-pop
IAD89-C3
content-type
text/css
x-amz-cf-id
p2oPzw2RgdSxetVdG1wQtW9jStqaOZ-DMAFlgXJXww3Njuj20ioMTQ==
comments_listing_asset.css
blog.threatstop.com/hs/hsstatic/AsyncSupport/static-1.89/sass/ 		1 KB
632 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs/hsstatic/AsyncSupport/static-1.89/sass/comments_listing_asset.css
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
895371b22358988c93ca9e5318fdf9784782e44efff401ea65d7171cd9a12bc6

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 738984066968793a5714282f49fe0ab9.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
25794
x-amz-server-side-encryption
AES256
cf-ray
5e863244594ce007-FRA
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
content-encoding
br
cf-request-id
0607bdbeba0000e007d3afe000000001
last-modified
Fri, 09 Oct 2020 17:06:38 GMT
server
cloudflare
etag
W/"c968756b365e11e754dac723e04806b7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
6ekD4Vx9XeTxF5BzZeb1sJe9rb5WwDSz
cache-control
s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-cf-pop
IAD89-C3
content-type
text/css
x-amz-cf-id
1uZzKPmRyoL2SmFw7_Ill2D5sZY8_MYSOUSkfWz0mueBLsU2WypKQQ==
js
www.googletagmanager.com/gtag/ 		94 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-2012230-3
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b918af842098cb2ef6447e79178ba962d8d0e011b264705bbcd31fe9697067a3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
content-encoding
br
vary
Accept-Encoding
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37949
x-xss-protection
0
last-modified
Mon, 26 Oct 2020 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 26 Oct 2020 18:21:19 GMT
in.js
platform.linkedin.com/ 		181 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.linkedin.com/in.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F0A) /
Resource Hash
b3b09cc1a022c4c266a81312b9d6e34ed28175b2ec387eb75620922f6de43274

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
content-encoding
gzip
x-cdn-client-ip-version
IPV6
x-cdn
ECST
age
1612
x-cache
HIT
status
200
x-cdn-proto
HTTP2
content-length
55605
x-li-uuid
pB/FbF2cQRYACxc+KCsAAA==
server
ECAcc (frc/8F0A)
last-modified
Mon, 26 Oct 2020 17:54:27 GMT
x-li-pop
prod-eda6
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
accept-ranges
bytes
x-li-proto
http/1.1
x-li-fabric
prod-lva1
expires
Mon, 26 Oct 2020 18:54:27 GMT
layout.min.css
cdn2.hubspot.net/hub/-1/hub_generated/template_assets/1495141902003/hubspot_default/shared/responsive/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn2.hubspot.net/hub/-1/hub_generated/template_assets/1495141902003/hubspot_default/shared/responsive/layout.min.css
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:f1cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
341a4d40ad1b2560db940f906716d0e9539d4c0785399d7e0348fd0d3af00170

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
content-encoding
br
cf-cache-status
HIT
age
593198
status
200
x-amz-meta-md5-hash
0b0c633d59ab0af9553a98c0e7d97349
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 8
cf-request-id
0607bdbec90000177621974000000001
last-modified
Thu, 18 May 2017 21:11:43 GMT
server
cloudflare
etag
W/"0b0c633d59ab0af9553a98c0e7d97349"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
s-maxage=7200, max-age=7200
x-amz-cf-pop
IAD89-C1
cf-ray
5e8632447ae51776-FRA
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 8
Threatstop_Nov2016-style.min.css
blog.threatstop.com/hs-fs/hub/2548414/hub_generated/template_assets/4457237089/1603303521464/Coded_files/Custom/page/Threatstop_Nov2016-theme/ 		66 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs-fs/hub/2548414/hub_generated/template_assets/4457237089/1603303521464/Coded_files/Custom/page/Threatstop_Nov2016-theme/Threatstop_Nov2016-style.min.css
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
927f625f322af8f4f4dda14a02d969dc28bcd9039f2b2cf889cb3c3ec0f0f205

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront)
cf-cache-status
REVALIDATED
x-amz-cf-pop
IAD89-C1
x-hs-alternate-content-type
text/plain
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
status
200
x-amz-replication-status
COMPLETED
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 11
content-encoding
br
x-amz-request-id
B27B57E09CBF3D18
x-amz-id-2
bJ2zdha34h+ztVxZlrG/kL4eLqejfpNU8h2OO4ZCjk/CLMK4RWVeA25s8h0btrwjyuoxdT92TQY=
last-modified
Wed, 21 Oct 2020 18:05:22 GMT
server
cloudflare
etag
W/"073ab8530b17e9b03f9d9c910e5e08eb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-meta-created-unix-time-millis
1603303521464
content-type
text/css
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
7YQkZpUR5F_BkH1zOwjka5h6hCW5hnOT
cf-request-id
0607bdbeba0000e007918f3000000001
cf-ray
5e863244594fe007-FRA
x-amz-cf-id
8G2iUJY7LXYXilTiK0yTT3W8HC82HQn1oYf-hAUbMMnFO8twzHB1kw==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 11
TS-Logo-Black.png
blog.threatstop.com/hs-fs/hubfs/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.threatstop.com/hs-fs/hubfs/TS-Logo-Black.png?width=200&name=TS-Logo-Black.png
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3deb9301f5b7ee8be71f86ead73f0da2718119d5651d9ad2ec290f3b26ae103f

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 0fbab52df0695e2a561cd26eb7f9484d.cloudfront.net (CloudFront)
cf-cache-status
MISS
x-amz-cf-pop
IAD89-C1
x-amz-server-side-encryption
AES256
edge-cache-tag
F-5234003574,P-2548414,FLS-ALL
status
200
x-amz-replication-status
COMPLETED
x-cache
Miss from cloudfront
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 11
content-length
6295
cf-request-id
0607bdbf0a0000e007e8b5a000000001
last-modified
Wed, 21 Oct 2020 17:03:29 GMT
server
cloudflare
etag
"9d6ace44b949117813c0d6b5c4069c85"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
5e863244da6ee007-FRA
x-amz-cf-id
ERlFXX5eORyZajJMwg6QMwrtgUkwe12Dga52dx90_bBBJaRT3hpK-Q==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 11
zeus-greek-gods.jpg
blog.threatstop.com/hs-fs/hubfs/ 		33 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.threatstop.com/hs-fs/hubfs/zeus-greek-gods.jpg?width=455&name=zeus-greek-gods.jpg
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ca5e064e4024b35fa7e097aaf77fb27da6cf580665d0355048cd3227be182d3

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 0fbab52df0695e2a561cd26eb7f9484d.cloudfront.net (CloudFront)
cf-cache-status
MISS
x-amz-cf-pop
IAD89-C1
x-amz-server-side-encryption
AES256
edge-cache-tag
F-5262711986,P-2548414,FLS-ALL
status
200
x-amz-replication-status
COMPLETED
x-cache
RefreshHit from cloudfront
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 11
content-length
33643
cf-request-id
0607bdbf0b0000e007bc0e4000000001
last-modified
Wed, 07 Oct 2020 08:15:09 GMT
server
cloudflare
etag
"82cd5fa08c033660758e9cbe8f963581"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
access-control-allow-credentials
false
accept-ranges
bytes
cf-ray
5e863244da70e007-FRA
x-amz-cf-id
y5DDHe6Jhay5MbH1Cwf6ijqd6Lr6Mctt29iq2l75GVjI0YM3qFkv_Q==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 11
85b7ef36-8763-490d-bc35-71b5614dede1.png
no-cache.hubspot.com/cta/default/2548414/ 		722 B
941 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://no-cache.hubspot.com/cta/default/2548414/85b7ef36-8763-490d-bc35-71b5614dede1.png
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6bab4e86d62b8b9835219e2834564390b88e56d827420ba4c10daf8f9c973a44
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
cf-cache-status
DYNAMIC
x-amz-request-id
29D31D136236F4BB
x-amz-server-side-encryption
AES256
status
200
content-length
722
x-amz-id-2
npA+PKfRYWWibsQw+Y6XC6rQm+xCX+qPmYh2PsfU7zVI8MOIP8rkK0FirmBpFePpUhFMfgXOXr4=
last-modified
Fri, 18 Sep 2020 16:52:24 GMT
server
cloudflare
etag
"ab620c48453005c66c7d1768ea7a29a2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
no-cache, no-store
cf-request-id
0607bdbf1f00002b16fd907000000001
accept-ranges
bytes
cf-ray
5e863244ffe62b16-FRA
current.js
blog.threatstop.com/hs/cta/cta/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs/cta/cta/current.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5d4829469e6064155fae5206ebe9830bc2e5b2ce5b6914b388aafedfd2fa215
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 91edf3d46098c7786cee1900c8e34990.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
HIT
age
456
x-amz-server-side-encryption
AES256
cf-ray
5e863244da61e007-FRA
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
content-encoding
br
cf-request-id
0607bdbf080000e007fd933000000001
last-modified
Fri, 16 Oct 2020 09:29:03 UTC
server
cloudflare
etag
W/"d88e52a8f091f9d691cdffe50a5540c6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-version-id
b8y05eep.TS0Bx3r5pNPvkA_D8CZc2D6
cache-control
max-age=600
x-amz-cf-pop
IAD66-C2
content-type
application/javascript; charset=utf-8
x-amz-cf-id
0QXhzBrkvUZLiDzqx-zTyapRbF8Bil2SeMpL_CtFl5tA7WSDXDoDNg==
8093222e-eef6-41f3-bc5f-e4272bef25f2.png
no-cache.hubspot.com/cta/default/2548414/ 		820 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://no-cache.hubspot.com/cta/default/2548414/8093222e-eef6-41f3-bc5f-e4272bef25f2.png
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c2a5f70df3f1acc045dcc9621912051328e61056e134ca00bde0b8e367d2ff1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
cf-cache-status
DYNAMIC
x-amz-request-id
5WATEK5Z4Y8R4J6T
x-amz-server-side-encryption
AES256
status
200
content-length
820
x-amz-id-2
EHe8nfwLzYx7bu9sp1/orsekC+/oiIVtFrAvrVT6a4fg+B53X8SRu/alQC4JWBFsxTCwcNMS+9w=
last-modified
Fri, 18 Sep 2020 16:52:23 GMT
server
cloudflare
etag
"b55be400d383087af8179f1190910c40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
no-cache, no-store
cf-request-id
0607bdbf2000002b16e22e6000000001
accept-ranges
bytes
cf-ray
5e863244ffea2b16-FRA
Threatstop_Nov2016-main.js
blog.threatstop.com/hs-fs/hub/2548414/hub_generated/template_assets/4457257049/1569708369521/Coded_files/Custom/page/Threatstop_Nov2016-theme/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs-fs/hub/2548414/hub_generated/template_assets/4457257049/1569708369521/Coded_files/Custom/page/Threatstop_Nov2016-theme/Threatstop_Nov2016-main.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ee76632067ef875bb89c78492f57d043ae5a78513c362949aa4085f19310f6da

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
via
1.1 7dc4818c830423900ae855831181d2b8.cloudfront.net (CloudFront)
cf-cache-status
REVALIDATED
x-amz-cf-pop
IAD89-C1
x-cache
RefreshHit from cloudfront
status
200
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 11
content-encoding
br
x-amz-request-id
2C6963B8B5C60911
x-amz-id-2
QLPAzt5x8UgxhYxi3+t++gCR3OVdEjMaMNqNTYwChYEL+LPqf5BR8CGIBha/ejv5JFdavkpb8Q8=
last-modified
Sat, 28 Sep 2019 22:06:10 GMT
server
cloudflare
etag
W/"2c8e2565870757b9b4b8f3ae8654b704"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900, s-maxage=31536000, max-age=31536000
access-control-allow-credentials
false
x-amz-version-id
nQ6vxeghMCkR0J6htambKCfOf.pJuDnS
cf-request-id
0607bdbf090000e00746212000000001
cf-ray
5e863244da63e007-FRA
x-amz-cf-id
pRpX0rkNmABtetLJWWhKjZFsFH-B3E_dqnfcmJLqL8Ws385SQJIPVg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 11
jscroll.js
blog.threatstop.com/hubfs/Threatstop_Nov2016/JS/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hubfs/Threatstop_Nov2016/JS/jscroll.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3fe48a394d503fb2828eec569ff1627d90fab6ba358df438ee0c7c4f17daeb86

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-meta-cache-tag
F-4616295803,P-2548414,FLS-ALL
age
25793
edge-cache-tag
F-4616295803,P-2548414,FLS-ALL
status
200
x-cache
RefreshHit from cloudfront
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 11
content-encoding
br
x-amz-request-id
8EF8CC072DF05603
cf-request-id
0607bdbf0e0000e0073124c000000001
last-modified
Thu, 05 Oct 2017 23:38:15 GMT
server
cloudflare
etag
W/"ae2ac358c33d05e2d2aa892cfbcf0f74"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-amz-id-2
tbvQY+C7jsw8DzW+BZeBuyUlxW7biQ8lnVr0wZz0LmILUt5oqGAscmvMQ8BIKT8aZHHmcYbQlwU=
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-version-id
3ELg3ap6IiF8U2iORCiXbxf1m.JYpvGe
x-amz-cf-pop
FRA6-C1
cf-ray
5e863244da6ae007-FRA
x-amz-cf-id
d-8ldgfAY1cDWE_Efh1WIoYta-ur_ulJyww2ogA7IYL-CGTFcsY0gg==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 11
2548414.js
blog.threatstop.com/hs/scriptloader/ 		1 KB
669 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs/scriptloader/2548414.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
afcf451d2d9e9cf017d0d5c61810c12f1b5560a75d44a67a231a3884157ba4f9

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
x-trace
2BCBE2BFD2CD3C98444E1DDB1D1A1510BAA1768B18000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
status
200
cache-control
public, max-age=60
access-control-allow-credentials
false
cf-ray
5e863244da71e007-FRA
cf-request-id
0607bdbf100000e00746214000000001
expires
Mon, 26 Oct 2020 18:22:19 GMT
conversion.js
www.googleadservices.com/pagead/ 		29 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f2.1e100.net
Software
cafe /
Resource Hash
fa7c2cd8fa0196bca6e808ed4259571ad5ff7372f37de837a16fd90aaca7e51d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
11440
x-xss-protection
0
server
cafe
etag
2885770095241673848
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 26 Oct 2020 18:21:19 GMT
fbevents.js
connect.facebook.net/en_US/ 		88 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
default-src https: data: wss: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.facebook.com/csp/reporting/;
status
200
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
23070
x-xss-protection
0
pragma
public
x-fb-debug
j4RcG3aDr71ckY/S2YgViCumHnz++hgmWoOWw00+ReIcpxgXDUJZ4ElzPyJFQDFiWjGQvkLInkTZqez7Oz8kKQ==
x-fb-trip-id
664085054
x-frame-options
DENY
date
Mon, 26 Oct 2020 18:21:19 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
expires
Sat, 01 Jan 2000 00:00:00 GMT
439793516377641
connect.facebook.net/signals/config/ 		234 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/439793516377641?v=2.9.27&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9a5498f2546daaadd9314073d33719d8bf095660ba8c3904dbcb649357624eed
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
gUFRiABisJCSTpwa+j4vVkgGFNaOBhfoW6wvdjq5QPjZX8JJkEFcDveJx2xxQbzS7Zonyo+sJhR8MzOsluyEUw==
x-fb-trip-id
664085054
date
Mon, 26 Oct 2020 18:21:19 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
expires
Sat, 01 Jan 2000 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2012230-3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 09 Sep 2020 01:50:37 GMT
server
Golfe2
age
3931
date
Mon, 26 Oct 2020 17:15:48 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18650
expires
Mon, 26 Oct 2020 19:15:48 GMT
collect
www.google-analytics.com/j/ 		2 B
70 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j86&a=1805111823&t=pageview&_s=1&dl=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&ul=en-us&de=UTF-8&dt=Zloader%2FTerdot%20%E2%80%93%20That%20Man%20in%20the%20Middle&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=739396051&gjid=1863725904&cid=1280328631.1603736480&tid=UA-2012230-3&_gid=537905175.1603736480&_r=1&gtm=2ouae1&z=868929490
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 26 Oct 2020 18:21:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
text/plain
access-control-allow-origin
https://blog.threatstop.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
469 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-2012230-3&cid=1280328631.1603736480&jid=739396051&gjid=1863725904&_gid=537905175.1603736480&_u=IEBAAUAAAAAAAC~&z=1938069600
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Mon, 26 Oct 2020 18:21:19 GMT
status
200
content-type
text/plain
access-control-allow-origin
https://blog.threatstop.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
376 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=439793516377641&ev=PageView&dl=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&rl=&if=false&ts=1603736479613&sw=1600&sh=1200&v=2.9.27&r=stable&ec=0&o=30&fbp=fb.1.1603736479612.1542215381&it=1603736479522&coo=false&rqm=GET
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Mon, 26 Oct 2020 18:21:19 GMT
ga-audiences
www.google.com/ads/ 		42 B
292 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-2012230-3&cid=1280328631.1603736480&jid=739396051&_u=IEBAAUAAAAAAAC~&z=95962930
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Oct 2020 18:21:19 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-2012230-3&cid=1280328631.1603736480&jid=739396051&_u=IEBAAUAAAAAAAC~&z=95962930
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Oct 2020 18:21:19 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
css
fonts.googleapis.com/ 		25 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs-fs/hub/2548414/hub_generated/template_assets/4457237089/1603303521464/Coded_files/Custom/page/Threatstop_Nov2016-theme/Threatstop_Nov2016-style.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a758040e3d48d51c8085342320827fceb7a23d282f0c29d8e3e3aa414ba5c39d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/hs-fs/hub/2548414/hub_generated/template_assets/4457237089/1603303521464/Coded_files/Custom/page/Threatstop_Nov2016-theme/Threatstop_Nov2016-style.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 26 Oct 2020 16:23:21 GMT
server
ESF
date
Mon, 26 Oct 2020 18:21:19 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 26 Oct 2020 18:21:19 GMT
font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/ 		32 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/font-awesome.css
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs-fs/hub/2548414/hub_generated/template_assets/4457237089/1603303521464/Coded_files/Custom/page/Threatstop_Nov2016-theme/Threatstop_Nov2016-style.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
082b0736a3408950e50fd65a090921003fe83d89ec6e3084549a01d5dfa9e854

Request headers

Referer
https://blog.threatstop.com/hs-fs/hub/2548414/hub_generated/template_assets/4457237089/1603303521464/Coded_files/Custom/page/Threatstop_Nov2016-theme/Threatstop_Nov2016-style.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
425138
x-via
cfworker/kv
status
200
content-length
5195
cf-request-id
0607bdc016000064499495a000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
etag
"5eb03e5f-81d1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=t%2BuBwg%2BRqzf6VogtE7%2BKIxIJV6FNwLQ3h8EGPM%2Bx5vvvFBbU4aZ6%2B9p29MYrOuNd8Jno7Kp6J4GHIYNCMEOBmEIUBGK1wSQZua%2BM%2FkLRrzSJ%2FYk4H5gzPDtVl2MacOrGXA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5e86324689106449-FRA
expires
Sat, 16 Oct 2021 18:21:19 GMT
css
fonts.googleapis.com/ 		1 KB
532 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Francois+One:400
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs-fs/hub/2548414/hub_generated/template_assets/4457237089/1603303521464/Coded_files/Custom/page/Threatstop_Nov2016-theme/Threatstop_Nov2016-style.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a0765e55871b735d4d9e616bc42f9b3158e087460a415043009067304a37bf90
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/hs-fs/hub/2548414/hub_generated/template_assets/4457237089/1603303521464/Coded_files/Custom/page/Threatstop_Nov2016-theme/Threatstop_Nov2016-style.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 26 Oct 2020 18:21:19 GMT
server
ESF
date
Mon, 26 Oct 2020 18:21:19 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 26 Oct 2020 18:21:19 GMT
s-BiyweUPV0v-yRb-cjciPk_vArhqVIZ0nv9q090hN8.woff
cdn2.hubspot.net/hubfs/2548414/Threatstop_Nov2016/Fonts/ 		25 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn2.hubspot.net/hubfs/2548414/Threatstop_Nov2016/Fonts/s-BiyweUPV0v-yRb-cjciPk_vArhqVIZ0nv9q090hN8.woff
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs-fs/hub/2548414/hub_generated/template_assets/4457237089/1603303521464/Coded_files/Custom/page/Threatstop_Nov2016-theme/Threatstop_Nov2016-style.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:f1cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d5657ce4d50c13924350b5e42a1bc7e527262d2a15e0e98087a81b6fa931acff

Request headers

Origin
https://blog.threatstop.com
Referer
https://blog.threatstop.com/hs-fs/hub/2548414/hub_generated/template_assets/4457237089/1603303521464/Coded_files/Custom/page/Threatstop_Nov2016-theme/Threatstop_Nov2016-style.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:19 GMT
via
1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-amz-meta-cache-tag
F-4617177723,P-2548414,FLS-ALL
age
25792
edge-cache-tag
F-4617177723,P-2548414,FLS-ALL
status
200
x-cache
RefreshHit from cloudfront
x-hs-cf-lambda
us-east-1.enforceAclForReadsProd 11
content-encoding
br
x-amz-request-id
6FCAC5EFBEE25A9A
cf-request-id
0607bdc04900002b7dd090c000000001
x-amz-id-2
wh/xxfEb7zXadxsFVSGgotGfQQaCTO1M+HQtaYrO+4uxsq3qoDIZ9TOfvK1EKdKdFNM9NbdeS2k=
last-modified
Thu, 05 Oct 2017 23:38:15 GMT
server
cloudflare
etag
W/"509a4a718fd2110269a1b5a71119d80c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/font-woff
access-control-allow-origin
*
cache-control
s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-version-id
mYK8z25SGu_uA6zvTyzkKU0iAdUvhUvT
x-amz-cf-pop
FRA6-C1
cf-ray
5e863246da1c2b7d-FRA
x-amz-cf-id
kAORbh29zT8IEEiDa36fvRGEm2NPAih_PkpsSSUmxIHmY1aWzwQ7SA==
x-hs-cf-lambda-enforce
us-east-1.enforceAclForReadsProd 11
162830b9-5f2d-4ae2-83b8-0668bb7f651d
blog.threatstop.com/_hcms/forms/embed/v3/form/2548414/ 		20 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/_hcms/forms/embed/v3/form/2548414/162830b9-5f2d-4ae2-83b8-0668bb7f651d?callback=hs_reqwest_0&hutk=
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/_hcms/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
683d73dfc904c6f24d7dbf79ceebdca95cc4dc19f5c4862612431e93e10bb608
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
server
cloudflare
x-trace
2B51D529E57A8A4E485CAC432F21A652C7F8434294000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
status
200
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
content-disposition
attachment; filename=no-rfd.txt
cf-ray
5e863248a9dde007-FRA
cf-request-id
0607bdc1670000e0075f8fa000000001
a7b6a944-858e-4411-93bc-4ac896a23886
blog.threatstop.com/_hcms/forms/embed/v3/form/2548414/ 		19 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/_hcms/forms/embed/v3/form/2548414/a7b6a944-858e-4411-93bc-4ac896a23886?callback=hs_reqwest_1&hutk=
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/_hcms/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6dfab64414e5f01e83525a4f0b595a1724b1af2a1062c142762b47b82ab874c6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
server
cloudflare
x-trace
2B5FB9CDA0734BE1638AAD47A3EFF8BE4E1159F0E6000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
status
200
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
content-disposition
attachment; filename=no-rfd.txt
cf-ray
5e863248a9e2e007-FRA
cf-request-id
0607bdc1680000e007148a8000000001
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1057237493/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1057237493/?random=1603736480105&cv=9&fst=1603736480105&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&tiba=Zloader%2FTerdot%20%E2%80%93%20That%20Man%20in%20the%20Middle&hn=www.googleadservices.com&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef5ab40d50e5c8a8d6812ec1b1ca978ed2736312c49327eee2479e569cd7ce2a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Oct 2020 18:21:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
1030
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
all.js
connect.facebook.net/en_US/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/all.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
44920f3bd51b0469ad6c8a3c9ec4569765c728792cabdad9c551a16edcd29f46
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
Hm09pdcR+95oXrqaR8+HYw==
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1780
etag
"80895c6c582856984471d0c6fe341c2e"
x-fb-debug
J4oH6m/yAo7/sVVpbfjnQS4T8cV6xMgj3Pzmox0Zx2iugR9fXMYswxTBoBZBt/nL3/tduKCPZT7E9aPyt1yTpQ==
x-fb-trip-id
664085054
x-fb-content-md5
68b9537396760ef5665766c1db6ba96c
x-frame-options
DENY
date
Mon, 26 Oct 2020 18:21:20 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 26 Oct 2020 18:28:21 GMT
widgets.js
platform.twitter.com/ 		95 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (fcn/4192) /
Resource Hash
2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 26 Oct 2020 18:21:20 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Oct 2020 21:52:09 GMT
Server
ECS (fcn/4192)
Age
644
Etag
"a671d4d584ef50954e5cebb21da17065+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
28698
public
api.hubapi.com/comments/v3/comments/thread/ 		75 B
550 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api.hubapi.com/comments/v3/comments/thread/public?portalId=2548414&offset=0&limit=1000&contentId=5262664117&collectionId=4539653656&callback=jsonp_1603736480131_86566
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs/hsstatic/AsyncSupport/static-1.89/js/comment_listing_asset.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:cccc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
35ebefb2ea1aea9317a4ad839c48c0410bc67ea99617888e25493cde63c48664
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
x-trace
2B1EB2438FA79D147B7C25E67EE1734BE6105E50A6000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
access-control-allow-credentials
false
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
5e863248ec9797ea-FRA
cf-request-id
0607bdc195000097ea96b19000000001
has-permission
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 		0
277 B 		Script
General
Check archive.org
Download Go to
Full URL
https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission?portalId=2548414&callback=jsonpHandler
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs/hsstatic/HubspotToolsMenu/static-1.79/js/index.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
cf-cache-status
DYNAMIC
server
cloudflare
x-trace
2BEB36B141300107E42D0C225E3888F61F75386410000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
status
204
cache-control
max-age=0
access-control-allow-credentials
false
cf-ray
5e863248eb5c2b16-FRA
cf-request-id
0607bdc18c00002b16dc275000000001
fb.js
js.hsadspixel.net/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hsadspixel.net/fb.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs/scriptloader/2548414.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:72b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
242409fa576bcb5b1a71fef56b23678871ee7d04566ab52d02cac40901ed6953

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
via
1.1 20f0d9cf6610f77242f5c592d2ecfd1d.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
298
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
content-encoding
br
content-type
application/javascript; charset=utf-8
cf-request-id
0607bdc1a90000d6f1333e4000000001
last-modified
Wed, 21 Oct 2020 12:53:35 UTC
server
cloudflare
etag
W/"ccf4c3930c4c7f11e70b8e920469c952"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
MfiKUsk1dHgHPpisLj.Sxbewlnw9Cy4F
cache-control
max-age=600
x-amz-cf-pop
IAD89-C3
cf-ray
5e8632490a30d6f1-FRA
x-amz-cf-id
a2cqV6I0l1ThSUJIpRk13aRm6_U9OIZfUYjxmRLpH3fYzcmB87atog==
2548414.js
js.hs-analytics.net/analytics/1603736400000/ 		60 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-analytics.net/analytics/1603736400000/2548414.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs/scriptloader/2548414.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:45b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4958c44fe89c3250c689721cac2efbb943eac172a7efb0d30dd9453b9fda1726

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
content-encoding
br
cf-cache-status
MISS
x-amz-request-id
0967DB23C44556F7
x-amz-server-side-encryption
AES256
cf-ray
5e863249092e05c4-FRA
status
200
x-amz-id-2
7ELQIBeQDeolD3CvqWmf1077lD6WKyZv8b/eLQ2bWaiEfMemGG20h2/dXuBRgJiM8jlSSxMlo8A=
last-modified
Thu, 22 Oct 2020 18:38:35 GMT
server
cloudflare
etag
W/"eed41531f62faa043466985ec6b675aa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
null
cache-control
max-age=300, public
access-control-allow-credentials
false
cf-request-id
0607bdc1a8000005c49f2fe000000001
content-type
text/javascript
expires
Mon, 26 Oct 2020 18:26:20 GMT
2548414.js
js.hs-banner.com/ 		46 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-banner.com/2548414.js
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs/scriptloader/2548414.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:15bf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b488242c5d9328fa7c0b4cf42ea02b5409f34a7dc1ff2c1487059ab3b69f7da4

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-goog-hash
crc32c=eu4YyA==, md5=HwS5Zr+16WVog6B5wVXcsg==
date
Mon, 26 Oct 2020 18:21:20 GMT
content-encoding
br
cf-cache-status
EXPIRED
x-guploader-uploadid
ABg5-UyJ0xDAVpWJcwH_YHIbgzjcJgHWdcFM6CsO5JO2CGicB0t1qbiIQ5vD1ccybGzHwB4ObQkCwC9R5-q71Edqw_QwqxWEsw
x-goog-storage-class
STANDARD
status
200
access-control-max-age
604800
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
text/javascript; charset=UTF-8
cf-request-id
0607bdc1b100002bc6e3306000000001
timing-allow-origin
*
last-modified
Mon, 26 Oct 2020 17:03:14 GMT
server
cloudflare
etag
W/"1f04b966bfb5e9656883a079c155dcb2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-goog-generation
1603731794912632
access-control-allow-origin
https://blog.threatstop.com
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300, public
access-control-allow-credentials
true
x-goog-stored-content-length
47055
cf-ray
5e8632491d4c2bc6-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires
Mon, 26 Oct 2020 18:26:20 GMT
/
www.facebook.com/tr/ 		44 B
146 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=439793516377641&ev=Microdata&dl=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&rl=&if=false&ts=1603736480156&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Zloader%2FTerdot%20%E2%80%93%20That%20Man%20in%20the%20Middle%22%2C%22meta%3Adescription%22%3A%22Zloader%20acts%20as%20the%20loader%20for%20Zbot%2C%20after%20a%20successful%20phishing%20trip%2C%20or%20infection%20through%20SunDown%20EK%2C%20Zloader%20downloads%20Zbot.%20Then%20the%20real%20trouble%20starts.%22%7D&cd[OpenGraph]=%7B%22og%3Adescription%22%3A%22Zloader%20acts%20as%20the%20loader%20for%20Zbot%2C%20after%20a%20successful%20phishing%20trip%2C%20or%20infection%20through%20SunDown%20EK%2C%20Zloader%20downloads%20Zbot.%20Then%20the%20real%20trouble%20starts.%22%2C%22og%3Atitle%22%3A%22Zloader%2FTerdot%20%E2%80%93%20That%20Man%20in%20the%20Middle%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fblog.threatstop.com%2Fhubfs%2Fzeus-greek-gods.jpg%23keepProtocol%22%2C%22og%3Aimage%3Awidth%22%3A%22736%22%2C%22og%3Aimage%3Aheight%22%3A%22443%22%2C%22og%3Aimage%3Aalt%22%3A%22zeus-greek-gods.jpg%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle%22%2C%22og%3Atype%22%3A%22article%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.27&r=stable&ec=1&o=30&fbp=fb.1.1603736479612.1542215381&it=1603736479522&coo=false&es=automatic&tm=3&rqm=GET
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Mon, 26 Oct 2020 18:21:20 GMT
all.js
connect.facebook.net/en_US/ 		188 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/all.js?hash=2fc3b6d150448625a2e73bf136e4d9fa&ua=modern_es6
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
e9a6b226b341fc1eea3b6254d4ebf6f603a7b38cf4a6094972d61bae1ca3ca0a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Origin
https://blog.threatstop.com
Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
zhsrOwQHwyflpH4B9PVy/g==
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
57651
etag
"9a5eb7375c0de870acf2b0685647b76e"
x-fb-debug
HKw4EBVWamFFP/ejX0TKJfFchFhjDEe+EvTUsWcCQFFZq5fShY5Fjo8jJHTmdarAIbFU9gn4Fqe13WgbJSWeQg==
x-fb-trip-id
664085054
x-fb-content-md5
24a1ab13a342214f75a08ac09ae6a556
x-frame-options
DENY
date
Mon, 26 Oct 2020 18:21:20 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin
*
expires
Tue, 26 Oct 2021 16:09:09 GMT
widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html
platform.twitter.com/widgets/ Frame 6183 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fblog.threatstop.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (fcn/41A9) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
994920
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Mon, 26 Oct 2020 18:21:20 GMT
Etag
"9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified
Thu, 01 Oct 2020 21:50:01 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/41A9)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
5825
/
www.google.com/pagead/1p-user-list/1057237493/ 		42 B
519 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/1057237493/?random=1603736480105&cv=9&fst=1603735200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&tiba=Zloader%2FTerdot%20%E2%80%93%20That%20Man%20in%20the%20Middle&fmt=3&is_vtc=1&random=3676679994&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Oct 2020 18:21:20 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/1057237493/ 		42 B
519 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/1057237493/?random=1603736480105&cv=9&fst=1603735200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&tiba=Zloader%2FTerdot%20%E2%80%93%20That%20Man%20in%20the%20Middle&fmt=3&is_vtc=1&random=3676679994&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Oct 2020 18:21:20 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
button.63c51c903061d0dbd843c41e8a00aa5a.js
platform.twitter.com/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/js/button.63c51c903061d0dbd843c41e8a00aa5a.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (fcn/4192) /
Resource Hash
e0a70c5d116d9c823c7d7958ecea2a7926315fac156e390bd7dc8a5fa088cdc3

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 26 Oct 2020 18:21:20 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Oct 2020 21:49:51 GMT
Server
ECS (fcn/4192)
Age
1025476
Etag
"62d4b0301f07768d13f3ee5de8633739+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
2294
tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
platform.twitter.com/widgets/ Frame 0DAB 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (fcn/4192) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
1025477
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Mon, 26 Oct 2020 18:21:20 GMT
Etag
"076dccdedb34f3771be52190b917884e+gzip"
Last-Modified
Thu, 01 Oct 2020 21:49:58 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/4192)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
12263
api.js
www.google.com/recaptcha/ 		918 B
764 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?onload=hsRecaptchaLoadCallback&render=explicit&isolated=true
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/_hcms/forms/v2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
dd01b37b4ba40f9c11db5f6ccb35f4b5edf6b3e041d487c8ae5f2fb3d9534276
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
583
x-xss-protection
1; mode=block
expires
Mon, 26 Oct 2020 18:21:20 GMT
_Xmr-H4zszafZw3A-KPSZut9wQiRmfW_Aw.woff2
fonts.gstatic.com/s/francoisone/v15/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/francoisone/v15/_Xmr-H4zszafZw3A-KPSZut9wQiRmfW_Aw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Francois+One:400
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
96cfec5bdef2e05c4c1a5c1d8e5df9bfa0a715d55930270afab9d47cc00ce274
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://blog.threatstop.com
Referer
https://fonts.googleapis.com/css?family=Francois+One:400
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 21 Oct 2020 11:21:18 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Sep 2020 05:10:07 GMT
server
sffe
age
457202
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10940
x-xss-protection
0
expires
Thu, 21 Oct 2021 11:21:18 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/T9w1ROdplctW2nVKvNJYXH8o/ 		341 KB
134 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/T9w1ROdplctW2nVKvNJYXH8o/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=hsRecaptchaLoadCallback&render=explicit&isolated=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54f3aa37078dcd01911c9da1a5fd753b5834dde5acfd90c5bd55243bba87cf6d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://blog.threatstop.com
Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 17:30:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3075
status
200
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
136962
x-xss-protection
0
last-modified
Mon, 12 Oct 2020 04:11:53 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 26 Oct 2021 17:30:05 GMT
anchor
www.google.com/recaptcha/api2/ Frame E001 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc2_RsUAAAAAAYBSd4rxsgeQz7whuL9COCsHeET&co=aHR0cHM6Ly9ibG9nLnRocmVhdHN0b3AuY29tOjQ0Mw..&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&size=invisible&badge=inline&cb=3yniy3hxgqjr
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/T9w1ROdplctW2nVKvNJYXH8o/recaptcha__en.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-Hn+/whqZ0YrefamkZwfpVA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/anchor?ar=1&k=6Lc2_RsUAAAAAAYBSd4rxsgeQz7whuL9COCsHeET&co=aHR0cHM6Ly9ibG9nLnRocmVhdHN0b3AuY29tOjQ0Mw..&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&size=invisible&badge=inline&cb=3yniy3hxgqjr
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 26 Oct 2020 18:21:20 GMT
content-security-policy
script-src 'report-sample' 'nonce-Hn+/whqZ0YrefamkZwfpVA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
10535
server
GSE
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
counters.gif
perf.hsforms.com/embed/v3/ 		35 B
526 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://perf.hsforms.com/embed/v3/counters.gif?key=forms-next-recaptcha-viewed&count=1&portalId=2548414
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5805 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
cf-cache-status
DYNAMIC
server
cloudflare
x-trace
2BB64C20A2112C1A5BD0E86C8B0BFAB3BB5036DAB7000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
5e86324b3bd39790-FRA
content-length
35
cf-request-id
0607bdc30200009790e307a000000001
jot
syndication.twitter.com/i/ 		43 B
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22threatstop%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1603736480522%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%22ed20a2b%3A1601588405575%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
119
pragma
no-cache
last-modified
Mon, 26 Oct 2020 18:21:20 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
f72f749dc098987ea8de5f5113808195
x-transaction
0060685200c6b015
expires
Tue, 31 Mar 1981 05:00:00 GMT
like.php
www.facebook.com/plugins/ Frame 628D
Redirect Chain
  • https://web.facebook.com/plugins/like.php?action=like&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df904acf9079814%26domain%3Dblog.threatst...
  • https://www.facebook.com/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df904acf9079814%26domain%3Dblog.threatsto...
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df904acf9079814%26domain%3Dblog.threatstop.com%26origin%3Dhttps%253A%252F%252Fblog.threatstop.com%252Ff3554bedfbee834%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&layout=button_count&locale=en_US&sdk=joey&share=true&show_faces=false&width=120&_rdc=1&_rdr
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=2fc3b6d150448625a2e73bf136e4d9fa&ua=modern_es6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df904acf9079814%26domain%3Dblog.threatstop.com%26origin%3Dhttps%253A%252F%252Fblog.threatstop.com%252Ff3554bedfbee834%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&layout=button_count&locale=en_US&sdk=joey&share=true&show_faces=false&width=120&_rdc=1&_rdr
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
fr=0eRKgaY4jnkecsUDv..BflxOf...1.0.BflxOf.
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
about:blank

Response headers

status
200
vary
Accept-Encoding
pragma
no-cache
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
cache-control
private, no-cache, no-store, must-revalidate
content-encoding
br
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
x-xss-protection
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
content-type
text/html; charset="utf-8"
x-fb-debug
l2ahes8S5QY69PQQ+UKJ66yqvy2l6257Wg9hUcPf6PpuBPylqbdUCTicZaKjJoV60q30LzsYv4SDpVA1EArFIA==
date
Mon, 26 Oct 2020 18:21:20 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

status
302
location
https://www.facebook.com/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df904acf9079814%26domain%3Dblog.threatstop.com%26origin%3Dhttps%253A%252F%252Fblog.threatstop.com%252Ff3554bedfbee834%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&layout=button_count&locale=en_US&sdk=joey&share=true&show_faces=false&width=120&_rdc=1&_rdr
x-fb-zr-redirect
02|1603822880|FzBFAiEAw3aOEzm3Nb5ZIIiQE7ctn2zgnlWJmKDnon2ZY3ikD_UCIEKuAUV3RsFmN7Oc0q33GvwYwJMVZqxDd7LB5QdJusZ6
strict-transport-security
max-age=15552000; preload
content-type
text/html; charset="utf-8"
x-fb-debug
8wBfNvaJp0Plu2Z0KtxWCnPEXnfmzd6lvubo+/rxmFme7H1ouExP4/iBMwEBUAl43u8HBfBpsMIuEodrAbsE3A==
content-length
0
date
Mon, 26 Oct 2020 18:21:20 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
collect
www.google-analytics.com/j/ 		2 B
48 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j86&a=1805111823&t=pageview&_s=1&dl=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&ul=en-us&de=UTF-8&dt=Zloader%2FTerdot%20%E2%80%93%20That%20Man%20in%20the%20Middle&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=KEDAAUABAAAAAC~&jid=474660449&gjid=952594996&cid=1280328631.1603736480&tid=UA-2012230-6&_gid=537905175.1603736480&_r=1&_slc=1&z=539332124
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 26 Oct 2020 18:21:20 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
text/plain
access-control-allow-origin
https://blog.threatstop.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
json
api.hubapi.com/hs-script-loader-public/v1/config/pixel/ 		68 B
670 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.hubapi.com/hs-script-loader-public/v1/config/pixel/json?portalId=2548414
Requested by
Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:cccc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d94052d4af9c315c400e7a7e5b119c6e37a3d514452fc3b2a13a0159164d201c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
DYNAMIC
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-request-id
0607bdc4210000324c8a2cc000000001
server
cloudflare
x-trace
2BD270C4565B4251E80929AE9A283D7B89177B47BD000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
180
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type
application/json;charset=utf-8
access-control-allow-origin
https://blog.threatstop.com
access-control-allow-credentials
false
cf-ray
5e86324d0e9b324c-FRA
access-control-allow-headers
*
loader-v2.js
blog.threatstop.com/hs/cta/ctas/v2/public/cs/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs/cta/ctas/v2/public/cs/loader-v2.js?cos=1&__hsfp=2978788718&__hssc=138000303.1.1603736480786&__hstc=138000303.3529e0d1687cab4d14d2bf4252cea4bb.1603736480785.1603736480785.1603736480785.1&canon=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&hsutk=3529e0d1687cab4d14d2bf4252cea4bb&pageId=5262664117&contentType=blog-post&pg=85b7ef36-8763-490d-bc35-71b5614dede1&pid=2548414&sv=cta-embed-js-static-1.10&lag=1001&rdy=1&cos=1&df=a
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs/cta/cta/current.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
adaf06a8993c5a58cd09142b881ce93438bcdc0f44faf7dbc8765f38548177f4

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
content-encoding
gzip
cf-cache-status
MISS
cf-ray
5e86324cfa0be007-FRA
status
200
content-disposition
attachment; name="loaderJS" filename="loader-v2.js"
content-length
2151
cf-request-id
0607bdc41b0000e00725366000000001
server
cloudflare
x-trace
2B816545B02B5F862195E9A3E4FF74FD6A7748EEFA000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
cache-control
no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials
false
accept-ranges
bytes
x-robots-tag
noindex, follow
loader-v2.js
blog.threatstop.com/hs/cta/ctas/v2/public/cs/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs/cta/ctas/v2/public/cs/loader-v2.js?cos=1&__hsfp=2978788718&__hssc=138000303.1.1603736480786&__hstc=138000303.3529e0d1687cab4d14d2bf4252cea4bb.1603736480785.1603736480785.1603736480785.1&canon=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&hsutk=3529e0d1687cab4d14d2bf4252cea4bb&pageId=5262664117&contentType=blog-post&pg=8093222e-eef6-41f3-bc5f-e4272bef25f2&pid=2548414&sv=cta-embed-js-static-1.10&lag=1000&rdy=1&cos=1&df=a
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs/cta/cta/current.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
896833e0b7969abce09ea9b51eb9afd96f9e2520d0c98f98c113f38b1a4047ab

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:20 GMT
content-encoding
gzip
cf-cache-status
MISS
cf-ray
5e86324cfa0de007-FRA
status
200
content-disposition
attachment; name="loaderJS" filename="loader-v2.js"
content-length
1891
cf-request-id
0607bdc41b0000e007469bf000000001
server
cloudflare
x-trace
2B1C5D3D9372B6AEFD77B2EE0B1591CA86BA8C20DC000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
cache-control
no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials
false
accept-ranges
bytes
x-robots-tag
noindex, follow
__ptq.gif
track.hubspot.com/ 		45 B
128 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=162830b9-5f2d-4ae2-83b8-0668bb7f651d&fci=14320d1e-5ee1-467d-8eb4-36732ce84dbb&ft=4&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2978788718&v=1.1&a=2548414&pi=5262664117&ct=blog-post&ccu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&cpi=5262664117&cgi=4539653656&lpi=5262664117&lvi=5262664117&lvc=en-us&pu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&t=Zloader%2FTerdot+%E2%80%93+That+Man+in+the+Middle&cts=1603736480792&vi=3529e0d1687cab4d14d2bf4252cea4bb&nc=true&u=138000303.3529e0d1687cab4d14d2bf4252cea4bb.1603736480785.1603736480785.1603736480785.1&b=138000303.1.1603736480786
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray
5e86324d1f3a2b16-FRA
date
Mon, 26 Oct 2020 18:21:20 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="NOI CUR ADM OUR NOR STA NID"
status
200
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/gif
content-length
45
cf-request-id
0607bdc42c00002b16be20e000000001
x-robots-tag
none
__ptq.gif
track.hubspot.com/ 		45 B
129 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=162830b9-5f2d-4ae2-83b8-0668bb7f651d&fci=14320d1e-5ee1-467d-8eb4-36732ce84dbb&ft=4&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2978788718&v=1.1&a=2548414&pi=5262664117&ct=blog-post&ccu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&cpi=5262664117&cgi=4539653656&lpi=5262664117&lvi=5262664117&lvc=en-us&pu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&t=Zloader%2FTerdot+%E2%80%93+That+Man+in+the+Middle&cts=1603736480797&vi=3529e0d1687cab4d14d2bf4252cea4bb&nc=true&u=138000303.3529e0d1687cab4d14d2bf4252cea4bb.1603736480785.1603736480785.1603736480785.1&b=138000303.1.1603736480786
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray
5e86324d1f312b16-FRA
date
Mon, 26 Oct 2020 18:21:20 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="NOI CUR ADM OUR NOR STA NID"
status
200
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/gif
content-length
45
cf-request-id
0607bdc42b00002b16aea63000000001
x-robots-tag
none
__ptq.gif
track.hubspot.com/ 		45 B
129 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=17&fi=a7b6a944-858e-4411-93bc-4ac896a23886&fci=d50374af-6259-44f4-bf05-855b5c0542e5&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2978788718&v=1.1&a=2548414&pi=5262664117&ct=blog-post&ccu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&cpi=5262664117&cgi=4539653656&lpi=5262664117&lvi=5262664117&lvc=en-us&pu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&t=Zloader%2FTerdot+%E2%80%93+That+Man+in+the+Middle&cts=1603736480799&vi=3529e0d1687cab4d14d2bf4252cea4bb&nc=true&u=138000303.3529e0d1687cab4d14d2bf4252cea4bb.1603736480785.1603736480785.1603736480785.1&b=138000303.1.1603736480786
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray
5e86324d1f362b16-FRA
date
Mon, 26 Oct 2020 18:21:20 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="NOI CUR ADM OUR NOR STA NID"
status
200
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/gif
content-length
45
cf-request-id
0607bdc42c00002b16d4999000000001
x-robots-tag
none
__ptq.gif
track.hubspot.com/ 		45 B
222 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=a7b6a944-858e-4411-93bc-4ac896a23886&fci=d50374af-6259-44f4-bf05-855b5c0542e5&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2978788718&v=1.1&a=2548414&pi=5262664117&ct=blog-post&ccu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&cpi=5262664117&cgi=4539653656&lpi=5262664117&lvi=5262664117&lvc=en-us&pu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&t=Zloader%2FTerdot+%E2%80%93+That+Man+in+the+Middle&cts=1603736480802&vi=3529e0d1687cab4d14d2bf4252cea4bb&nc=true&u=138000303.3529e0d1687cab4d14d2bf4252cea4bb.1603736480785.1603736480785.1603736480785.1&b=138000303.1.1603736480786
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray
5e86324d1f332b16-FRA
date
Mon, 26 Oct 2020 18:21:20 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="NOI CUR ADM OUR NOR STA NID"
status
200
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/gif
content-length
45
cf-request-id
0607bdc42c00002b160014a000000001
x-robots-tag
none
__ptq.gif
track.hubspot.com/ 		45 B
129 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2978788718&v=1.1&a=2548414&pi=5262664117&ct=blog-post&ccu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&cpi=5262664117&cgi=4539653656&lpi=5262664117&lvi=5262664117&lvc=en-us&pu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&t=Zloader%2FTerdot+%E2%80%93+That+Man+in+the+Middle&cts=1603736480803&vi=3529e0d1687cab4d14d2bf4252cea4bb&nc=true&u=138000303.3529e0d1687cab4d14d2bf4252cea4bb.1603736480785.1603736480785.1603736480785.1&b=138000303.1.1603736480786
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray
5e86324d1f342b16-FRA
date
Mon, 26 Oct 2020 18:21:20 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="NOI CUR ADM OUR NOR STA NID"
status
200
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/gif
content-length
45
cf-request-id
0607bdc42c00002b169ea7a000000001
x-robots-tag
none
bframe
www.google.com/recaptcha/api2/ Frame 09B6 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6Lc2_RsUAAAAAAYBSd4rxsgeQz7whuL9COCsHeET&cb=uvbpn5gdger1
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/T9w1ROdplctW2nVKvNJYXH8o/recaptcha__en.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-glWtR6q7tkDyecyGAdEHIw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6Lc2_RsUAAAAAAYBSd4rxsgeQz7whuL9COCsHeET&cb=uvbpn5gdger1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 26 Oct 2020 18:21:20 GMT
content-security-policy
script-src 'report-sample' 'nonce-glWtR6q7tkDyecyGAdEHIw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
1172
server
GSE
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
js
www.googletagmanager.com/gtag/ 		94 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-1057237493
Requested by
Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
4a376d8e82195af0b63f6d038003ba667bb05389a3ab8cdf3fdd434522016933
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:21 GMT
content-encoding
br
vary
Accept-Encoding
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37963
x-xss-protection
0
last-modified
Mon, 26 Oct 2020 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 26 Oct 2020 18:21:21 GMT
js
www.googletagmanager.com/gtag/ 		94 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-1057237493&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2012230-3
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
6678bc86e5be9628d5d521b3470bb360626afffa996191f3045040e285cade82
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:21 GMT
content-encoding
br
vary
Accept-Encoding
status
200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37967
x-xss-protection
0
last-modified
Mon, 26 Oct 2020 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 26 Oct 2020 18:21:21 GMT
__ptq.gif
track.hubspot.com/ 		45 B
129 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=12&aij=%5B%228093222e-eef6-41f3-bc5f-e4272bef25f2%22%2C%2288cc5c86-c3ab-486c-ad4a-4eb38f74ffea%22%5D&rfc=8&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2978788718&v=1.1&a=2548414&pi=5262664117&ct=blog-post&ccu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&cpi=5262664117&cgi=4539653656&lpi=5262664117&lvi=5262664117&lvc=en-us&pu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&t=Zloader%2FTerdot+%E2%80%93+That+Man+in+the+Middle&cts=1603736480992&vi=3529e0d1687cab4d14d2bf4252cea4bb&nc=true&u=138000303.3529e0d1687cab4d14d2bf4252cea4bb.1603736480785.1603736480785.1603736480785.1&b=138000303.1.1603736480786
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray
5e86324e3a3d2b16-FRA
date
Mon, 26 Oct 2020 18:21:21 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="NOI CUR ADM OUR NOR STA NID"
status
200
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/gif
content-length
45
cf-request-id
0607bdc4e300002b16fd9a9000000001
x-robots-tag
none
__ptq.gif
track.hubspot.com/ 		45 B
152 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=12&aij=%5B%2285b7ef36-8763-490d-bc35-71b5614dede1%22%2C%223792d1de-1e5a-45a5-a2b8-bcf3fb166ede%22%5D&rfc=8&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2978788718&v=1.1&a=2548414&pi=5262664117&ct=blog-post&ccu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&cpi=5262664117&cgi=4539653656&lpi=5262664117&lvi=5262664117&lvc=en-us&pu=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&t=Zloader%2FTerdot+%E2%80%93+That+Man+in+the+Middle&cts=1603736480995&vi=3529e0d1687cab4d14d2bf4252cea4bb&nc=true&u=138000303.3529e0d1687cab4d14d2bf4252cea4bb.1603736480785.1603736480785.1603736480785.1&b=138000303.1.1603736480786
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray
5e86324e3a482b16-FRA
date
Mon, 26 Oct 2020 18:21:21 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="NOI CUR ADM OUR NOR STA NID"
status
200
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/gif
content-length
45
cf-request-id
0607bdc4e600002b16f0222000000001
x-robots-tag
none
cta-loaded.js
blog.threatstop.com/hs/cta/ctas/v2/public/cs/ 		0
115 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs/cta/ctas/v2/public/cs/cta-loaded.js?pid=2548414&pg=8093222e-eef6-41f3-bc5f-e4272bef25f2&lt=1603736479790&dt=1603736480790&at=1603736481002&ae=1&sl=1&an=1
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs/cta/cta/current.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:21 GMT
cf-cache-status
MISS
server
cloudflare
x-trace
2B9A6069C283A3782670C3F30661256EE7F2310FB1000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
status
200
cache-control
no-cache, no-store, no-transform, max-age=0
access-control-allow-credentials
false
cf-ray
5e86324e4c8de007-FRA
cf-request-id
0607bdc4ee0000e007a1290000000001
x-robots-tag
noindex, follow
cta-loaded.js
blog.threatstop.com/hs/cta/ctas/v2/public/cs/ 		0
188 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/hs/cta/ctas/v2/public/cs/cta-loaded.js?pid=2548414&pg=85b7ef36-8763-490d-bc35-71b5614dede1&lt=1603736479788&dt=1603736480789&at=1603736481005&ae=1&sl=1&an=1
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/hs/cta/cta/current.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:21 GMT
cf-cache-status
MISS
server
cloudflare
x-trace
2B20FABF7B2F17A5919CB71A96D9660C8DDE3A4DAF000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
status
200
cache-control
no-cache, no-store, no-transform, max-age=0
access-control-allow-credentials
false
cf-ray
5e86324e4c93e007-FRA
cf-request-id
0607bdc4ef0000e007ac90f000000001
x-robots-tag
noindex, follow
conversion_async.js
www.googleadservices.com/pagead/ 		30 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1057237493
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
df32de5a0f701ff09a08264784fb56022000a81ae73f4944bb7b7c74d4f73fd4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 18:21:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
11911
x-xss-protection
0
server
cafe
etag
11845489739789137477
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 26 Oct 2020 18:21:21 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1057237493/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1057237493/?random=1603736481140&cv=9&fst=1603736481140&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&tiba=Zloader%2FTerdot%20%E2%80%93%20That%20Man%20in%20the%20Middle&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
defc24b0882cec8d01b28cc49bc70935a93a2db3d81d4f9bd0b25e26e7d5e9ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Oct 2020 18:21:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
1067
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/1057237493/ 		42 B
88 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/1057237493/?random=1603736481140&cv=9&fst=1603735200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&tiba=Zloader%2FTerdot%20%E2%80%93%20That%20Man%20in%20the%20Middle&async=1&fmt=3&is_vtc=1&random=3115094099&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Oct 2020 18:21:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/1057237493/ 		42 B
88 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/1057237493/?random=1603736481140&cv=9&fst=1603735200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.threatstop.com%2Fzloader%2Fterdot-that-man-in-the-middle&tiba=Zloader%2FTerdot%20%E2%80%93%20That%20Man%20in%20the%20Middle&async=1&fmt=3&is_vtc=1&random=3115094099&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Oct 2020 18:21:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
perf
blog.threatstop.com/_hcms/ 		2 B
395 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://blog.threatstop.com/_hcms/perf
Requested by
Host: blog.threatstop.com
URL: https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7fb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://blog.threatstop.com/zloader/terdot-that-man-in-the-middle
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/json

Response headers

cf-ray
5e86325f8feee007-FRA
date
Mon, 26 Oct 2020 18:21:23 GMT
cf-cache-status
DYNAMIC
server
cloudflare
x-trace
2BC4CBF01D24FFC975F2F71496AB84092C87F9E0FC000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/plain; charset=utf-8
status
200
access-control-allow-credentials
false
x-robots-tag
none
content-length
2
cf-request-id
0607bdcfb20000e0071b9f2000000001

Verdicts & Comments Add Verdict or Comment

135 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery function| hsjQuery object| _hsp function| gtag object| dataLayer function| fbq function| _fbq object| __core-js_shared__ object| Sslac object| IN object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData object| _hsq object| hbspt object| hsCommentListing function| hsPopulateCommentsFeed function| hsPopulateCommentFormOnFormReady function| hsPopulateCommentFormOnFormSubmitted function| hsPopulateCommentFormGetExtraMetaDataBeforeSubmit function| hsOnReadyPopulateCommentsFeed function| bindToWindowOnError object| globalRoot function| hns object| hubspot object| __hsRoot object| hspreserve undefined| React undefined| reqwest function| OutpostErrorReporter undefined| Pikaday function| hns2 function| hmerge undefined| I18n undefined| ReactDOM undefined| require undefined| requirejs undefined| define undefined| exports undefined| module undefined| bootstrap object| HSFR function| hs_reqwest_0 function| hs_reqwest_1 object| hsVars object| google_conversion_id object| google_custom_params object| google_remarketing_only function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_conversion_format object| google_enable_display_cookie_match object| google_conversion_type object| google_conversion_order_id object| google_conversion_language object| google_conversion_value object| google_conversion_currency object| google_conversion_domain object| google_conversion_label object| google_conversion_color object| google_disable_viewthrough object| google_gtag_event_data object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_restricted_data_processing object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| onload_callback object| opt_image_generator object| google_gtm_url_processor object| google_conversion_page_url object| google_conversion_referrer_url object| google_gtm object| google_gcl_cookie_prefix object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_additional_conversion_params object| google_additional_params object| google_transport_url object| google_gtm_experiments object| jQuery17102104032593525711 function| jsonp_1603736480131_86566 function| jsonpHandler object| FB object| __twttrll object| twttr object| __twttr boolean| PIXELS_RAN boolean| _hspb_loaded function| hsRecaptchaLoadCallback number| RECAPTCHA_INTERVAL object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| _paq boolean| _hstc_loaded object| recaptcha object| closure_lm_704108 boolean| _hspb_ran boolean| _hstc_ran string| __hsUserToken number| expireDateTime string| default_css string| cta_css function| google_trackConversion object| GooglebQhCsO

11 Cookies

Domain/Path Name / Value
.threatstop.com/ Name: __hstc
Value: 138000303.3529e0d1687cab4d14d2bf4252cea4bb.1603736480785.1603736480785.1603736480785.1
.threatstop.com/ Name: __hssc
Value: 138000303.1.1603736480786
.threatstop.com/ Name: _gat
Value: 1
.threatstop.com/ Name: _fbp
Value: fb.1.1603736479612.1542215381
.threatstop.com/ Name: _ga
Value: GA1.2.1280328631.1603736480
.threatstop.com/ Name: _gat_gtag_UA_2012230_3
Value: 1
.threatstop.com/ Name: _gid
Value: GA1.2.537905175.1603736480
.blog.threatstop.com/ Name: __cfduid
Value: d563647d0faad4afbac0b0f7b4c0e18e11603736479
.threatstop.com/ Name: __hssrc
Value: 1
.threatstop.com/ Name: hubspotutk
Value: 3529e0d1687cab4d14d2bf4252cea4bb
.blog.threatstop.com/ Name: __cfruid
Value: c4a23d0ffb2d6b04afe8a0421bf4c1640e14b2e9-1603736479

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.hubapi.com
app.hubspot.com
blog.threatstop.com
cdn2.hubspot.net
cdnjs.cloudflare.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
js.hs-analytics.net
js.hs-banner.com
js.hsadspixel.net
no-cache.hubspot.com
perf.hsforms.com
platform.linkedin.com
platform.twitter.com
stats.g.doubleclick.net
syndication.twitter.com
track.hubspot.com
web.facebook.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
104.244.42.136
172.217.18.98
2606:2800:233:66b5:799a:7cd3:f74d:7071
2606:2800:234:59:254c:406:2366:268c
2606:4700::6810:135e
2606:4700::6810:5805
2606:4700::6811:45b0
2606:4700::6811:72b0
2606:4700::6811:7fb4
2606:4700::6811:cccc
2606:4700::6811:f1cc
2606:4700::6812:15bf
2606:4700::6813:9a53
2a00:1450:4001:801::200a
2a00:1450:4001:802::2003
2a00:1450:4001:80b::2002
2a00:1450:4001:819::2004
2a00:1450:4001:81e::2003
2a00:1450:4001:81f::2003
2a00:1450:4001:824::2008
2a00:1450:4001:824::200e
2a00:1450:400c:c00::9d
2a03:2880:f01c:800e:face:b00c:0:2
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
082b0736a3408950e50fd65a090921003fe83d89ec6e3084549a01d5dfa9e854
0ca5e064e4024b35fa7e097aaf77fb27da6cf580665d0355048cd3227be182d3
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
242409fa576bcb5b1a71fef56b23678871ee7d04566ab52d02cac40901ed6953
28a10c1f5d82f21d724f45b8fe8d90be175ca8b321efa5ee71888cbe540060ca
2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15
341a4d40ad1b2560db940f906716d0e9539d4c0785399d7e0348fd0d3af00170
35ebefb2ea1aea9317a4ad839c48c0410bc67ea99617888e25493cde63c48664
3deb9301f5b7ee8be71f86ead73f0da2718119d5651d9ad2ec290f3b26ae103f
3fe48a394d503fb2828eec569ff1627d90fab6ba358df438ee0c7c4f17daeb86
44920f3bd51b0469ad6c8a3c9ec4569765c728792cabdad9c551a16edcd29f46
4958c44fe89c3250c689721cac2efbb943eac172a7efb0d30dd9453b9fda1726
4a376d8e82195af0b63f6d038003ba667bb05389a3ab8cdf3fdd434522016933
54f3aa37078dcd01911c9da1a5fd753b5834dde5acfd90c5bd55243bba87cf6d
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5d1727bd82b767b5a6122bad9776dd8ccc1b765b154c0d1714275850513c19c0
5d715618b720d589976c75ff0d142928ac0ec6726ed740a860717dc727bd5501
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6678bc86e5be9628d5d521b3470bb360626afffa996191f3045040e285cade82
683d73dfc904c6f24d7dbf79ceebdca95cc4dc19f5c4862612431e93e10bb608
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6bab4e86d62b8b9835219e2834564390b88e56d827420ba4c10daf8f9c973a44
6dfab64414e5f01e83525a4f0b595a1724b1af2a1062c142762b47b82ab874c6
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd
895371b22358988c93ca9e5318fdf9784782e44efff401ea65d7171cd9a12bc6
896833e0b7969abce09ea9b51eb9afd96f9e2520d0c98f98c113f38b1a4047ab
927f625f322af8f4f4dda14a02d969dc28bcd9039f2b2cf889cb3c3ec0f0f205
96cfec5bdef2e05c4c1a5c1d8e5df9bfa0a715d55930270afab9d47cc00ce274
9a5498f2546daaadd9314073d33719d8bf095660ba8c3904dbcb649357624eed
9c2a5f70df3f1acc045dcc9621912051328e61056e134ca00bde0b8e367d2ff1
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0765e55871b735d4d9e616bc42f9b3158e087460a415043009067304a37bf90
a758040e3d48d51c8085342320827fceb7a23d282f0c29d8e3e3aa414ba5c39d
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
adaf06a8993c5a58cd09142b881ce93438bcdc0f44faf7dbc8765f38548177f4
afcf451d2d9e9cf017d0d5c61810c12f1b5560a75d44a67a231a3884157ba4f9
b3b09cc1a022c4c266a81312b9d6e34ed28175b2ec387eb75620922f6de43274
b488242c5d9328fa7c0b4cf42ea02b5409f34a7dc1ff2c1487059ab3b69f7da4
b918af842098cb2ef6447e79178ba962d8d0e011b264705bbcd31fe9697067a3
cf3e0ecae28a70c5e010c24c160321243efe54f497d49a6a8f31ca12ee7eb972
d5657ce4d50c13924350b5e42a1bc7e527262d2a15e0e98087a81b6fa931acff
d94052d4af9c315c400e7a7e5b119c6e37a3d514452fc3b2a13a0159164d201c
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dd01b37b4ba40f9c11db5f6ccb35f4b5edf6b3e041d487c8ae5f2fb3d9534276
dd3eb59038a5df086653388d9394fed2f2f1d72d9c01cfdc4920247a9d371e83
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
defc24b0882cec8d01b28cc49bc70935a93a2db3d81d4f9bd0b25e26e7d5e9ae
df32de5a0f701ff09a08264784fb56022000a81ae73f4944bb7b7c74d4f73fd4
e0a70c5d116d9c823c7d7958ecea2a7926315fac156e390bd7dc8a5fa088cdc3
e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5d4829469e6064155fae5206ebe9830bc2e5b2ce5b6914b388aafedfd2fa215
e9a6b226b341fc1eea3b6254d4ebf6f603a7b38cf4a6094972d61bae1ca3ca0a
ee76632067ef875bb89c78492f57d043ae5a78513c362949aa4085f19310f6da
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef5ab40d50e5c8a8d6812ec1b1ca978ed2736312c49327eee2479e569cd7ce2a
fa7c2cd8fa0196bca6e808ed4259571ad5ff7372f37de837a16fd90aaca7e51d
fb56af9f7623a55839dfb9cf019b05664a62e1b41671d925f3ed587c506443b5