urlscan.io logo urlscan.io
SecurityTrails logo

www.securityweek.com Open in urlscan Pro
2606:4700:20::ac43:61a9  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://sales.cscglobal.com/api/mailings/click/PMRGSZBCHI4TENRVGQ2SYITVOJWCEORCNB2HI4DTHIXS653XO4XHGZLDOVZGS5DZO5SWK2ZOMNXW2...
Effective URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Submission: On February 04 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 22 IPs in 3 countries across 14 domains to perform 95 HTTP transactions. The main IP is 2606:4700:20::ac43:61a9, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.securityweek.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 4th 2020. Valid for: a year.
This is the only time www.securityweek.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 52.86.71.216 14618 (AMAZON-AES)
39 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a03:2880:f11... 32934 (FACEBOOK)
7 2606:2800:234... 15133 (EDGECAST)
2 2606:2800:233... 15133 (EDGECAST)
2 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
4 172.217.16.130 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 1 104.244.42.72 13414 (TWITTER)
6 168.62.202.120 8075 (MICROSOFT...)
2 2a00:1450:400... 15169 (GOOGLE)
2 137.135.51.188 8075 (MICROSOFT...)
95 22
1    52.86.71.216 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-86-71-216.compute-1.amazonaws.com
sales.cscglobal.com
39    2606:4700:20::ac43:61a9 (United States)

ASN13335 (CLOUDFLARENET, US)
www.securityweek.com
1    2606:4700::6810:a823 (United States)

ASN13335 (CLOUDFLARENET, US)
ajax.cloudflare.com
2    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
7    2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)
platform.twitter.com
2    2606:2800:233:66b5:799a:7cd3:f74d:7071 (United States)

ASN15133 (EDGECAST, US)
platform.linkedin.com
2    2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
pagead2.googlesyndication.com
6    2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
apis.google.com
4    172.217.16.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net
securepubads.g.doubleclick.net
1    2a00:1450:4001:811::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
accounts.google.com
1    2a00:1450:4001:802::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ssl.google-analytics.com
2    2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
cse.google.com
2    2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
adservice.google.com
1    2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fe004785f74c2bf7fc2a92b14956b30c.safeframe.googlesyndication.com
1    2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
2    2a00:1450:4001:821::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ssl.google-analytics.com
5    2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
4    2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
pagead2.googlesyndication.com
1    104.244.42.72 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
6    168.62.202.120 (San Jose, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
app.brightinfo.com
2    2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    137.135.51.188 (San Jose, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bia.brightinfo.com
Domain Requested by
39 www.securityweek.com www.securityweek.com
ajax.cloudflare.com
7 platform.twitter.com ajax.cloudflare.com
platform.twitter.com
6 app.brightinfo.com www.securityweek.com
app.brightinfo.com
6 tpc.googlesyndication.com securepubads.g.doubleclick.net
tpc.googlesyndication.com
6 apis.google.com www.securityweek.com
apis.google.com
4 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.securityweek.com
3 pagead2.googlesyndication.com securepubads.g.doubleclick.net
www.googletagservices.com
3 ssl.google-analytics.com www.securityweek.com
3 www.googletagservices.com www.securityweek.com
securepubads.g.doubleclick.net
2 bia.brightinfo.com app.brightinfo.com
2 www.google-analytics.com app.brightinfo.com
www.google-analytics.com
2 www.google.com 1 redirects securepubads.g.doubleclick.net
2 platform.linkedin.com ajax.cloudflare.com
2 www.facebook.com www.securityweek.com
1 syndication.twitter.com 1 redirects
1 fe004785f74c2bf7fc2a92b14956b30c.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 adservice.google.com securepubads.g.doubleclick.net
1 adservice.google.de securepubads.g.doubleclick.net
1 cse.google.com www.securityweek.com
1 accounts.google.com apis.google.com
1 ajax.cloudflare.com www.securityweek.com
1 sales.cscglobal.com 1 redirects
0 securityweek.disqus.com Failed www.securityweek.com
95 23
Subject Issuer Validity Valid
securityweek.com
Cloudflare Inc ECC CA-3		 2020-07-04 -
2021-07-04		 a year crt.sh
ajax.cloudflare.com
DigiCert ECC Secure Server CA		 2020-08-11 -
2022-08-16		 2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-12-22 -
2021-03-21		 3 months crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-05 -
2021-11-09		 a year crt.sh
platform.linkedin.com
DigiCert SHA2 Secure Server CA		 2019-10-10 -
2021-10-14		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh
*.google.com
GTS CA 1O1		 2021-01-19 -
2021-04-13		 3 months crt.sh
accounts.google.com
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh
*.google.de
GTS CA 1O1		 2021-01-19 -
2021-04-13		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh
*.brightinfo.com
DigiCert SHA2 Secure Server CA		 2020-03-11 -
2021-03-16		 a year crt.sh

This page contains 14 frames:

Primary Page: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Frame ID: 4DBA7CD776190B47D3C17A69477378CD
Requests: 74 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21
Frame ID: 874C2A245A8E18AC6E98EA66F5062974
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21
Frame ID: D24BA119196453E7EA92BAF2A904024E
Requests: 1 HTTP requests in this frame

Frame: https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.securityweek.com&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Frame ID: D8A17AF90EAA7E2A55502700F2A37782
Requests: 1 HTTP requests in this frame

Frame: https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.securityweek.com&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Frame ID: 302585D30C759994CBD0FBD785483DD9
Requests: 1 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.securityweek.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Frame ID: CADE3B8FCAAB91133F46492698F4672E
Requests: 1 HTTP requests in this frame

Frame: https://www.securityweek.com/ad.html
Frame ID: 15E295ABE0A053900CBFB1DFD6D3ECD5
Requests: 1 HTTP requests in this frame

Frame: https://www.securityweek.com/ad.html
Frame ID: EF8E2708BC6E5C65BDFAB621B843A460
Requests: 2 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fwww.securityweek.com
Frame ID: CD728152255C5D44CAE78E28BB001E3F
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Frame ID: 8589E80A7B02568187621422E6E07D88
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Frame ID: 7533766BEDF6F14D2A070B73F77AD4BB
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstqHvdNTsybw2mWFGybY7lFThj4G9HOOQWGvPexJ7T0SDxvvKjPhI8kD871Gsu8hAdPR4ArrqNEQtSXJKq41gxPOiTYVefe8u7QrORIdRH2KoK1Br7CFAh50cxXfBSFNrGC7VntE0K51q_pSq5X5Zt5baTN4UELAExWbKPNBFFlxPvthnj3BhMMY3tTp10Louyp5myiGgQyJNqdKYnTSM_X5sFpzsPOGWY69SXJgtyoTi4FQP2WeUzTtZliDcwELIZwuP8chemtuJuGKWjMtIw9ER8OfcATDb9SYJeqFH3i4ymtm8P67xwUR7A&sai=AMfl-YQvoH3IeBapqO0WL4VylxjwERXYp-DZ67ypbLPEPCaKox9NEnrSj4hHReAh2LaEi_hHb8f6CQkvVjpiUSlrMBgwCgDPe4j8VcnQiNmpVq6cWwy2hCcgJWvn4fxRNVU&sig=Cg0ArKJSzJE3EIrFTT7gEAE&adurl=
Frame ID: D639CAA26BF60F2889CA19D305C89DF6
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: F42DCDF0C85CD7F5F6426DAC1962FCCB
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/jot.html
Frame ID: 08D70803F09FFC4A3D1A4A3A31266551
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://sales.cscglobal.com/api/mailings/click/PMRGSZBCHI4TENRVGQ2SYITVOJWCEORCNB2HI4DTHIXS653XO4XHGZLDO... HTTP 302
    https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<(?:link|style)[^>]+"\/sites\/(?:default|all)\/(?:themes|modules)\//i
  • headers expires /19 Nov 1978/i
Overall confidence: 100%
Detected patterns
  • html /<(?:link|style)[^>]+"\/sites\/(?:default|all)\/(?:themes|modules)\//i
  • headers expires /19 Nov 1978/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • script /apis\.google\.com\/js\/[a-z]*\.js/i

Page Statistics

95
Requests

97 %
HTTPS

78 %
IPv6

14
Domains

23
Subdomains

22
IPs

3
Countries

1369 kB
Transfer

3304 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://sales.cscglobal.com/api/mailings/click/PMRGSZBCHI4TENRVGQ2SYITVOJWCEORCNB2HI4DTHIXS653XO4XHGZLDOVZGS5DZO5SWK2ZOMNXW2L3INFVGCY3LMVSC24DFOJWGG33NFVSG63LBNFXC22DPON2GKZBNNFYC2YLEMRZGK43TFVWGS3TLMVSC23LBNRUWG2LPOVZS2YLDORUXM2LUPERCYITPOJTSEORCMUYTKNJTGQ2TKLJTMUYWCLJUGVQWKLLBMMYWGLLDGMZGKZLDHA2TINTFMMRCYITWMVZHG2LPNYRDUIRUEIWCE43JM4RDUISEOZVDS4C2GZJUYZCONNIVG5KSMRLTEOKRMIYGOSSJKJNDS23KGRKTSZLXKAWS232ULBRT2IT5 HTTP 302
    https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 55
  • https://www.google.com/coop/intl/en/images/google_custom_search_watermark.gif HTTP 301
  • https://cse.google.com/coop/intl/en/images/google_custom_search_watermark.gif
Request Chain 80
  • https://syndication.twitter.com/i/jot HTTP 302
  • https://platform.twitter.com/jot.html

95 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
www.securityweek.com/
Redirect Chain
  • https://sales.cscglobal.com/api/mailings/click/PMRGSZBCHI4TENRVGQ2SYITVOJWCEORCNB2HI4DTHIXS653XO4XHGZLDOVZGS5DZO5SWK2ZOMNXW2L3INFVGCY3LMVSC24DFOJWGG33NFVSG63LBNFXC22DPON2GKZBNNFYC2YLEMRZGK43TFVWGS3...
  • https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
40 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.29
Resource Hash
cb9477033c58e96024bca0f7dd5653690517c2ed8f6b633c396f00d206964848

Request headers

:method
GET
:authority
www.securityweek.com
:scheme
https
:path
/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
content-type
text/html; charset=utf-8
set-cookie
__cfduid=dd596e6a33c54d03bdbd5b6b1bf941b8f1612465441; expires=Sat, 06-Mar-21 19:04:01 GMT; path=/; domain=.securityweek.com; HttpOnly; SameSite=Lax; Secure SESSc3f2c9572aa8f3f5ea6f60501affecb3=bc595737a8f285b1d8301ead12055ba8; expires=Sat, 27-Feb-2021 22:37:21 GMT; path=/; domain=.securityweek.com
x-powered-by
PHP/5.3.29
expires
Sun, 19 Nov 1978 05:00:00 GMT
cache-control
must-revalidate
last-modified
Thu, 04 Feb 2021 16:14:45 GMT
cf-cache-status
DYNAMIC
cf-request-id
08100722e9000064fd0f02d000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=fG3EbVSqyr7w%2FB7lWY9QAK8JUkjBYYgyqJILoZ2om7X3mWx8%2BTFS%2FqK8D9HZZPFqoHGqE7Bey3k3CylSvekezalTe%2FECKTyjUtBAh7PKKOwykP23LFlbOfBLZFtSDHyQ3A%3D%3D"}],"max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
61c6a7b17f4a64fd-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date
Thu, 04 Feb 2021 19:04:01 GMT
content-type
text/html; charset=utf-8
content-length
119
location
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
strict-transport-security
max-age=31536000; includeSubDomains
MtZjAddKzhFJoLq5xYGl1vZkDn8.js
www.securityweek.com/cdn-cgi/apps/head/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/cdn-cgi/apps/head/MtZjAddKzhFJoLq5xYGl1vZkDn8.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8dd5483dc29044f06c3a45f8fd05d0f122a2b4315292df6da919775189351c9

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5866637
content-type
application/javascript; charset=utf-8
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
9D7676ECF72C63F9
x-amz-id-2
0xGkw3tMrnTlmaIdMRQ1nPOkVlhn00QQLGQ9gViAs8CwIMwdeNYUxK3VIXqSFWH3lkNmDPniutA=
last-modified
Tue, 04 Dec 2018 19:44:59 GMT
server
cloudflare
etag
W/"6998744eb932e2ecef296a28191978ed"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=OhnJixh6BaEviJsDrpeJw4VpMOuxS%2BmeM3Gzo4VK4hdCtmkqCeQgLYK9cGPEDMkb7x6aMhDpksC2wImIstpxHZ70VMYDl9x38ME0U3yeOvDfYaHBqTE2FGOZFmg3C%2BGLBA%3D%3D"}],"max_age":604800}
x-amz-version-id
JCMgPdMNLoo3bIn5Dbz15QtzSlH_yitT
cache-control
public, max-age=31536000
cf-request-id
08100723fa000064fdf4186000000001
cf-ray
61c6a7b32ff264fd-FRA
css_636fa26ba16f5959acb96ee0d8919061.css
www.securityweek.com/sites/default/files/css/ 		24 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/sites/default/files/css/css_636fa26ba16f5959acb96ee0d8919061.css
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d10a778caafc69e25249f7b7fa00a1bfaa240991b6c7cdedb7f562fff418eb21

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
101305
cf-polished
origSize=24799
cf-bgj
minify
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
08100723fc000064fd02183000000001
last-modified
Wed, 03 Feb 2021 14:54:07 GMT
server
cloudflare
etag
W/"3c18d2-60df-5ba6fc25235be"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NyWEH7iwvUWorhgAMvp0zRBRdQ55rQoPXHjQZWFUqgps%2FgvbAQYQ2Vk4dUkzO8uvfF%2B7vgqVwOnyuGRsdBCM9GMixXFXQ908OSXatBq5Dl8WvriACaqhbBXNGVJDY%2B55SA%3D%3D"}],"max_age":604800}
content-type
text/css
cache-control
max-age=1209600
cf-ray
61c6a7b32ff464fd-FRA
expires
Wed, 17 Feb 2021 14:55:36 GMT
css_718fafafcc386276c845e7bdb0114c58.css
www.securityweek.com/sites/default/files/css/ 		27 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0deae7d488b0316e0149f1dc2caec46821b2272127b61b4ffadf6f99a303ea16

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
101305
cf-polished
origSize=27647
cf-bgj
minify
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0810072400000064fdf21ed000000001
last-modified
Wed, 03 Feb 2021 14:54:07 GMT
server
cloudflare
etag
W/"3c18d4-6bff-5ba6fc2524176"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=8JsrJvGiUfKBihV9BAOxfixvEfpTeYHCZqk1s6WzDZeeJ7f8zQVJiqoBHtYzMBI%2BovsbBUrntRsp%2BfXFHhuHUkw3as6d1DE4nWGQ3qDnccPh2Xfd%2FDwQ2gjRqDVJE5Hdrw%3D%3D"}],"max_age":604800}
content-type
text/css
cache-control
max-age=1209600
cf-ray
61c6a7b33ffa64fd-FRA
expires
Wed, 17 Feb 2021 14:55:36 GMT
securityweek_logo.jpg
www.securityweek.com/sites/default/files/ 		19 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/securityweek_logo.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5ae75bcb392ec9110db2837a9134c1b414c373244ea62816c63cc5bb41a90cfe

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
432679
cf-polished
origSize=20250
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
19584
cf-request-id
0810072439000064fd098f4000000001
last-modified
Sat, 02 Jan 2021 18:33:44 GMT
server
cloudflare
etag
"c60712-4f1a-5b7ef18cbdb45"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6BwDXUDMSb%2B7j0oSG1iGmMl2yb8lwxe%2BYSZk6JRXi%2BwxGOYzJtScQQffu9eOtMWR%2FbBH7dNYJA8uYLWBgCYOrzP2aHVSruvRPNZURu%2BOir8efaQw50OqsBfmDga6p%2FVgWg%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Sat, 13 Feb 2021 18:52:42 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b3883c64fd-FRA
cf-bgj
imgq:100,h2pri
IoT_Lockdown-970x250.jpg
www.securityweek.com/sites/default/files/features/ 		86 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/features/IoT_Lockdown-970x250.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
afedf855d6d8ece53e013419b411dd4870baa7594fe221ab1e493d78be8eb957

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
82050
cf-polished
origSize=101635
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
88472
cf-request-id
081007243d000064fd04182000000001
last-modified
Wed, 20 Jan 2021 20:12:19 GMT
server
cloudflare
etag
"c60752-18d03-5b95a927ff00e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=2N7v4cS%2BGxMv3R0dDR9sq7v%2BKbzBxJVxTzekjYzeSbwxteu8Dy0SptAYyvrxtG%2FfmXsNBlRTcA1OxDWeVPGZmtFnJAAE8qxKsnvF0ou1h1URf36N0hV6%2FNUWpbQC8CxEnw%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Wed, 17 Feb 2021 20:16:30 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b3883e64fd-FRA
cf-bgj
imgq:100,h2pri
picture-142.jpg
www.securityweek.com/sites/default/files/imagecache/auth_story/pictures/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/imagecache/auth_story/pictures/picture-142.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8c3472f82c523707024b21c9c02755fb4fc9540558895e5ec10ceb1a7ac7977

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6415
cf-polished
origSize=2275
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1946
cf-request-id
081007243d000064fd02189000000001
last-modified
Wed, 31 Aug 2016 11:41:29 GMT
server
cloudflare
etag
"3c191c-8e3-53b5c9400d9a0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=RXlr93XWycrxogeN3SRgfFmcpD%2B9kA6m8uVglQ7NQDK0jlf1paaNi%2BYtcDtuX9yuLGSM3%2F6L57nn11upa39QJVot7N1xCwye2xncKu%2B6PXleVlayqWbONUKJaMaMARSYSA%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Thu, 18 Feb 2021 17:17:06 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b3883f64fd-FRA
cf-bgj
imgq:100,h2pri
RSS-Icon.png
www.securityweek.com/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/images/RSS-Icon.png
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62b425148295a81e4162a87cb36eba754d16b295ec5b733140e2b82c7f77a731

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1028587
cf-polished
origSize=2844
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2637
cf-request-id
081007243d000064fdfe089000000001
last-modified
Wed, 06 Oct 2010 06:57:24 GMT
server
cloudflare
etag
"1e133b-b1c-491ed4a241d00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=91N1yrGx1RhP7S3Rv0fUZ9PFSjdlarFP0gMbeVoNBOwCU9Xbw6IJAOdds%2FZwjjL%2BdletF5z2l3N4XkYPbHiFo51zy2FzZqb%2BC4%2FHBrCxnAYahXCoFwQ61rD4LPQvX3501w%3D%3D"}],"max_age":604800}
content-type
image/png
expires
Sat, 06 Feb 2021 21:20:54 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b3884064fd-FRA
cf-bgj
imgq:100,h2pri
serve.php
www.securityweek.com/sites/all/modules/ad/ 		695 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=1296
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.29
Resource Hash
ad853a72ac4fa4a7ea4700fb824906dbba6fd62e4f61e92449a5cba3f60ff1dc

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 04 Feb 2021 19:04:02 GMT
server
cloudflare
x-powered-by
PHP/5.3.29
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"report_to":"cf-nel","max_age":604800}
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=s4Yqt%2BQqstgkYWSZCMIs9RYtntEqvh87qZP7hTt%2FO2D7RUU%2B8HNPJZu8iywdcl%2BmvJ%2FKLdkrThbwDEyOC4H9Ibl0yCiZn32ZB%2Fl2v%2FDSPVANbqkj0z%2BpWCA2gw506gI3cg%3D%3D"}],"max_age":604800}
content-type
image/jpeg
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
61c6a7b3884164fd-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
081007243d000064fd0185f000000001
expires
Mon, 26 Jul 1997 05:00:00 GMT
serve.php
www.securityweek.com/sites/all/modules/ad/ 		695 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=1030
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.29
Resource Hash
ad853a72ac4fa4a7ea4700fb824906dbba6fd62e4f61e92449a5cba3f60ff1dc

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 04 Feb 2021 19:04:02 GMT
server
cloudflare
x-powered-by
PHP/5.3.29
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"report_to":"cf-nel","max_age":604800}
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=b0LH%2B4ZxK2sQ1JoVNdEnnaD3222OPWneRQ0Z7tIR8bE9L1zJHoy6CLTwdZqGYBlXCgZaa7zgpnAcyI7Eob4VfIPGUU7n%2BJ2%2Fdnwpkbd3MVZeMlqOZW2Ny6B2f3Bpc2IsKw%3D%3D"}],"max_age":604800}
content-type
image/jpeg
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
61c6a7b3884464fd-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0810072441000064fdf197a000000001
expires
Mon, 26 Jul 1997 05:00:00 GMT
serve.php
www.securityweek.com/sites/all/modules/ad/ 		695 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=683
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.29
Resource Hash
ad853a72ac4fa4a7ea4700fb824906dbba6fd62e4f61e92449a5cba3f60ff1dc

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 04 Feb 2021 19:04:02 GMT
server
cloudflare
x-powered-by
PHP/5.3.29
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"report_to":"cf-nel","max_age":604800}
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=xvsChSHPiw66vpYqJWOyt2kh1b13O0GJwXr28h0IXTSxNjKuWTs6tYca5bgh2XXddxOF7fR%2BElxhz5v7YWPK2PGWb9o0GfxLA%2BuSPgXEZm7sLGZX%2BqraImsbwTuLovLifw%3D%3D"}],"max_age":604800}
content-type
image/jpeg
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
61c6a7b3884864fd-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0810072443000064fd01275000000001
expires
Mon, 26 Jul 1997 05:00:00 GMT
serve.php
www.securityweek.com/sites/all/modules/ad/ 		695 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=693
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.29
Resource Hash
ad853a72ac4fa4a7ea4700fb824906dbba6fd62e4f61e92449a5cba3f60ff1dc

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 04 Feb 2021 19:04:02 GMT
server
cloudflare
x-powered-by
PHP/5.3.29
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"report_to":"cf-nel","max_age":604800}
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=t0j0fYmCyJXLW7VB9dvXKykcXf0U6SdAalCd%2BXI0MJWTKLTw5yy9kjOKEsTwyzqMV0EoNh9jINqGRJap4TkjQZ7JcOBAfjv2QvT57RcBMZmplL6fg94%2B3pZ%2BwvvpsySmTA%3D%3D"}],"max_age":604800}
content-type
image/jpeg
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
61c6a7b3884964fd-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0810072443000064fdf60e5000000001
expires
Mon, 26 Jul 1997 05:00:00 GMT
serve.php
www.securityweek.com/sites/all/modules/ad/ 		695 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=894
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.29
Resource Hash
ad853a72ac4fa4a7ea4700fb824906dbba6fd62e4f61e92449a5cba3f60ff1dc

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 04 Feb 2021 19:04:02 GMT
server
cloudflare
x-powered-by
PHP/5.3.29
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"report_to":"cf-nel","max_age":604800}
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=J0Qd5MF7UEePRyzDxKWHA4HazbfBTlfbP2zh4e9x9vsIX6buJiCk7qyyTJ6uDV59DqIghz0EGi%2F0ZC9Up%2BVSKKRHOzFgMCSfitok0fjOgekaw1T3DiyZf8w2hgjUug2zHQ%3D%3D"}],"max_age":604800}
content-type
image/jpeg
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
61c6a7b3884a64fd-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0810072448000064fdf60e6000000001
expires
Mon, 26 Jul 1997 05:00:00 GMT
tag_icon.jpg
www.securityweek.com/images/ 		680 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/images/tag_icon.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
65cc8600f521d4e99aa77e95337426f53ec86dd569e8db164bcda70d5c1da388

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
391928
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
680
cf-request-id
081007244b000064fd01276000000001
last-modified
Fri, 06 Aug 2010 07:41:12 GMT
server
cloudflare
etag
"1e133a-2a8-48d22ca765600"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lRxABKR2MPqeILiF9KuqNZgzsUM8N8po4CEJl9I3bOZEi6M6ZGJ1jIvrFP%2FGLt4naaqFP71XxZrqMrovpPXYpn4g7tXHWZYzJpi4%2BH%2Brg72ViYNRqoBuvnN3IyokTKts4A%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Sun, 14 Feb 2021 06:11:53 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b3884b64fd-FRA
cf-bgj
imgq:100,h2pri
security_newsletter.gif
www.securityweek.com/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/images/security_newsletter.gif
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
200abde0c426b23abe8a9c501ab4e8e72c048cc0653203817cc9ff96cc6e394d

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
220772
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1084
cf-request-id
0810072447000064fd098f6000000001
last-modified
Fri, 22 Apr 2011 17:43:08 GMT
server
cloudflare
etag
"1e134c-43c-4a185640ae300"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bJJIcMNZ4ymKQSAmM5TG%2FzEqBHuLV0F7NyNBFtQdPo9iUgm3XApjw5A9HJNNCfLjUlWYBWHQDyQUqExzqHV8q2DEiaPosjpr7Rh20Z6%2FVgBNEuKRGigqmFrN9SXFFyLnxw%3D%3D"}],"max_age":604800}
content-type
image/gif
expires
Tue, 16 Feb 2021 05:44:29 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b3984c64fd-FRA
cf-bgj
imgq:100,h2pri
Twitter-security-icon.png
www.securityweek.com/sites/default/files/logos/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/logos/Twitter-security-icon.png
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
10f0e5158e45d76ba649af69ed465a28489483ac934b3e491773cb5e4c9704f0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
771649
cf-polished
origSize=2314
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1238
cf-request-id
0810072448000064fd0f03c000000001
last-modified
Tue, 12 Jan 2021 20:28:49 GMT
server
cloudflare
etag
"c6072c-90a-5b8b9deca4eed"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jIOVs5tqdXyfxHMqupR%2B%2BtLGB6WvP2%2BtaPv45V32dVbcdUQU2U3IbBEXb10HWTwYj074Ik8lzOIuDS1EtCsPriu0G6OGrhQBCJVUmvpTi5Bs2VrmKWKz%2FZvZPrIyAU9zuw%3D%3D"}],"max_age":604800}
content-type
image/png
expires
Tue, 09 Feb 2021 20:43:12 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b3984d64fd-FRA
cf-bgj
imgq:100,h2pri
Facebook-Security-Group.png
www.securityweek.com/sites/default/files/logos/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/logos/Facebook-Security-Group.png
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8f9048e36baefc5cac0974c3e49ffc683d667c5b2081f6cd8d20f5a301b124c2

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
771657
cf-polished
origSize=2335
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1315
cf-request-id
0810072449000064fdf197c000000001
last-modified
Tue, 12 Jan 2021 20:31:23 GMT
server
cloudflare
etag
"c6072e-91f-5b8b9e7f5d191"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Cbb9AOZSBE6tpmGccA27QR9OSpMlBB3pTx5TDtEpIHZ%2BLdGQAU0UViBfFCb0Cep6%2BwCC1L%2BNae6jm4tUYdqnTUI%2BIEokKZujw6OwEw4IkW51zHRdS4d3PzmNvDV6a4K1Cw%3D%3D"}],"max_age":604800}
content-type
image/png
expires
Tue, 09 Feb 2021 20:43:04 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b3984f64fd-FRA
cf-bgj
imgq:100,h2pri
LinkedIn-Cybersecurity-icon.png
www.securityweek.com/sites/default/files/logos/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/logos/LinkedIn-Cybersecurity-icon.png
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f3d36be68e6a795cf0d621b7d8b4beb4b9f9caea3f3682f2f8f59a846000893

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
771657
cf-polished
origSize=2404
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1369
cf-request-id
081007244a000064fd0e943000000001
last-modified
Tue, 12 Jan 2021 20:28:18 GMT
server
cloudflare
etag
"c6072a-964-5b8b9dce83b9e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HlBYEpHU5Uq7c7XTOQqj%2B2BSIcLhPBHNLEeaaw%2B761jqQu7yrpg7ZUDNYeVaUeSqH5r%2FKI9zeZE09qThYcJHUD9uDrn6klVloTK8o8ZJvZRdqhZ2w4TvwVX1LR%2BeiWFnhA%3D%3D"}],"max_age":604800}
content-type
image/png
expires
Tue, 09 Feb 2021 20:43:04 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b3985064fd-FRA
cf-bgj
imgq:100,h2pri
Cybersecurity_News_Feed.png
www.securityweek.com/sites/default/files/logos/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/logos/Cybersecurity_News_Feed.png
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
efb9d49a04efcc971667386f67fb420e20fd130339f1c994fc7359bc34771ef9

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
771657
cf-polished
origSize=2414
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1398
cf-request-id
0810072446000064fd0218a000000001
last-modified
Tue, 12 Jan 2021 20:27:46 GMT
server
cloudflare
etag
"c60731-96e-5b8b9db04a596"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4M8DTN16wcnWOvaC6LM5iuLVEzdgGVmW7yOcX2Gunq9sX1978SbhrpTpo1o4V8tfQjCQj9kdDUYuZpgrg55pSTWjAqiq%2BiAv19bbbhUZX0fCV9xFVCeKKSk48Cf%2FyvuZeg%3D%3D"}],"max_age":604800}
content-type
image/png
expires
Tue, 09 Feb 2021 20:43:04 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b3985164fd-FRA
cf-bgj
imgq:100,h2pri
IoT_Lockdown-300x250.png
www.securityweek.com/sites/default/files/features/ 		120 KB
121 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/features/IoT_Lockdown-300x250.png
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
61152d4b8363a8db7d72ece0ebb989ca0788d860b0c3cce645d16b63fa37e525

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
82910
cf-polished
origSize=148460
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
122767
cf-request-id
081007244a000064fd0218b000000001
last-modified
Wed, 20 Jan 2021 19:57:40 GMT
server
cloudflare
etag
"c606c9-243ec-5b95a5e19d468"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=CTMY907HJS7vZRTHGyMGc%2FDlyizxElImhcarHW2W3F0xKlURTcC0M9RDIY9qpNNONsfMLuvgXdy46kBM0m3y2V1E4WKRdmcNG6S2VWhkXMBBqxPIhKxN0ApoxpVLXbUR1A%3D%3D"}],"max_age":604800}
content-type
image/png
expires
Wed, 17 Feb 2021 20:02:11 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b3985364fd-FRA
cf-bgj
imgq:100,h2pri
wired_publishing.jpg
www.securityweek.com/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/images/wired_publishing.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08fa49f20076c343e2724c631a732d8cbd3bd0daf55f4a0f8311e07dc77be29c

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
740087
cf-polished
origSize=2601
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2076
cf-request-id
0810072448000064fdf21f2000000001
last-modified
Wed, 08 Dec 2010 15:26:32 GMT
server
cloudflare
etag
"1e132d-a29-496e7bef23a00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=LFIiByteYExtKZXkMG4MuhJ9eUI0wk4NoPxpYyRFlyrzTj0aSfIWeX633OSBDN9mebWz0Xm9AgljHcwBIooS5ZWxB0Zdjo%2FHznHYFmfXaUFOhtckcI0EwOtBk3q5Tlq2hA%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Wed, 10 Feb 2021 05:29:14 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b3985464fd-FRA
cf-bgj
imgq:100,h2pri
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:a823 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
nel
{"max_age":604800,"report_to":"cf-nel"}
vary
Accept-Encoding
cf-request-id
08100724550000e00be8a56000000001
last-modified
Mon, 25 Jan 2021 17:22:41 GMT
server
cloudflare
x-frame-options
DENY
etag
W/"600efe61-3016"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Dl7E9RjhUXMZ3CBLF7uQHd9yD56ITotesn2Iie3ZTKCgfm2n2UtRDqanhxv2xSgNfebHlvxLCMCR41xh9Uu8Vcrtx%2BSPM9%2BYF%2FOZpi7kvW4I1DMiWUcYC87UIeoakgf%2F"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
61c6a7b3baade00b-FRA
expires
Sat, 06 Feb 2021 19:04:01 GMT
JsfVAji5wHtjMw9KWartCq34fZY.js
www.securityweek.com/cdn-cgi/apps/body/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/cdn-cgi/apps/body/JsfVAji5wHtjMw9KWartCq34fZY.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/cdn-cgi/apps/head/MtZjAddKzhFJoLq5xYGl1vZkDn8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c9b185e1e937971dfedaafecf01bc14813a2ece31cc9af4a2097f9b3ecb061d

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:01 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
7997366
content-type
application/javascript; charset=utf-8
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
1D200412F3071A81
x-amz-id-2
ocW6f66LRM5e6Qp8eBxBVUkoliev/hyIMvHJhblhdyqBW0T870LfdE02FwNUZURk2IV3CxFownw=
last-modified
Tue, 04 Dec 2018 19:44:58 GMT
server
cloudflare
etag
W/"cb0ca31f11dc8247de26e3dcd49db722"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=uV3mZgh%2F%2FGSE%2FY393F5yDkvusVvUQ87AJebS%2B%2FjER9BBODnl4I2qo926xX4L43Kmy1S8es70SAafXF0w7GlTjdjUNNeM9248zicWzRS%2F3zrvOlpBYk7AnuOTp2Q%2BLqVYrg%3D%3D"}],"max_age":604800}
x-amz-version-id
h5OK1yTQAx2t7V4blDMielr1pB4gwYKR
cache-control
public, max-age=31536000
cf-request-id
081007244b000064fd098f7000000001
cf-ray
61c6a7b3985564fd-FRA
like.php
www.facebook.com/plugins/ Frame 874C 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

vary
Accept-Encoding
x-fb-rlafr
0
pragma
no-cache
expires
Sat, 01 Jan 2000 00:00:00 GMT
content-encoding
br
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
x-xss-protection
0
cache-control
private, no-cache, no-store, must-revalidate
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-type
text/html; charset="utf-8"
x-fb-debug
g2fKPkLKhzDNtuYNL64AaNOBkPOUOzMYQnTG0pGPqvVlwqBQsJOBrIeB1YLupDIxeMa3tTZ6b0W9zqEm86sWkQ==
date
Thu, 04 Feb 2021 19:04:01 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
like.php
www.facebook.com/plugins/ Frame D24B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

vary
Accept-Encoding
x-fb-rlafr
0
pragma
no-cache
expires
Sat, 01 Jan 2000 00:00:00 GMT
content-encoding
br
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
x-xss-protection
0
cache-control
private, no-cache, no-store, must-revalidate
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-type
text/html; charset="utf-8"
x-fb-debug
t3WoBXhd1rNmq4orO4+lptE4BUrXz0IYgU4WBAb2F1FYZFBGB5A9TDuBdU+lbAceMETdhKxxqbyVkPAnWOa+MQ==
date
Thu, 04 Feb 2021 19:04:01 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
bg.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		475 B
873 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/bg.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab74e69c44356590de92b4b7354dc5ae3887e20f3dd9d07cea55cedbdd441f95

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
391321
cf-polished
origSize=13217
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
475
cf-request-id
08100724d8000064fdf60ed000000001
last-modified
Sat, 09 Aug 2014 20:02:44 GMT
server
cloudflare
etag
"3c0013-33a1-50037ce116100"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Ilpf3GEYVJE6FWXvDWLe0np0pv%2BSaCLkn2mO9JWDe2LtO%2BseQCpjpNB3SEubrAhOKBsb9nxExnPvDBwbTsDOemJ6UiVySMtqlixLsgUNv0NH8MVcEmBJLiiHttoZeDeFKQ%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Sun, 14 Feb 2021 06:22:01 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b4889c64fd-FRA
cf-bgj
imgq:100,h2pri
menu-leaf.gif
www.securityweek.com/sites/all/themes/securityweek/images/icons/ 		175 B
569 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/icons/menu-leaf.gif
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
913e0bff2ebdfd8aa46e82e8282910638f68fdb9f56f447f1f6b259f3fe5e539

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
481717
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
175
cf-request-id
08100724d7000064fdf1983000000001
last-modified
Mon, 22 Mar 2010 15:27:51 GMT
server
cloudflare
etag
"3c002d-af-482655712cbc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Z7RgWLJb85vIcMx%2BAAPDmNg8Q1QRrmViP5r7HLJuyi%2BRYwr4PZReNLlnkVNru8C9zw3E5G1NagpVdW9mqyA5cjFaphlOc4j84jM2iBoZHXG6Tm075RGrBOfDsy4pD1OjCA%3D%3D"}],"max_age":604800}
content-type
image/gif
expires
Sat, 13 Feb 2021 05:15:25 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b4889f64fd-FRA
cf-bgj
imgq:100,h2pri
header_bg.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		387 B
782 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/header_bg.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d55e4cb97826944c4f826821ac2688b361d7cf0303b4640c2cb3eef6ee19b233

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1028587
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
387
cf-request-id
08100724d1000064fd02194000000001
last-modified
Mon, 22 Mar 2010 15:27:31 GMT
server
cloudflare
etag
"3c0020-183-4826555e19ec0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jSn3CWPy%2FNjTbmo3nGWAzJDdJMcnJXRrWcBWvPVL6%2BCzWxwoJDiLz8yV1iVnqx%2B2UoXFpWzf%2F9a2yOa6oxqYiQE3cxMGcTI7%2BcmgJgwC4bqZrk4AeNmwCBX65zFzYg7nSQ%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Sat, 06 Feb 2021 21:20:55 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b488a164fd-FRA
cf-bgj
imgq:100,h2pri
nav_bg.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		500 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/nav_bg.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
21b195ce0d8efa07e31b863199d8a6802cb773e2417443e534ed8c113d8949a8

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
660729
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
500
cf-request-id
08100724d6000064fdfe08e000000001
last-modified
Mon, 22 Mar 2010 15:28:13 GMT
server
cloudflare
etag
"3c001b-1f4-4826558627d40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jLg4trJUmQeuFjBaQwHpbAP4yeOAuxzlq9yBq0e%2F7d3hO8uVqL%2Fjqt9Fa1MZF07nOCHizgNsF9Own7ipON%2FQ%2FXK%2B790jOLm7Dda9gKgvgr1Dmm6J5VuiB4f%2FtNcK7yyPiQ%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Thu, 11 Feb 2021 03:31:53 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b488a364fd-FRA
cf-bgj
imgq:100,h2pri
menu-expanded.gif
www.securityweek.com/sites/all/themes/securityweek/images/icons/ 		183 B
582 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/icons/menu-expanded.gif
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa76185f417cf85d7029b35e3a6544d4495402e17f76a32633b5ba80a81faa26

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
731963
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
183
cf-request-id
08100724d8000064fd01866000000001
last-modified
Mon, 22 Mar 2010 15:27:50 GMT
server
cloudflare
etag
"3c002a-b7-4826557038980"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PX%2BAf3mdRWWAmnwqiI9H4wH%2FM9lM%2BwBqYgs9OQrxdlvdA3PGBcMKlWIdq0RcTkyr3HlyESxyYrUD4DbkZfhWvNbYt%2F1L7G59B%2BLiRQt0czdF4dND%2FBzJTk7tpvOgJoI1cQ%3D%3D"}],"max_age":604800}
content-type
image/gif
expires
Wed, 10 Feb 2021 07:44:39 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b488a864fd-FRA
cf-bgj
imgq:100,h2pri
line_dotted.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/line_dotted.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55851ffd45a0a3e9abd9c2ac844eba1efd50272a39360d0f3b396d26a7d0bfc8

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
659780
cf-polished
origSize=3724
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3165
cf-request-id
08100724d7000064fdf4193000000001
last-modified
Sun, 15 Jan 2012 05:43:31 GMT
server
cloudflare
etag
"3c001c-e8c-4b68a93f6a6c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=svV%2Bexs0R8lpX3aDitfIiINbuCDfz9kW96CnNvBoby1o0lwMU86rvinJJp5vbRmLd1wpF7T%2BqP1jWYRmbtzmNJt5c%2FFtmukxlVQtNqf9obvvJ2LUe%2Fwgw2U0%2BUSy0zaZxA%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Thu, 11 Feb 2021 03:47:42 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b488a964fd-FRA
cf-bgj
imgq:100,h2pri
bullet.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/bullet.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ffad58a307aa1ac6baff90296c8edc9db313f888876bc2ad453be4db8d01bf9

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1028587
cf-polished
origSize=2285
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1901
cf-request-id
08100724d8000064fdfc978000000001
last-modified
Sun, 15 Jan 2012 05:30:46 GMT
server
cloudflare
etag
"3c0019-8ed-4b68a665dad80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4TH88rB8nJtLmPJH1Zv%2FJP6CFDlrMj4uuhTpYAJHctMWSl0nYhKXrjJGhZjUR6SgW2%2FogO5TiUkzDiGRcqSGXAYpBRnpLpO7SkM5nZqDm2zh7sYgftqaPBvnx3lVNSzrxQ%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Sat, 06 Feb 2021 21:20:55 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b488ab64fd-FRA
cf-bgj
imgq:100,h2pri
subscribe-btn.gif
www.securityweek.com/sites/all/themes/securityweek/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/subscribe-btn.gif
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4986aea94d23482c38fb06749a6a5c5c6ab95db97aa3bcc9feaf7eda6cbf6626

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
391321
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2249
cf-request-id
08100724db000064fdf60ee000000001
last-modified
Tue, 25 Jan 2011 04:28:42 GMT
server
cloudflare
etag
"3c0021-8c9-49aa426bbd280"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DLKEwy%2FMMaXPquZjGk33MBk2%2FICtf8z3CoCIAwgs4pZ40g1UErwukDauIOPlP1tuJfRR1QMPwNcS%2BL%2FrRF4o7vEBFDstbwyvgq3yy8X0GHXWyzSSFhu1kq%2BfnFF0EAaF9g%3D%3D"}],"max_age":604800}
content-type
image/gif
expires
Sun, 14 Feb 2021 06:22:01 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b488ac64fd-FRA
cf-bgj
imgq:100,h2pri
footer_bg.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		510 B
918 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/footer_bg.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e4a85296d37106cff5d646be0fabf370fd83a9b133c3aaf41e6ffb73d108366

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
800789
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
510
cf-request-id
08100724d9000064fdf5a4b000000001
last-modified
Mon, 22 Mar 2010 15:27:23 GMT
server
cloudflare
etag
"3c0015-1fe-4826555678cc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jHPPqgPaUlsrFuvLSxmOy7MAdLfgn%2FOjuP7Ey6mJ%2FknEt5YfVIsFeGUnfeI2jsI1y%2FH%2BacYZn0al43h9n99Jpjg%2FHutBYUEteFWNXWrfM93FoliC623MKd%2FvtQlxmNU5QQ%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Tue, 09 Feb 2021 12:37:33 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b488ad64fd-FRA
cf-bgj
imgq:100,h2pri
footer_partition.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		412 B
807 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/footer_partition.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d77a9a71769ddc2a85524914671fb1d031132a8e37366440a4b6b01d7ad0025

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
735059
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
412
cf-request-id
08100724d9000064fd0f043000000001
last-modified
Mon, 22 Mar 2010 15:27:29 GMT
server
cloudflare
etag
"3c000f-19c-4826555c31a40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NjNJuN6YuB%2BerBWPTD0q07c2b9H00idkZoK4tvfWeKO3wE1CCSkCIxwpzVLoQ4JapfIeueyN4f0YvNx86BviKyHPhfGl1Qwe5fZQC8%2FiS0o6rw14kYCXvOrf%2FemG6jRqrw%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Wed, 10 Feb 2021 06:53:03 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b488af64fd-FRA
cf-bgj
imgq:100,h2pri
footer_h3_dotted.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/footer_h3_dotted.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11789957fc00eda3630397edd31ee6a5575a997ab4334d79b655b3830ab4caf4

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
659779
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1026
cf-request-id
08100724df000064fd02195000000001
last-modified
Mon, 22 Mar 2010 15:27:27 GMT
server
cloudflare
etag
"3c001d-402-4826555a495c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=aH%2FAoJAjylNadRITB%2BrBZ2kEHaYfwK91VVlGLm24unAJW6ookz3mUqxeK%2F%2BpACJTh7CwHNpidIkktQREajNdBfXMzNtVllXYV1m%2BgX22wKnmXDiNed1ay2QqWE9vKX9kAA%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Thu, 11 Feb 2021 03:47:43 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b488b064fd-FRA
cf-bgj
imgq:100,h2pri
footer_bullet.gif
www.securityweek.com/sites/all/themes/securityweek/images/ 		58 B
641 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/footer_bullet.gif
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f1298490f294128f086689a5654a8340ea9ec7c20c8e97f811590d5313edc9e

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
729495
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
58
cf-request-id
08100724dd000064fd0418e000000001
last-modified
Mon, 22 Mar 2010 15:27:25 GMT
server
cloudflare
etag
"3c001e-3a-4826555861140"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EIavuTnAOl4MGdTFAHIn4Mz28%2B0C2xntQOzRkABQHi3GUNenzTeCw4IFp9QioyAY09QQE7QJhw40LSdF8bFJZHgkhCwD3qfwQcS4%2BsfpxTpajiMdKJYlzlr3YyTgiZfiKw%3D%3D"}],"max_age":604800}
content-type
image/gif
expires
Wed, 10 Feb 2021 08:25:47 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7b488b164fd-FRA
cf-bgj
imgq:100,h2pri
init.js
www.securityweek.com/sites/all/modules/custom_control/misc/ 		1 KB
859 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/sites/all/modules/custom_control/misc/init.js?1612455285
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
05f4004f999652bf4c69b8b17fd4813363473fabcf89c056d3da5a6d8eac0555

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0810072604000064fdf5a59000000001
last-modified
Thu, 22 Mar 2018 21:18:02 GMT
server
cloudflare
etag
W/"3c0d00-44d-56806d7baf680"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=m1aTNgJxJC8m0uXbTU5xBylA2fCE5u3Py46ICKBR%2FM3xgY5O9H06v4eazJC72oyL9icA3fbnxwyqScT6R3hHV%2BQ2UTpyw4dpL2Cee9rYaclkukSE%2FD4h4ema2lOpolJeyw%3D%3D"}],"max_age":604800}
content-type
application/javascript
cache-control
max-age=1209600
cf-ray
61c6a7b6696e64fd-FRA
expires
Thu, 18 Feb 2021 19:04:02 GMT
js_def5b13468ddfa4386970cbe7d780b8e.js
www.securityweek.com/sites/default/files/js/ 		785 B
825 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/sites/default/files/js/js_def5b13468ddfa4386970cbe7d780b8e.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8df0ba2d8af3e602eaba8677fe2c57228955b28868c91c2850a4c3c1ad8c7f68

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
101306
cf-polished
origSize=1094
cf-bgj
minify
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0810072605000064fd01286000000001
last-modified
Wed, 03 Feb 2021 14:54:07 GMT
server
cloudflare
etag
W/"3a0014-446-5ba6fc2525cce"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5haD48oOQ8xbLEUSRPJ7GxkuUTjkzzHJC58%2F9iCa%2BjFnMORbWZK74nAIioKtsxgmFdRzDGCEulSA0d6x2Am%2BKSGUQ3p6bbOTlryxAvT0SzfIFFzx%2FmAl8n7fugckuesGoA%3D%3D"}],"max_age":604800}
content-type
application/javascript
cache-control
max-age=1209600
cf-ray
61c6a7b6697064fd-FRA
expires
Wed, 17 Feb 2021 14:55:36 GMT
widgets.js
platform.twitter.com/ 		95 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B7E) /
Resource Hash
2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:02 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Oct 2020 21:52:09 GMT
Server
ECS (amb/6B7E)
Age
195
Etag
"a671d4d584ef50954e5cebb21da17065+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
28698
in.js
platform.linkedin.com/ 		181 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.linkedin.com/in.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F0A) /
Resource Hash
28bcb4f0306800cf4c3706d53203e0d016f6493cbb70043b819bf5f4a48d4e0c

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
content-encoding
gzip
x-cdn-client-ip-version
IPV6
x-cdn
ECST
age
2894
x-cache
HIT
x-cdn-proto
HTTP2
content-length
55604
x-li-uuid
ZFAl9iSeYBYgZMxxpSsAAA==
server
ECAcc (frc/8F0A)
last-modified
Thu, 04 Feb 2021 18:15:48 GMT
x-li-pop
prod-efr5
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
accept-ranges
bytes
x-li-proto
http/1.1
x-li-fabric
prod-lva1
expires
Thu, 4 Feb 2021 19:15:48 GMT
js_6e579c89d00a4fee8965bdf76dd962fa.js
www.securityweek.com/sites/default/files/js/ 		69 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/sites/default/files/js/js_6e579c89d00a4fee8965bdf76dd962fa.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1098ef7fef25a8fd6eac7dbf1442047062c4d1400c601f8ff843742c61de640c

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
101306
cf-polished
origSize=90975
cf-bgj
minify
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0810072620000064fdf5a5c000000001
last-modified
Wed, 03 Feb 2021 14:54:07 GMT
server
cloudflare
etag
W/"3a0004-1635f-5ba6fc2524946"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=8bmTdZLmEO3pPBoHXqXoieP2jdI0ENcox%2F%2Frz3im2RSeloO9CbExzmSguTRnk6qiX%2FzpzHyf3oYy9BYEquIA5qJ4N03pw9gGjofSMSfToNtXOMtppjAEq10XDQ4HO2zJOg%3D%3D"}],"max_age":604800}
content-type
application/javascript
cache-control
max-age=1209600
cf-ray
61c6a7b6998f64fd-FRA
expires
Wed, 17 Feb 2021 14:55:36 GMT
truncated
/ 		6 KB
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
03253e6108bcbd971960c840c954069278e642928fcfaf9bc4e002fff1d61a0d

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
text/css;charset=utf-8
gpt.js
www.googletagservices.com/tag/js/ 		56 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92997675d99730ec8f0dc897926ddca4e87b1a87e94b865e12e360b87753cd39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"774 / 676 of 1000 / last-modified: 1612461383"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
19174
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:02 GMT
plusone.js
apis.google.com/js/ 		49 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/js/plusone.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d54294a6014df645a307b1ddcc2647e902b58333bc92a30d65ea1786d77457d2
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-suPbSIGMWMPIO9qTKPyItg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
x-ua-compatible
IE=edge, chrome=1
server
ESF
x-frame-options
SAMEORIGIN
etag
"3c51cc543292f02d30879e16f46128be"
strict-transport-security
max-age=31536000
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=1800, stale-while-revalidate=1800
content-security-policy
script-src 'report-sample' 'nonce-suPbSIGMWMPIO9qTKPyItg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin
*
expires
Thu, 04 Feb 2021 19:04:02 GMT
in.js
platform.linkedin.com/ 		181 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.linkedin.com/in.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F0A) /
Resource Hash
28bcb4f0306800cf4c3706d53203e0d016f6493cbb70043b819bf5f4a48d4e0c

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
content-encoding
gzip
x-cdn-client-ip-version
IPV6
x-cdn
ECST
age
2894
x-cache
HIT
x-cdn-proto
HTTP2
content-length
55604
x-li-uuid
ZFAl9iSeYBYgZMxxpSsAAA==
server
ECAcc (frc/8F0A)
last-modified
Thu, 04 Feb 2021 18:15:48 GMT
x-li-pop
prod-efr5
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
accept-ranges
bytes
x-li-proto
http/1.1
x-li-fabric
prod-lva1
expires
Thu, 4 Feb 2021 19:15:48 GMT
pubads_impl_2021020101.js
securepubads.g.doubleclick.net/gpt/ 		275 KB
98 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
sffe /
Resource Hash
c7736f6538aca3fcafdd33667cdcbb4baaf13cb9217f11c95fd00f01d788c6f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 01 Feb 2021 09:41:46 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
99427
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:02 GMT
cb=gapi.loaded_0
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/ 		141 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/cb=gapi.loaded_0
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1dbe94f24870455b60be49be9b72675f862260aa374086a786e893f59cb080b0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 09:20:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 27 Jan 2021 20:08:03 GMT
server
sffe
age
35037
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
50334
x-xss-protection
0
expires
Fri, 04 Feb 2022 09:20:05 GMT
cb=gapi.loaded_1
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/ 		97 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/cb=gapi.loaded_1
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
274c5c962cd8ec53ac23d6d07978901972efd7b33e2eb0d1a7222c61fb7f907d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 03:49:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 27 Jan 2021 20:08:03 GMT
server
sffe
age
54892
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
34392
x-xss-protection
0
expires
Fri, 04 Feb 2022 03:49:10 GMT
fastbutton
apis.google.com/se/0/_/+1/ Frame D8A1 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.securityweek.com&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-peLIQR1OP6wY/OIWAiX5xQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
apis.google.com
:scheme
https
:path
/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.securityweek.com&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
NID=208=Hwy_x6ZvsOukkZw-2-T2ocwQ3ag0PjRiw38lgyVqT_R-mgIMubeu-c7ClIJ2qTbn8mBVAvOyc45OYb_dvgKdxMwrF-Q2_2em-iyskACkPSjCVLVtlTRC3C73MKeqmADLGUVUpbAhKLygEyHoyAMsM9VvuOE-Z3-B8rkaO-4lPSE
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Thu, 04 Feb 2021 19:04:02 GMT
content-security-policy
script-src 'report-sample' 'nonce-peLIQR1OP6wY/OIWAiX5xQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
content-encoding
gzip
server
ESF
x-xss-protection
0
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
fastbutton
apis.google.com/se/0/_/+1/ Frame 3025 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.securityweek.com&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-undcoxO2BzOnOay78d9GOw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
apis.google.com
:scheme
https
:path
/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.securityweek.com&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
NID=208=Hwy_x6ZvsOukkZw-2-T2ocwQ3ag0PjRiw38lgyVqT_R-mgIMubeu-c7ClIJ2qTbn8mBVAvOyc45OYb_dvgKdxMwrF-Q2_2em-iyskACkPSjCVLVtlTRC3C73MKeqmADLGUVUpbAhKLygEyHoyAMsM9VvuOE-Z3-B8rkaO-4lPSE
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Thu, 04 Feb 2021 19:04:02 GMT
content-security-policy
script-src 'report-sample' 'nonce-undcoxO2BzOnOay78d9GOw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
content-encoding
gzip
server
ESF
x-xss-protection
0
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
plusone.js
apis.google.com/js/ 		49 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/js/plusone.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d54294a6014df645a307b1ddcc2647e902b58333bc92a30d65ea1786d77457d2
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-2wvDg2NVWuL8dQOmrZzXpQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
x-ua-compatible
IE=edge, chrome=1
server
ESF
x-frame-options
SAMEORIGIN
etag
"3c51cc543292f02d30879e16f46128be"
strict-transport-security
max-age=31536000
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=1800, stale-while-revalidate=1800
content-security-policy
script-src 'report-sample' 'nonce-2wvDg2NVWuL8dQOmrZzXpQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin
*
expires
Thu, 04 Feb 2021 19:04:02 GMT
widgets.js
platform.twitter.com/ 		95 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B7E) /
Resource Hash
2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:02 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Oct 2020 21:52:09 GMT
Server
ECS (amb/6B7E)
Age
195
Etag
"a671d4d584ef50954e5cebb21da17065+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
28698
postmessageRelay
accounts.google.com/o/oauth2/ Frame CADE 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.securityweek.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Requested by
Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/cb=gapi.loaded_1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-boMjtVF9BNjNu7UK9CZLcw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
accounts.google.com
:scheme
https
:path
/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.securityweek.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
NID=208=Hwy_x6ZvsOukkZw-2-T2ocwQ3ag0PjRiw38lgyVqT_R-mgIMubeu-c7ClIJ2qTbn8mBVAvOyc45OYb_dvgKdxMwrF-Q2_2em-iyskACkPSjCVLVtlTRC3C73MKeqmADLGUVUpbAhKLygEyHoyAMsM9VvuOE-Z3-B8rkaO-4lPSE
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Thu, 04 Feb 2021 19:04:03 GMT
content-security-policy
script-src 'report-sample' 'nonce-boMjtVF9BNjNu7UK9CZLcw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding
gzip
server
ESF
x-xss-protection
0
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ga.js
ssl.google-analytics.com/ 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
1883
date
Thu, 04 Feb 2021 18:32:40 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17168
expires
Thu, 04 Feb 2021 20:32:40 GMT
embed.js
securityweek.disqus.com/ 		0
0
google_custom_search_watermark.gif
cse.google.com/coop/intl/en/images/
Redirect Chain
  • https://www.google.com/coop/intl/en/images/google_custom_search_watermark.gif
  • https://cse.google.com/coop/intl/en/images/google_custom_search_watermark.gif
2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cse.google.com/coop/intl/en/images/google_custom_search_watermark.gif
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
pfe /
Resource Hash
4b4b65dc5e87ed8215fb3d74834cd100069e7eb8aaf903a4665e26079fb0777d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 18:40:28 GMT
x-content-type-options
nosniff
last-modified
Wed, 08 Feb 2012 18:07:38 GMT
server
pfe
age
1415
x-frame-options
SAMEORIGIN
content-type
image/gif
cache-control
public, max-age=1800
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2024
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:10:28 GMT

Redirect headers

date
Thu, 04 Feb 2021 18:57:25 GMT
x-content-type-options
nosniff
server
sffe
age
398
content-type
text/html; charset=UTF-8
location
https://cse.google.com/coop/intl/en/images/google_custom_search_watermark.gif
cache-control
public, max-age=1800
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
274
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:27:25 GMT
ad.html
www.securityweek.com/ Frame 15E2 		0
0
ad.html
www.securityweek.com/ Frame EF8E 		556 B
609 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/ad.html
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
437542a358225b118f29d8d09db80177878af0ae9581353e3e701ec7416c67b8

Request headers

:method
GET
:authority
www.securityweek.com
:scheme
https
:path
/ad.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=dd596e6a33c54d03bdbd5b6b1bf941b8f1612465441; SESSc3f2c9572aa8f3f5ea6f60501affecb3=bc595737a8f285b1d8301ead12055ba8; SESSae1377f0cbe7278b70a9339b7853afbd=e39b4c9ed70bc206bb902000ff077753; has_js=1; sessid=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

date
Thu, 04 Feb 2021 19:04:03 GMT
content-type
text/html
last-modified
Mon, 04 Jan 2021 19:55:42 GMT
cache-control
max-age=1209600
expires
Thu, 18 Feb 2021 19:04:03 GMT
cf-cache-status
DYNAMIC
cf-request-id
081007291c000064fdf897c000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=zaroCT4c0ITGAfCYZroLS6J7s5AwaZNSITo3Cux%2FjDs6%2B4fRWlokGTH1y7H8nbXptqSnMsyaEoG80c6j0czh%2F357GOHZSHaprfGrm7sEepCNlx3yqacmhqjgNkxzoEVLtQ%3D%3D"}],"max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
61c6a7bb6b7564fd-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html
platform.twitter.com/widgets/ Frame CD72 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fwww.securityweek.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6BAC) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
591420
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Thu, 04 Feb 2021 19:04:03 GMT
Etag
"9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified
Thu, 01 Oct 2020 21:50:01 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (amb/6BAC)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
5825
integrator.js
adservice.google.de/adsid/ 		109 B
169 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.securityweek.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 04 Feb 2021 19:04:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
169 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.securityweek.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 04 Feb 2021 19:04:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		42 KB
15 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3246452651659507&correlator=743434615321253&output=ldjh&impl=fifs&eid=21068602%2C21068773%2C21068891%2C21069919%2C21069728&vrg=2021020101&ptt=17&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20210204&iu_parts=1009451%2C300x250-Lower%2C300x600-Right-Side%2C728x90-Bottom%2CSecurityWeek-Splash-640x480%2CSecurityWeek_Home_Top_728x90%2CSecurityWeek_Home_Top_Right_300x250%2CRSA-ThreatInsights-300x600%2CRSA-ThreatInsights-728x90&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8&prev_iu_szs=300x250%2C300x600%2C728x90%2C640x480%2C728x90%2C300x250%2C300x600%2C728x90&cookie_enabled=1&bc=31&abxe=1&lmt=1612455285&dt=1612465443158&dlt=1612465441771&idt=1358&frm=20&biw=1600&bih=1200&oid=3&adxs=-9%2C993%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adys=-9%2C621%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adks=2099535745%2C3057893268%2C1175233209%2C4168261516%2C3429238268%2C2944426297%2C4131204049%2C771541050&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1%7C303x610%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&msz=0x-1%7C300x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&ga_vid=559345764.1612465443&ga_sid=1612465443&ga_hid=1949325937&fws=2%2C4%2C2%2C2%2C2%2C2%2C2%2C2&ohw=0%2C998%2C0%2C0%2C0%2C0%2C0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
b54a6cb2a362fdb52cbf249bf56d9586c1289ec1799089b0740d1cb3a22825e1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:03 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14266
x-xss-protection
0
google-lineitem-id
-2,4506530349,-2,81272401,-2,-2,-2,-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2,138308208778,-2,30583699681,-2,-2,-2,-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.securityweek.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
fe004785f74c2bf7fc2a92b14956b30c.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://fe004785f74c2bf7fc2a92b14956b30c.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
button.63c51c903061d0dbd843c41e8a00aa5a.js
platform.twitter.com/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/js/button.63c51c903061d0dbd843c41e8a00aa5a.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B7E) /
Resource Hash
e0a70c5d116d9c823c7d7958ecea2a7926315fac156e390bd7dc8a5fa088cdc3

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:03 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Oct 2020 21:49:51 GMT
Server
ECS (amb/6B7E)
Age
591417
Etag
"62d4b0301f07768d13f3ee5de8633739+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
2294
__utm.gif
ssl.google-analytics.com/r/ 		35 B
378 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=626233284&utmhn=www.securityweek.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Hijacked%20Perl.com%20Domain%20Hosted%20on%20IP%20Address%20Linked%20to%20Malicious%20Activity%20%7C%20SecurityWeek.Com&utmhid=1949325937&utmr=-&utmp=%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&utmht=1612465443202&utmac=UA-11590534-1&utmcc=__utma%3D89563204.999756078.1612465443.1612465443.1612465443.1%3B%2B__utmz%3D89563204.1612465443.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1912013385&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:03 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
platform.twitter.com/widgets/ Frame 8589 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B7E) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
591416
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Thu, 04 Feb 2021 19:04:03 GMT
Etag
"076dccdedb34f3771be52190b917884e+gzip"
Last-Modified
Thu, 01 Oct 2020 21:49:58 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (amb/6B7E)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
12263
tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
platform.twitter.com/widgets/ Frame 7533 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B7E) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
591416
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Thu, 04 Feb 2021 19:04:03 GMT
Etag
"076dccdedb34f3771be52190b917884e+gzip"
Last-Modified
Thu, 01 Oct 2020 21:49:58 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (amb/6B7E)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
12263
view
securepubads.g.doubleclick.net/pcs/ Frame D639 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstqHvdNTsybw2mWFGybY7lFThj4G9HOOQWGvPexJ7T0SDxvvKjPhI8kD871Gsu8hAdPR4ArrqNEQtSXJKq41gxPOiTYVefe8u7QrORIdRH2KoK1Br7CFAh50cxXfBSFNrGC7VntE0K51q_pSq5X5Zt5baTN4UELAExWbKPNBFFlxPvthnj3BhMMY3tTp10Louyp5myiGgQyJNqdKYnTSM_X5sFpzsPOGWY69SXJgtyoTi4FQP2WeUzTtZliDcwELIZwuP8chemtuJuGKWjMtIw9ER8OfcATDb9SYJeqFH3i4ymtm8P67xwUR7A&sai=AMfl-YQvoH3IeBapqO0WL4VylxjwERXYp-DZ67ypbLPEPCaKox9NEnrSj4hHReAh2LaEi_hHb8f6CQkvVjpiUSlrMBgwCgDPe4j8VcnQiNmpVq6cWwy2hCcgJWvn4fxRNVU&sig=Cg0ArKJSzJE3EIrFTT7gEAE&adurl=
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 04 Feb 2021 19:04:03 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:03 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210202/r20110914/ Frame D639 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210202/r20110914/abg_lite_fy2019.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2f1eba35c5c38e67956012861717efdbc6d13c8de0d624213f66de83b8262ff3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 18:08:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3312
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7377
x-xss-protection
0
server
cafe
etag
9429885086326325396
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 18 Feb 2021 18:08:51 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210202/r20110914/client/ Frame D639 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210202/r20110914/client/window_focus_fy2019.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5593d7d222d4086d4427b7c81fb081bf45884d8e1499e1ac1adafb017dc102f9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 18:06:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3450
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1533
x-xss-protection
0
server
cafe
etag
10039694515999607746
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 18 Feb 2021 18:06:33 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame D639 		106 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f1762ce2250a6a35a6fd892b054eec13df91cf939dca3e40ade35ae57d90b215
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1612182882448455"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
33332
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:03 GMT
l
www.google.com/ads/measurement/ Frame D639 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSWc6tLPir8anJtPmQfZ3ejbwQgIBYaCJlqf7vOpiPunZNkJ9RK1uTPsLk9QR0GS-teb0JL
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
1956689884250199370
tpc.googlesyndication.com/simgad/ Frame D639 		200 KB
200 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/1956689884250199370
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d700d6487ef4b0198e9a669c9ec89dd2d633302b7c82808b08f37ff9d38e98b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 01 Feb 2021 17:32:59 GMT
x-content-type-options
nosniff
age
264664
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
204410
x-xss-protection
0
last-modified
Wed, 01 Apr 2020 12:54:53 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 01 Feb 2022 17:32:59 GMT
osd.js
www.googletagservices.com/activeview/js/current/ 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
208dfab1fdcf1f4e57f80d6fd873265f0ff90c42c36cb25e38dff42695e383a4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1612182870646033"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
28348
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:03 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		9 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021020101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
37fff0b873816321bbeb706d3b85dd8364f49e9b9b797aab9b288c9889a8ab83
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 04 Feb 2021 19:04:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6730
x-xss-protection
0
truncated
/ Frame D639 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
66cb023f1a0ebad3f29b17f154c71e508952f4112c54dada5a242d00abf28200

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1611170586013198"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6403
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:03 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame D639 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuROSA7CzZN403es1G_dv6x7-XVz1jT95zZ2Ww6ITPqDIh4KV0C5op8av_5DTbqxxvMZ3PW2V_ek7SWvLsb6KwTiUmYRzP_5vy07TShCMc8LLRLmjDfzW8QC8dh7TXifdJ67ATcV8bbSwR75pi0sQg1hCv_tQpUGgqBQUkIlrqM7lWrpF9hyCNHLU9KfRA_0k35lrKiPKCXWPy70izPSuAKODATPhFowClIsC-bVKbwRTcZCY35gR6v-wuexpZuLF_nJSk0zaKFrawDNYlpEMiQ0unDHbSwdvv4bVip2u541xq_Z4quIHj3QVqGYg&sai=AMfl-YTjhIrF-GquSXw2AZpg3Z_6EOZAcsGinUBjVCWLDHZZ6YqhQGdTW1EDybwjoZTkHc5RMeqhTBBWe-SUPhHwWg-ym6QWTeDrFFi6j6JCtAL9bJNrdm9hAGDYyJPjuWU&sig=Cg0ArKJSzMUtcscT5xi9EAE&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 04 Feb 2021 19:04:03 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:03 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/221/ Frame F42D 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/221/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
4984
date
Thu, 04 Feb 2021 17:16:07 GMT
expires
Fri, 04 Feb 2022 17:16:07 GMT
last-modified
Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
6476
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
jot.html
platform.twitter.com/ Frame 08D7
Redirect Chain
  • https://syndication.twitter.com/i/jot
  • https://platform.twitter.com/jot.html
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/jot.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B7E) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
Origin
https://www.securityweek.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
591420
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Thu, 04 Feb 2021 19:04:03 GMT
Etag
"d9592a6c704736fa4da218d4357976dd"
Last-Modified
Thu, 01 Oct 2020 21:52:09 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (amb/6B7E)
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
80

Redirect headers

cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length
0
content-type
text/html;charset=utf-8
date
Thu, 04 Feb 2021 19:04:03 GMT
expires
Tue, 31 Mar 1981 05:00:00 GMT
last-modified
Thu, 04 Feb 2021 19:04:03 GMT
location
https://platform.twitter.com/jot.html
pragma
no-cache
server
tsa_o
status
302 Found
strict-transport-security
max-age=631138519
x-connection-hash
202f30777d65c6fe813ee58d078619e7
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-response-time
111
x-transaction
0076514b0063354b
x-tsa-request-body-time
1
x-twitter-response-tags
BouncerCompliant
x-xss-protection
0
BrightInfoVersion.aspx
app.brightinfo.com/ 		512 B
942 B 		Script
General
Check archive.org
Download Go to
Full URL
https://app.brightinfo.com/BrightInfoVersion.aspx
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
168.62.202.120 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
46411f952453bbf85b05074d1d042e4f1b4467aa6e5a54345c629a626cb04d09

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 04 Feb 2021 19:04:04 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control
no-cache, no-store
Content-Type
text/javascript; charset=utf-8
Content-Length
503
Expires
-1
gen_204
pagead2.googlesyndication.com/pagead/ 		0
122 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gpt_2021020101&jk=3246452651659507&bg=!REelRwTNAAWnsTPUpzsAKQB2-DxaCQfdiNdeX1NUYZbd58FZc2gBiLg2kXBfSMTS_T8JYrQORbG2AgAAAIZSAAAAD2gBBwoAm8ShXRFiRmlbDS_3okTea18-qbfMy2oK0Eh8dwjwtdAJQnZvI_OVhCkcamEr4PjSc9amKT-_0IgPH8by-5-hd7br4w7tJNeDaYjiZNTlW4Xwd-pvw4YNiKHw3jmqaRlcaV_p2lmrDdsQkRplGNBeRr53rcqYK_AwGD2G-TVkZ94xGFM81Tn7ltPYBiXKAe2PZEsYumYqokUpVREImQHfXNzPfAfnTk4QdhhfAn12AMh1SMW-EK_fuTWElyB2sr77hC4tkiSGev0QYOKgEl6PeUwdkkl_laJ6-mst4uT-DbDzaJ0J8flckN0WzLtCZXKuWFTMgBbR1n0_d7UU66rIcdvOjJwGqRvkd8LAPHHMIcC2H9PLl1-7TEc7xOvdZFzUzqNPCAiC9fNyEdECDXJObibPJ5bkboqCNxu9QX5qm2w9bxY-_qRVjt0BXrlxbibGrHyXvtc6DIzSNGc2L36g4NaCFPG9gk7O3OCsyZEs0cBkYo7Qrk1QQqdFSY4PTXUEKfsmXjlDty0qhZPP7Lmp3_jxLYpmuLMVfzSTpYrQ4Hw_zB4Ovfi4Pktc_UQu9UZqhq-hexboGtS5ZzlPNq2xyqsJ37MgpbhHJvRSRLyg5xi8UU470oAaph81waYROnTh7NMTHFE89sJvVzwJKSEm501_DpM2ZXHxiG9XvURqFCFBgMU02rYE6x90-Bq8cM2UUeI5tWh0AIImsAGqaQAywdKGpT51vsWhKIMozKINdDJmoQwKH8-_4u-uhzrgEvScRTCtiPwejS5JkbuPpIeiEvt5DgZykOc7HeCdnqQPNn-TXKEPE6jqbvJRwSTkay2Ou6Yj1cvz4ZXPVybvbPg
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:03 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Virtual-Events-640x480.jpg
www.securityweek.com/ad/ Frame EF8E 		146 KB
147 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/ad/Virtual-Events-640x480.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/ad.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:61a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a060b3f77ac5873b42822513a8d9c2439423dd9be07cf85d3e45f3dd8028d378

Request headers

Referer
https://www.securityweek.com/ad.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:03 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
255799
cf-polished
origSize=168045
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
149643
cf-request-id
0810072b93000064fd041f3000000001
last-modified
Mon, 04 Jan 2021 19:53:39 GMT
server
cloudflare
etag
"2c082c-2906d-5b81872459d18"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=G1f%2FtLuP5VHrGubAwOAMZHHLvsLRm9DBUvsm1hwzOtnd2W4v8H1P9xebkdDPrzPeerqZCYgeKFUaYL1bCqHB7Z9Q5Mcxa3dJTpaWa%2BFBxyHJ264bwzjMCeRS%2Bi0WccZLKA%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Mon, 15 Feb 2021 20:00:44 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a7bf5d9b64fd-FRA
cf-bgj
imgq:100,h2pri
activeview
pagead2.googlesyndication.com/pcs/ Frame D639 		42 B
725 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu7Qy8BdJgJqZAdHaGYOb8_2-6yQqrswflP3uhCtRS9-bGGnV-MLgRU721AXzBpcTKPPJp1pIQEBLRYIAfz5w7P4xgl453K0MSyhKCX3UI&sig=Cg0ArKJSzOJEcoXx_2hSEAE&id=osdim&mcvt=1000&p=621,993,1221,1293&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20210201&bin=7&avms=nio&bs=1600,1200&mc=0.97&app=0&itpl=3&adk=3057893268&rs=4&met=mue&la=0&cr=0&osd=0&vs=4&r=v&uup=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:04 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bi.js
app.brightinfo.com/Scripts/ 		260 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/BrightInfoVersion.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
168.62.202.120 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
c5d22156666a1a8d7c0b660324a007ae7c2a0a3a355a893b180f65d989bdee11

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:04 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
text/javascript; charset=utf-8
Cache-Control
private
Content-Length
76328
Expires
Fri, 04 Feb 2022 19:04:04 GMT
analytics.js
www.google-analytics.com/ 		46 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
5938
date
Thu, 04 Feb 2021 17:25:07 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Thu, 04 Feb 2021 19:25:07 GMT
bia.aspx
bia.brightinfo.com/ 		19 B
409 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bia.brightinfo.com/bia.aspx?callback=jQuery203005773269141906412_1612465445256&type=biLoad&version=2&jsonString=%7B%22url%22%3A%22https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity%22%2C%22cts%22%3A1612465445285%2C%22cid%22%3A%22wiredbusinessmedia-14532-1%22%2C%22pu%22%3A%22https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity%22%2C%22ru%22%3A%22%22%2C%22type%22%3A%22biLoad%22%2C%22sid%22%3A%221p8x276l6vlWv5nCtGm1%22%2C%22mobile%22%3A0%2C%22browser%22%3A%22chrome%22%2C%22accountId%22%3A%2214532%22%2C%22version%22%3A2%7D&_=1612465445257
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
137.135.51.188 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
0e688d02687c4c64094dd0a75f5189ea12b955acf8c91f7bd5ac4948f1429cb9

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:05 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
private
Content-Length
136
bi-animate.min.css
app.brightinfo.com/ui/ 		47 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://app.brightinfo.com/ui/bi-animate.min.css?bi_ver=132292759840000000&id=wiredbusinessmedia-14532-1&sid=1p8x276l6vlWv5nCtGm1
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
168.62.202.120 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
46cad46571cab06c5901e4e867aba4f0783dc88d3db626cfb73d58f00d130a16

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:04 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Mar 2020 14:53:24 GMT
Server
Microsoft-IIS/8.0
X-Powered-By
ASP.NET
ETag
"04a8a7890ffd51:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
4661
bi.min.css
app.brightinfo.com/ui/ 		47 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://app.brightinfo.com/ui/bi.min.css?bi_ver=132292759840000000&id=wiredbusinessmedia-14532-1&sid=1p8x276l6vlWv5nCtGm1
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
168.62.202.120 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
810956c722149065eabd5b5c4f62f98cb74cda6fb5e3695ab97958e53d6791ca

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:05 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Mar 2020 14:53:24 GMT
Server
Microsoft-IIS/8.0
X-Powered-By
ASP.NET
ETag
"04a8a7890ffd51:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
7239
bi-custom.css
app.brightinfo.com/ui/custom/wiredbusinessmedia-14532-1/ 		548 KB
57 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://app.brightinfo.com/ui/custom/wiredbusinessmedia-14532-1/bi-custom.css?bi_ver=132292759840000000&id=wiredbusinessmedia-14532-1&sid=1p8x276l6vlWv5nCtGm1
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
168.62.202.120 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
5690a1bcc83d00312ef6260da791205a71d80bed7b35ca9701c7b29cfd62b3fe

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:05 GMT
Content-Encoding
gzip
Last-Modified
Mon, 25 Jan 2021 18:19:52 GMT
Server
Microsoft-IIS/8.0
X-Powered-By
ASP.NET
ETag
"0946bac46f3d61:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
58375
bi.aspx
app.brightinfo.com/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.brightinfo.com/bi.aspx?method=load&callback=jQuery203005773269141906412_1612465445258&id=wiredbusinessmedia-14532-1&sid=1p8x276l6vlWv5nCtGm1&u=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&r=&testModeKey=&biSettings=&fip=&fvs=&fcs=&fec=&fic=&force=&forceHide=false&sw=1600&sh=1200&w=1600&h=1200&utma=89563204.1p8x276l6vlWv5nCtGm1.1612465443.1612465443.1612465443.1&ga=&logId=&iframe=false&startTime=637480622444622700&_=1612465445259
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
168.62.202.120 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
ad17f2c5deaf9801efd0113a4053248a6d3e9aedf315f57e0653844763d732db

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:05 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control
private
Content-Type
text/javascript; charset=utf-8
Content-Length
2571
collect
www.google-analytics.com/j/ 		2 B
70 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&a=1949325937&t=pageview&_s=1&dl=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&ul=en-us&de=UTF-8&dt=Hijacked%20Perl.com%20Domain%20Hosted%20on%20IP%20Address%20Linked%20to%20Malicious%20Activity%20%7C%20SecurityWeek.Com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=89563204.999756078.1612465443.1612465443.1612465443.1&_utmz=89563204.1612465443.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1612465446114&_u=KQBCAEABGAAAAC~&jid=737928736&gjid=910676165&cid=999756078.1612465443&tid=UA-72146139-2&_gid=1936846447.1612465446&_r=1&_slc=1&cd1=1p8x276l6vlWv5nCtGm1&cd2=1612465446113&cd3=Hidden&cd4=No%20recommended%20content&cd5=No%20Value&cd6=No%20Value&cd7=No%20Value&cd8=No%20Value&cd9=No%20Value&cd10=No%20Value&cd11=No%20Value&cd12=No%20Value&cd13=No%20Value&cd14=No%20Value&cd15=Default%20Content&z=1843493601
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:06 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.securityweek.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
bia.aspx
bia.brightinfo.com/ 		19 B
409 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bia.brightinfo.com/bia.aspx?callback=jQuery203005773269141906412_1612465445258&type=biVisit&version=2&jsonString=%7B%22url%22%3A%22https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity%22%2C%22cts%22%3A1612465446118%2C%22cid%22%3A%22wiredbusinessmedia-14532-1%22%2C%22pu%22%3A%22https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity%22%2C%22ru%22%3A%22%22%2C%22type%22%3A%22biVisit%22%2C%22sid%22%3A%221p8x276l6vlWv5nCtGm1%22%2C%22mobile%22%3A0%2C%22browser%22%3A%22chrome%22%2C%22accountId%22%3A14532%2C%22gatedPromotion%22%3Afalse%2C%22seq%22%3A1%2C%22siteId%22%3A14522%2C%22vs%22%3A%22Hidden%22%2C%22cs%22%3A%22Default+Content%22%2C%22version%22%3A2%2C%22promoId%22%3A0%7D&_=1612465445260
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
137.135.51.188 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
0e688d02687c4c64094dd0a75f5189ea12b955acf8c91f7bd5ac4948f1429cb9

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:06 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
private
Content-Length
136
__utm.gif
ssl.google-analytics.com/ 		35 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=2&utmn=1529438313&utmhn=www.securityweek.com&utme=8(WidgetPanelLocation%2FTimestamp*isPromotedContent*BI_ID*SID*ViewSegmentName)9(regular%7C1612465446078*No%20recommended%20content*No%20Value*89563204.1p8x276l6vlWv5nCtGm1.1612465443.1*Hidden)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Hijacked%20Perl.com%20Domain%20Hosted%20on%20IP%20Address%20Linked%20to%20Malicious%20Activity%20%7C%20SecurityWeek.Com&utmhid=1949325937&utmr=-&utmp=%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&utmht=1612465446089&utmac=UA-72146139-1&utmcc=__utma%3D89563204.999756078.1612465443.1612465443.1612465443.1%3B%2B__utmz%3D89563204.1612465443.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qRAAAAAAIAQAAAAAAAAAAAAE~
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 18:43:01 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1265
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
securityweek.disqus.com
URL
http://securityweek.disqus.com/embed.js
Domain
www.securityweek.com
URL
https://www.securityweek.com/ad.html

Verdicts & Comments Add Verdict or Comment

110 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| Eager object| CloudflareApps object| __cfQR object| Drupal object| jaaulde function| tb_show function| tb_showIframe function| tb_remove function| tb_position function| tb_parseQuery function| tb_getPageSize function| tb_setBrowserExtra function| tb_focusFirstFormElement string| disqus_shortname number| disqus_developer string| disqus_url string| disqus_title string| disqus_identifier function| disqus_config object| disqus_def_name object| disqus_def_email function| quicktabsClick object| Blueprint function| $ function| jQuery object| googletag string| biJsUrl object| _biq object| __core-js_shared__ object| Sslac object| IN object| __twttrll object| twttr object| __twttr object| ggeac object| google_js_reporting_queue object| gapi object| ___jsl object| gadgets object| osapi object| iframer object| __gapi_jstiming__ object| shindig function| ToolbarApi object| iframes function| IframeBase function| Iframe function| IframeProxy function| IframeWindow object| oauth2 object| _gaq boolean| __cfRLUnblockHandlers number| xWidth function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter undefined| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken number| __google_ad_urls_id number| google_unique_id object| gaGlobal object| _gat object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired object| GoogleGcLKhOms function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| google_image_requests string| bi_ver string| biSiteUrl string| biUtmaPrefix number| biStartTime function| jQueryBI object| _BI object| jQBrowser boolean| biLoaded string| biUrl string| GoogleAnalyticsObject function| _gabi object| SessionOptionsBI undefined| jQuery203005773269141906412_1612465445256 undefined| jQuery203005773269141906412_1612465445258 object| google_tag_data object| gaplugins object| _BI_ object| gaData

4 Cookies

Domain/Path Name / Value
.securityweek.com/ Name: SESSae1377f0cbe7278b70a9339b7853afbd
Value: e39b4c9ed70bc206bb902000ff077753
.securityweek.com/ Name: SESSc3f2c9572aa8f3f5ea6f60501affecb3
Value: bc595737a8f285b1d8301ead12055ba8
www.securityweek.com/ Name: has_js
Value: 1
.securityweek.com/ Name: __cfduid
Value: dd596e6a33c54d03bdbd5b6b1bf941b8f1612465441

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
adservice.google.com
adservice.google.de
ajax.cloudflare.com
apis.google.com
app.brightinfo.com
bia.brightinfo.com
cse.google.com
fe004785f74c2bf7fc2a92b14956b30c.safeframe.googlesyndication.com
pagead2.googlesyndication.com
platform.linkedin.com
platform.twitter.com
sales.cscglobal.com
securepubads.g.doubleclick.net
securityweek.disqus.com
ssl.google-analytics.com
syndication.twitter.com
tpc.googlesyndication.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagservices.com
www.securityweek.com
securityweek.disqus.com
www.securityweek.com
104.244.42.72
137.135.51.188
168.62.202.120
172.217.16.130
2606:2800:233:66b5:799a:7cd3:f74d:7071
2606:2800:234:59:254c:406:2366:268c
2606:4700:20::ac43:61a9
2606:4700::6810:a823
2a00:1450:4001:800::200e
2a00:1450:4001:802::2008
2a00:1450:4001:808::200e
2a00:1450:4001:811::2001
2a00:1450:4001:811::200d
2a00:1450:4001:812::2001
2a00:1450:4001:813::2002
2a00:1450:4001:821::2008
2a00:1450:4001:828::2002
2a00:1450:4001:829::2002
2a00:1450:4001:82a::2001
2a00:1450:4001:82b::2004
2a00:1450:4001:82b::200e
2a03:2880:f11c:8183:face:b00c:0:25de
52.86.71.216
03253e6108bcbd971960c840c954069278e642928fcfaf9bc4e002fff1d61a0d
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
05f4004f999652bf4c69b8b17fd4813363473fabcf89c056d3da5a6d8eac0555
08fa49f20076c343e2724c631a732d8cbd3bd0daf55f4a0f8311e07dc77be29c
0deae7d488b0316e0149f1dc2caec46821b2272127b61b4ffadf6f99a303ea16
0e688d02687c4c64094dd0a75f5189ea12b955acf8c91f7bd5ac4948f1429cb9
1098ef7fef25a8fd6eac7dbf1442047062c4d1400c601f8ff843742c61de640c
10f0e5158e45d76ba649af69ed465a28489483ac934b3e491773cb5e4c9704f0
11789957fc00eda3630397edd31ee6a5575a997ab4334d79b655b3830ab4caf4
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1dbe94f24870455b60be49be9b72675f862260aa374086a786e893f59cb080b0
200abde0c426b23abe8a9c501ab4e8e72c048cc0653203817cc9ff96cc6e394d
208dfab1fdcf1f4e57f80d6fd873265f0ff90c42c36cb25e38dff42695e383a4
21b195ce0d8efa07e31b863199d8a6802cb773e2417443e534ed8c113d8949a8
274c5c962cd8ec53ac23d6d07978901972efd7b33e2eb0d1a7222c61fb7f907d
28bcb4f0306800cf4c3706d53203e0d016f6493cbb70043b819bf5f4a48d4e0c
2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15
2f1298490f294128f086689a5654a8340ea9ec7c20c8e97f811590d5313edc9e
2f1eba35c5c38e67956012861717efdbc6d13c8de0d624213f66de83b8262ff3
37fff0b873816321bbeb706d3b85dd8364f49e9b9b797aab9b288c9889a8ab83
3d77a9a71769ddc2a85524914671fb1d031132a8e37366440a4b6b01d7ad0025
3e4a85296d37106cff5d646be0fabf370fd83a9b133c3aaf41e6ffb73d108366
437542a358225b118f29d8d09db80177878af0ae9581353e3e701ec7416c67b8
46411f952453bbf85b05074d1d042e4f1b4467aa6e5a54345c629a626cb04d09
46cad46571cab06c5901e4e867aba4f0783dc88d3db626cfb73d58f00d130a16
4986aea94d23482c38fb06749a6a5c5c6ab95db97aa3bcc9feaf7eda6cbf6626
4b4b65dc5e87ed8215fb3d74834cd100069e7eb8aaf903a4665e26079fb0777d
55851ffd45a0a3e9abd9c2ac844eba1efd50272a39360d0f3b396d26a7d0bfc8
5593d7d222d4086d4427b7c81fb081bf45884d8e1499e1ac1adafb017dc102f9
5690a1bcc83d00312ef6260da791205a71d80bed7b35ca9701c7b29cfd62b3fe
5ae75bcb392ec9110db2837a9134c1b414c373244ea62816c63cc5bb41a90cfe
5f3d36be68e6a795cf0d621b7d8b4beb4b9f9caea3f3682f2f8f59a846000893
61152d4b8363a8db7d72ece0ebb989ca0788d860b0c3cce645d16b63fa37e525
62b425148295a81e4162a87cb36eba754d16b295ec5b733140e2b82c7f77a731
65cc8600f521d4e99aa77e95337426f53ec86dd569e8db164bcda70d5c1da388
66cb023f1a0ebad3f29b17f154c71e508952f4112c54dada5a242d00abf28200
810956c722149065eabd5b5c4f62f98cb74cda6fb5e3695ab97958e53d6791ca
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8c9b185e1e937971dfedaafecf01bc14813a2ece31cc9af4a2097f9b3ecb061d
8df0ba2d8af3e602eaba8677fe2c57228955b28868c91c2850a4c3c1ad8c7f68
8f9048e36baefc5cac0974c3e49ffc683d667c5b2081f6cd8d20f5a301b124c2
8ffad58a307aa1ac6baff90296c8edc9db313f888876bc2ad453be4db8d01bf9
913e0bff2ebdfd8aa46e82e8282910638f68fdb9f56f447f1f6b259f3fe5e539
92997675d99730ec8f0dc897926ddca4e87b1a87e94b865e12e360b87753cd39
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a060b3f77ac5873b42822513a8d9c2439423dd9be07cf85d3e45f3dd8028d378
aa76185f417cf85d7029b35e3a6544d4495402e17f76a32633b5ba80a81faa26
ab74e69c44356590de92b4b7354dc5ae3887e20f3dd9d07cea55cedbdd441f95
ad17f2c5deaf9801efd0113a4053248a6d3e9aedf315f57e0653844763d732db
ad853a72ac4fa4a7ea4700fb824906dbba6fd62e4f61e92449a5cba3f60ff1dc
afedf855d6d8ece53e013419b411dd4870baa7594fe221ab1e493d78be8eb957
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
b54a6cb2a362fdb52cbf249bf56d9586c1289ec1799089b0740d1cb3a22825e1
c5d22156666a1a8d7c0b660324a007ae7c2a0a3a355a893b180f65d989bdee11
c7736f6538aca3fcafdd33667cdcbb4baaf13cb9217f11c95fd00f01d788c6f4
c8c3472f82c523707024b21c9c02755fb4fc9540558895e5ec10ceb1a7ac7977
cb9477033c58e96024bca0f7dd5653690517c2ed8f6b633c396f00d206964848
d10a778caafc69e25249f7b7fa00a1bfaa240991b6c7cdedb7f562fff418eb21
d54294a6014df645a307b1ddcc2647e902b58333bc92a30d65ea1786d77457d2
d55e4cb97826944c4f826821ac2688b361d7cf0303b4640c2cb3eef6ee19b233
d700d6487ef4b0198e9a669c9ec89dd2d633302b7c82808b08f37ff9d38e98b8
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
e0a70c5d116d9c823c7d7958ecea2a7926315fac156e390bd7dc8a5fa088cdc3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb9d49a04efcc971667386f67fb420e20fd130339f1c994fc7359bc34771ef9
f1762ce2250a6a35a6fd892b054eec13df91cf939dca3e40ade35ae57d90b215
f8dd5483dc29044f06c3a45f8fd05d0f122a2b4315292df6da919775189351c9