www.bleepingcomputer.com Open in urlscan Pro
104.20.60.209  Public Scan

11 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

• https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en HTTP 302
• https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request Chain 86

• https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585243625888&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1585243625889&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&c8=&c9=&cs_ucfr=0 HTTP 302
• https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585243625888&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1585243625889&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&c8=&c9=&cs_ucfr=0

Request Chain 125

• https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585243625888&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=1651&ns_st_cl=30000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=1651&ns_st_dpt=1651&ns_st_ipt=1651&ns_st_et=1651&ns_st_det=1651&ns_st_upc=1651&ns_st_dupc=1651&ns_st_iupc=1651&ns_st_upa=1651&ns_st_dupa=1651&ns_st_iupa=1651&ns_st_lpc=1651&ns_st_dlpc=1651&ns_st_lpa=1651&ns_st_dlpa=1651&ns_st_pa=1651&ns_ts=1585243627540&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&c8=&c9=&cs_ucfr=0 HTTP 302
• https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585243625888&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=1651&ns_st_cl=30000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=1651&ns_st_dpt=1651&ns_st_ipt=1651&ns_st_et=1651&ns_st_det=1651&ns_st_upc=1651&ns_st_dupc=1651&ns_st_iupc=1651&ns_st_upa=1651&ns_st_dupa=1651&ns_st_iupa=1651&ns_st_lpc=1651&ns_st_dlpc=1651&ns_st_lpa=1651&ns_st_dlpa=1651&ns_st_pa=1651&ns_ts=1585243627540&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&c8=&c9=&cs_ucfr=0

Request Chain 163

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 199

• https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
• https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

Request Chain 200

• https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent= HTTP 302
• https://u.openx.net/w/1.0/pd?cc=1&gdpr=0&gdpr_consent=

Request Chain 202

• https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
• https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

Request Chain 203

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 204

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 205

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 206

• https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
• https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

Request Chain 212

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 219

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

216 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/	65 KB 14 KB	587ms 544ms	Document text/html	104.20.60.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.60.209 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 595c6a86e1c8a022410d30032320af33e2ab0fbb307000af2d74c04e310df47a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers :method GET :authority www.bleepingcomputer.com :scheme https :path /news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers status 200 date Thu, 26 Mar 2020 17:27:04 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=ddfb48c03e78b97d129e1abaf2fae11591585243624; expires=Sat, 25-Apr-20 17:27:04 GMT; path=/; domain=.bleepingcomputer.com; HttpOnly; SameSite=Lax; Secure session_id=6f9ceb0516438032ec9925939dc554e9; path=/; domain=.bleepingcomputer.com; httponly;Secure lav=7694; expires=Sat, 25-Apr-2020 17:27:04 GMT; Max-Age=2592000; path=/;Secure content-security-policy upgrade-insecure-requests; x-frame-options SAMEORIGIN cache-control no-cache, no-store, must-revalidate pragma no-cache expires 0 last-modified Tue, 04 Feb 2020 21:39:30 GMT vary Accept-Encoding,User-Agent cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 57a2948c9a2cf43b-LHR content-encoding br
GET H2	200	css fonts.googleapis.com/	15 KB 1 KB	18ms 16ms	Stylesheet text/css	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2dda7ea92135dcf21660d4d79391d303fc38f6a6524ae74bbe2986f1d2e990d5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 26 Mar 2020 17:27:04 GMT server ESF date Thu, 26 Mar 2020 17:27:04 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 26 Mar 2020 17:27:04 GMT
GET H2	200	bootstrap.css www.bleepstatic.com/css/redesign/	111 KB 17 KB	112ms 25ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/bootstrap.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7e7c74d95df84ef3a6be5c4fcde54fae313a04a9bd611059e6a97a23ff09f26f Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT age 573 cf-polished origSize=137522 status 200 cf-bgj minify last-modified Fri, 23 Sep 2016 14:33:06 GMT server cloudflare etag W/"2184297232" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a294909e9ddc3b-LHR expires Sat, 23 Mar 2019 05:29:58 GMT
GET H2	200	main.css www.bleepstatic.com/css/redesign/	51 KB 9 KB	155ms 69ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c9e727b37a735a7983ea8bdad06a38b246261c239bb80b86cc0ff3663c910adb Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT age 1866166 cf-polished origSize=60842 status 200 cf-bgj minify last-modified Thu, 16 Aug 2018 15:28:40 GMT server cloudflare etag W/"4249134023" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a294909ea3dc3b-LHR expires Tue, 12 Nov 2019 07:00:33 GMT
GET H2	200	home.css www.bleepstatic.com/css/redesign/	12 KB 3 KB	112ms 25ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/home.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b3498f138f5418bd58413e79e4c0969e618d6f2fee2d9d98c0f4e70a6cbd04ad Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT age 188 cf-polished origSize=14998 status 200 cf-bgj minify last-modified Sat, 24 Mar 2018 16:18:00 GMT server cloudflare etag W/"2402535603" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a294909ea4dc3b-LHR expires Thu, 28 Mar 2019 00:17:49 GMT
GET H2	200	news.css www.bleepstatic.com/css/redesign/	27 KB 5 KB	127ms 40ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/news.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d44b93a0af159f0d547d7ec89e9227a5667ce1171bc630e6fbf79dae0e596e2d Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT age 188 cf-polished origSize=32905 status 200 cf-bgj minify last-modified Tue, 26 Nov 2019 02:56:16 GMT server cloudflare etag W/"400467278" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a294909ea8dc3b-LHR expires Tue, 31 Dec 2019 03:31:34 GMT
GET H2	200	jquery-1.11.1.min.js Show response www.bleepstatic.com/js/redesign/	94 KB 32 KB	131ms 44ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/jquery-1.11.1.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT last-modified Thu, 23 Apr 2015 12:36:44 GMT server cloudflare age 2116104 etag W/"3647451394" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 57a294909eaadc3b-LHR access-control-allow-origin * expires Mon, 06 Apr 2020 05:38:41 GMT
GET H2	200	news.js Show response www.bleepstatic.com/js/redesign/	183 B 534 B	111ms 24ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/news.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT age 2203736 cf-polished origSize=247 status 200 cf-bgj minify last-modified Wed, 16 Dec 2015 15:41:46 GMT server cloudflare etag W/"4218930423" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a294909eabdc3b-LHR expires Sun, 05 Apr 2020 05:18:09 GMT
GET H2	200	connatix.renderer.infeed.min.js Show response cdn.connatix.com/min/	957 B 1 KB	103ms 33ms	Script application/javascript	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash 45a3f5d0135ab059ea2ad9f75b800440db8c2c98ae88afacf19cd3366a71f010 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT via 1.1 varnish server Varnish age 0 x-cache HIT content-type application/javascript status 200 x-referer-host bleepingcomputer.com cache-control no-cache, no-store, must-revalidate, max-age=0 x-cache-hits 0 accept-ranges bytes x-timer S1585243625.046365,VS0,VE0 content-length 957 retry-after 0 x-served-by cache-hhn4030-HHN
GET H2	200	qc-consent.js Show response www.bleepstatic.com/js/qc-consent/	3 KB 1 KB	24ms 24ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/qc-consent/qc-consent.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3b6a84a416edfb98ed7608dad8cd26ffd7123e54bce2bb13a4a3394e0b948382 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT age 612 cf-polished origSize=3848 status 200 cf-bgj minify last-modified Thu, 07 Feb 2019 13:49:44 GMT server cloudflare etag W/"3981350888" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a294910fe0dc3b-LHR expires Thu, 07 Nov 2019 07:15:12 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	75 KB 28 KB	15ms 14ms	Script application/javascript	2a00:1450:4001:800::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 730bfff26abc95bea2467f53e7d88821e991530afe15737608f5972b45f97abd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br status 200 strict-transport-security max-age=31536000; includeSubDomains alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28637 x-xss-protection 0 last-modified Thu, 26 Mar 2020 15:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin http://www.googletagmanager.com cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 26 Mar 2020 17:27:05 GMT
GET H2	200	logo.png www.bleepstatic.com/images/site/	1 KB 1 KB	28ms 25ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/logo.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 683840 cf-polished origFmt=png, origSize=1882 status 200 content-disposition inline; filename="logo.webp" cf-bgj imgq:85 content-length 1152 last-modified Sat, 04 Mar 2017 04:12:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a29491181fdc3b-LHR expires Fri, 17 Apr 2020 19:29:45 GMT
GET H2	200	brand Show response cse.google.com/coop/cse/ Redirect Chain https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en	3 KB 2 KB	30ms 6ms	Script text/javascript	2a00:1450:4001:815::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software pfe / Resource Hash 4eeb4df3522892ea2ec61de6a58e870e8262019f8e3c759c099450cefb589313 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:24:59 GMT content-encoding gzip x-content-type-options nosniff server pfe age 126 x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control public, max-age=1800 content-disposition attachment; filename="f.txt" alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 1181 x-xss-protection 0 expires Thu, 26 Mar 2020 17:54:59 GMT Redirect headers date Thu, 26 Mar 2020 17:27:05 GMT x-content-type-options nosniff server sffe location https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 266 x-xss-protection 0
GET H2	200	reverse-emotet.jpg www.bleepstatic.com/content/hl-images/2018/10/24/	90 KB 90 KB	49ms 46ms	Image image/jpeg	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2018/10/24/reverse-emotet.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ca8060649b94cc4a353595f7fb7bb7b58ba5528b395f542014e5ce7cf776dd1c Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 290909 cf-polished origSize=94592, status=webp_bigger status 200 cf-bgj imgq:85 content-length 91715 last-modified Wed, 24 Oct 2018 18:45:12 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a294911824dc3b-LHR expires Wed, 22 Apr 2020 08:38:36 GMT
GET H2	200	spam-email.jpg www.bleepstatic.com/images/news/malware/e/emotet/tax-2020-signed-w9/	51 KB 51 KB	37ms 34ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/news/malware/e/emotet/tax-2020-signed-w9/spam-email.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 44912e0c0fbf274915500a82faeeaac1ececd34e6d25dd88027023dce69a8ec4 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 4316 cf-polished qual=85, origFmt=jpeg, origSize=113447 status 200 content-disposition inline; filename="spam-email.webp" cf-bgj imgq:85 content-length 51964 last-modified Tue, 04 Feb 2020 20:39:37 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a294911826dc3b-LHR expires Sat, 25 Apr 2020 16:15:09 GMT
GET H2	200	emotet-doc.jpg www.bleepstatic.com/images/news/malware/e/emotet/tax-2020-signed-w9/	59 KB 59 KB	64ms 61ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/news/malware/e/emotet/tax-2020-signed-w9/emotet-doc.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 84c9f1e96ee5c42db7d89b1a2d1b204f798aa7eeb66ac53fe414efbd58e6d0c2 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 4316 cf-polished qual=85, origFmt=jpeg, origSize=107811 status 200 content-disposition inline; filename="emotet-doc.webp" cf-bgj imgq:85 content-length 60026 last-modified Tue, 04 Feb 2020 20:51:20 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a294911829dc3b-LHR expires Sat, 25 Apr 2020 16:15:09 GMT
GET H2	200	adsbygoogle.js Show response pagead2.googlesyndication.com/pagead/js/	107 KB 38 KB	25ms 23ms	Script text/javascript	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 3c005dba1d518d8fcd6bb8b0cd5264947d7c8c5b53363556d98c453428a376ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 39033 x-xss-protection 0 server cafe etag 13352514705584774431 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Thu, 26 Mar 2020 17:27:05 GMT
GET H2	200	twitter.png www.bleepstatic.com/images/site/login/	282 B 446 B	30ms 28ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/login/twitter.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 687201 cf-polished origFmt=png, origSize=475 status 200 content-disposition inline; filename="twitter.webp" cf-bgj imgq:85 content-length 282 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a29491182bdc3b-LHR expires Fri, 17 Apr 2020 18:33:44 GMT
GET H2	200	bootstrap.js Show response www.bleepstatic.com/js/redesign/	44 KB 10 KB	33ms 30ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/bootstrap.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e5e0f326458e8b8ed839d42a0cf6892df80bf26d7dc7e4f8276a65c41582ab85 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT age 188 cf-polished origSize=65813 status 200 cf-bgj minify last-modified Thu, 23 Apr 2015 12:36:43 GMT server cloudflare etag W/"3930092018" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a29491182ddc3b-LHR expires Tue, 26 Mar 2019 04:15:43 GMT
GET H2	200	blazy.min.js Show response www.bleepstatic.com/js/blazy/	5 KB 2 KB	54ms 54ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/blazy/blazy.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT last-modified Thu, 16 Aug 2018 21:06:19 GMT server cloudflare age 188 etag W/"753357888" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 57a29490bee0dc3b-LHR access-control-allow-origin * expires Wed, 01 Jan 2020 06:03:54 GMT
GET H2	200	bleep.js Show response www.bleepstatic.com/js/redesign/	3 KB 761 B	27ms 25ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/bleep.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT age 188 cf-polished origSize=3600 status 200 cf-bgj minify last-modified Mon, 01 Oct 2018 12:47:57 GMT server cloudflare etag W/"2696894447" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a29491182edc3b-LHR expires Wed, 01 Jan 2020 06:03:55 GMT
GET H2	200	jquery.fancybox.js Show response www.bleepstatic.com/js/redesign/fancybox/	31 KB 10 KB	29ms 27ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT age 187 cf-polished origSize=48706 status 200 cf-bgj minify last-modified Wed, 14 Oct 2015 20:25:51 GMT server cloudflare etag W/"327140449" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a294911831dc3b-LHR expires Tue, 03 Mar 2020 05:01:54 GMT
GET H2	200	fixto.min.js Show response www.bleepstatic.com/js/fixto/	8 KB 3 KB	46ms 46ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/fixto/fixto.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT last-modified Sat, 13 Jun 2015 21:34:42 GMT server cloudflare age 6987 etag W/"1740214911" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 57a29490bf08dc3b-LHR access-control-allow-origin * expires Thu, 19 Dec 2019 04:53:37 GMT
GET H2	200	addthis_widget.js Show response s9.addthis.com/js/300/	349 KB 113 KB	129ms 58ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s9.addthis.com/js/300/addthis_widget.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Tue, 21 Jan 2020 20:57:37 GMT server nginx/1.15.8 etag "5e2765c1-57446" vary Accept-Encoding x-distribution 99 content-type application/javascript status 200 cache-control public, max-age=600 date Thu, 26 Mar 2020 17:27:05 GMT x-host s9.addthis.com content-length 114924
GET H2	200	pubfig.min.js Show response a.pub.network/bleepingcomputer-com/	440 KB 117 KB	142ms 63ms	Script application/javascript	2606:4700:20::681a:18b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://a.pub.network/bleepingcomputer-com/pubfig.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ee7100ccbc8f083d62f84c05b14515e829dd8cd13d0408227e3105042654057b Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT age 9 status 200 x-guploader-uploadid AEnB2Uo6hFTSUcdBVrsjch4P3bqDqr-9Ydta5698-xUMzYxhPhBxWnnDIID4qgCXwfv9Sk6X6rlc7LX-S0B-FFeiuuEeoNjxyQ x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity last-modified Thu, 26 Mar 2020 16:55:02 GMT server cloudflare etag W/"d40ecde028d3a8db9a04ecae21a854b2" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=Y7m/2Q==, md5=1A7N4CjTqNuaBOyuIahUsg== content-type application/javascript x-goog-generation 1585241702494421 cache-control public, max-age=1800 x-goog-stored-content-length 450899 cf-ray 57a29491bb07324c-FRA expires Thu, 26 Mar 2020 17:27:56 GMT
GET H/1.1	200 OK	fab.js Show response ecdn.analysis.fi/static/js/	4 KB 2 KB	80ms 21ms	Script application/javascript	212.71.236.117 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL https://ecdn.analysis.fi/static/js/fab.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.71.236.117 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS nb-212-71-236-117.london.nodebalancer.linode.com Software nginx/1.12.2 / Resource Hash affd87461f2babd57a2f7aec75e9193e8e71a377e8249a02c95a5f43326e289e Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 26 Mar 2020 17:35:52 GMT Content-Encoding gzip Last-Modified Wed, 15 Jul 2015 00:00:00 GMT Server nginx/1.12.2 ETag "55a5a280-560" Content-Type application/javascript Cache-Control max-age=3600 Connection close Content-Length 1376 Expires Thu, 26 Mar 2020 18:35:52 GMT
GET H2	200	login_bg.png www.bleepstatic.com/images/site/	126 B 376 B	22ms 21ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/login_bg.png Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 688370 cf-polished origFmt=png, origSize=187 status 200 content-disposition inline; filename="login_bg.webp" cf-bgj imgq:85 content-length 126 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a294912840dc3b-LHR expires Fri, 17 Apr 2020 18:14:15 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 2450399 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 31 Jan 2020 00:50:19 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:58 GMT server sffe age 4811806 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11020 x-xss-protection 0 expires Sat, 30 Jan 2021 00:50:19 GMT
GET H2	200	connatix.renderer.infeed.min_dc.js Show response cdns.connatix.com/p/1911/min/ Frame 277D	725 KB 191 KB	113ms 38ms	Script application/x-javascript	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 180ef002784b30cbe662cc5e8cde9b65da0adca8a993371fbb9bfa9a990182e4 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding gzip age 1290186 x-cache HIT, HIT status 200 content-length 194812 via 1.1 varnish, 1.1 varnish x-served-by cache-dca17725-DCA, cache-fra19123-FRA last-modified Wed, 11 Mar 2020 19:03:09 GMT x-timer S1585243625.237825,VS0,VE0 etag "ff3bcb0ad90321a624e17d47c9d54127" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=31557600 accept-ranges bytes x-cache-hits 1, 67155
GET DATA	200 OK	truncated /	37 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	nav_bg.png www.bleepstatic.com/images/site/	72 B 273 B	42ms 42ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/nav_bg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 688383 cf-polished origFmt=png, origSize=83 status 200 content-disposition inline; filename="nav_bg.webp" cf-bgj imgq:85 content-length 72 last-modified Sat, 04 Mar 2017 07:57:02 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a29491487edc3b-LHR expires Fri, 17 Apr 2020 18:14:02 GMT
GET H2	200	cmp.js Show response quantcast.mgr.consensu.org/	264 KB 76 KB	79ms 39ms	Script text/javascript	2600:9000:214f:8000:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://quantcast.mgr.consensu.org/cmp.js Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:214f:8000:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash bc73cc3b5fbc98895f0b459237df3d9aa111098c787650e72cda7eadf27388df Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:19:19 GMT content-encoding gzip last-modified Tue, 24 Mar 2020 19:10:19 GMT server AmazonS3 age 1147 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript;charset=UTF-8 status 200 x-amz-meta-qc-ineu True x-amz-cf-pop FRA53-C1 x-amz-cf-id zxT9Iy4gNsWpnJk_kHmcBp8gD6iUa6SRnDMLFGVC5UxrdhtSAIMzPQ== via 1.1 1cc446ef4692d8e752b16c07f2f58a59.cloudfront.net (CloudFront)
GET H2	200	20x20-printer.png www.bleepstatic.com/images/site/	422 B 710 B	35ms 34ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/20x20-printer.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 683625 cf-polished origFmt=png, origSize=824 status 200 content-disposition inline; filename="20x20-printer.webp" cf-bgj imgq:85 content-length 422 last-modified Sat, 03 Oct 2015 03:18:32 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a2949168cedc3b-LHR expires Fri, 17 Apr 2020 19:33:20 GMT
GET H2	200	calendar.png www.bleepstatic.com/images/site/	86 B 250 B	35ms 34ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/calendar.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 687625 cf-polished origFmt=png, origSize=129 status 200 content-disposition inline; filename="calendar.webp" cf-bgj imgq:85 content-length 86 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a2949168d0dc3b-LHR expires Fri, 17 Apr 2020 18:26:40 GMT
GET H2	200	clock.png www.bleepstatic.com/images/site/	252 B 522 B	34ms 34ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/clock.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 82c7fdbc4d001907e1e5d56cd335af3f0d48e0ffa7f0ad2aa3486ebb1123cb21 Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 687072 cf-polished origFmt=png, origSize=1316 status 200 content-disposition inline; filename="clock.webp" cf-bgj imgq:85 content-length 252 last-modified Fri, 29 May 2015 07:08:14 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a2949168d2dc3b-LHR expires Fri, 17 Apr 2020 18:35:53 GMT
GET H2	200	comment-light.png www.bleepstatic.com/images/site/	96 B 264 B	35ms 34ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/comment-light.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bfc8e65089dc5421d56ecc71a0328eafd4feb2a602503ae5c15bfa3189c02f7e Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 683407 cf-polished origFmt=png, origSize=1034 status 200 content-disposition inline; filename="comment-light.webp" cf-bgj imgq:85 content-length 96 last-modified Fri, 29 May 2015 07:08:28 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a2949168d3dc3b-LHR expires Fri, 17 Apr 2020 19:36:57 GMT
GET H2	200	32x32-printer.png www.bleepstatic.com/images/site/	256 B 425 B	35ms 35ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/32x32-printer.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 686379 cf-polished origFmt=png, origSize=618 status 200 content-disposition inline; filename="32x32-printer.webp" cf-bgj imgq:85 content-length 256 last-modified Fri, 02 Oct 2015 21:57:19 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a2949168d6dc3b-LHR expires Fri, 17 Apr 2020 18:47:26 GMT
GET H2	200	21beb902b545b086a90ec39f1df36b94.jpg www.bleepstatic.com/author/photos/	7 KB 8 KB	41ms 40ms	Image image/jpeg	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/author/photos/21beb902b545b086a90ec39f1df36b94.jpg Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19e1dbba639ba68ceb71cdada9621e11d0aec6edba410971f1937d6cc4935b32 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 6655 cf-polished origSize=7617, status=webp_bigger status 200 cf-bgj imgq:85 content-length 7581 last-modified Mon, 26 Oct 2015 17:15:33 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a2949168d7dc3b-LHR expires Sun, 17 Mar 2019 04:29:34 GMT
GET H2	200	KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	9ms 8ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:21:18 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:52 GMT server sffe age 1865147 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11180 x-xss-protection 0 expires Fri, 05 Mar 2021 03:21:18 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1865666 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	h4-bg.png www.bleepstatic.com/images/site/	38 B 285 B	29ms 29ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/h4-bg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 686919 cf-polished origFmt=png, origSize=72 status 200 content-disposition inline; filename="h4-bg.webp" cf-bgj imgq:85 content-length 38 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a2949168d8dc3b-LHR expires Fri, 17 Apr 2020 18:38:25 GMT
GET H2	200	news_email_icon.png www.bleepstatic.com/images/site/	126 B 438 B	29ms 29ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/news_email_icon.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a Request headers Referer https://www.bleepstatic.com/css/redesign/home.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 681642 cf-polished origFmt=png, origSize=1105 status 200 content-disposition inline; filename="news_email_icon.webp" cf-bgj imgq:85 content-length 126 last-modified Fri, 29 May 2015 07:10:12 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a2949168dadc3b-LHR expires Fri, 17 Apr 2020 20:06:23 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	44 KB 18 KB	8ms 8ms	Script text/javascript	2a00:1450:4001:817::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Thu, 06 Feb 2020 00:21:02 GMT server Golfe2 age 2910 date Thu, 26 Mar 2020 16:38:35 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 18174 expires Thu, 26 Mar 2020 18:38:35 GMT
GET H2	200	news_footer_icon.png www.bleepstatic.com/images/site/	110 B 266 B	24ms 23ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/news_footer_icon.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 686935 cf-polished origFmt=png, origSize=186 status 200 content-disposition inline; filename="news_footer_icon.webp" cf-bgj imgq:85 content-length 110 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a294918948dc3b-LHR expires Fri, 17 Apr 2020 18:38:10 GMT
GET H2	200	integrator.js Show response adservice.google.de/adsid/	109 B 171 B	28ms 28ms	Script application/javascript	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.bleepingcomputer.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript; charset=UTF-8 server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 104 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	109 B 171 B	15ms 15ms	Script application/javascript	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript; charset=UTF-8 server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 104 x-xss-protection 0
GET H2	200	show_ads_impl_fy2019.js Show response pagead2.googlesyndication.com/pagead/js/r20200319/r20190131/	224 KB 84 KB	32ms 31ms	Script text/javascript	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20200319/r20190131/show_ads_impl_fy2019.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 1fea51227a0d0a882dcf26ad5791bdf3bbb79958e076630e86427a8266300a2a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 85515 x-xss-protection 0 server cafe etag 13950792502640807200 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=1209600 timing-allow-origin * expires Thu, 26 Mar 2020 17:27:05 GMT
GET H2	200	zrt_lookup.html googleads.g.doubleclick.net/pagead/html/r20200319/r20190131/ Frame DCA6	0 0	6ms 6ms	Document text/html	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/html/r20200319/r20190131/zrt_lookup.html Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/html/r20200319/r20190131/zrt_lookup.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * vary Accept-Encoding date Sat, 21 Mar 2020 14:49:24 GMT expires Sat, 04 Apr 2020 14:49:24 GMT content-type text/html; charset=UTF-8 etag 17714563530871986051 x-content-type-options nosniff content-encoding gzip server cafe content-length 4497 x-xss-protection 0 cache-control public, max-age=1209600 age 441461 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
GET H2	200	292x176_HPEDrives.png www.bleepstatic.com/content/posts/2020/03/24/thumb/	66 KB 67 KB	65ms 64ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/posts/2020/03/24/thumb/292x176_HPEDrives.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 35d66691f7a14594746c42c7ba82ffdd41b07a8508656195d6e1a956023a44a1 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 115499 cf-polished origFmt=png, origSize=106329 status 200 content-disposition inline; filename="292x176_HPEDrives.webp" cf-bgj imgq:85 content-length 68014 last-modified Tue, 24 Mar 2020 22:14:24 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a294923b2adc3b-LHR expires Fri, 24 Apr 2020 09:22:06 GMT
GET H2	200	292x176_Windows-Update.jpg www.bleepstatic.com/content/hl-images/2017/04/06/thumb/	4 KB 4 KB	64ms 64ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2017/04/06/thumb/292x176_Windows-Update.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9e1645236a3a45146c3498b755cfd559d3f866cddcdaa605c948b6864c9501c9 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 81449 cf-polished qual=85, origFmt=jpeg, origSize=4080 status 200 content-disposition inline; filename="292x176_Windows-Update.webp" cf-bgj imgq:85 content-length 3604 last-modified Thu, 06 Apr 2017 10:23:15 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a294923b2edc3b-LHR expires Fri, 24 Apr 2020 18:49:36 GMT
GET H2	200	jquery.fancybox.css www.bleepstatic.com/js/redesign/fancybox/	4 KB 1 KB	62ms 61ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT age 187 cf-polished origSize=4895 status 200 cf-bgj minify last-modified Wed, 14 Oct 2015 20:25:51 GMT server cloudflare etag W/"9108074" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a294923b30dc3b-LHR expires Tue, 03 Mar 2020 05:01:55 GMT
GET H2	200	font-awesome.css www.bleepstatic.com/css/redesign/	22 KB 5 KB	63ms 63ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/font-awesome.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status HIT age 515 cf-polished origSize=26776 status 200 cf-bgj minify last-modified Tue, 03 May 2016 04:39:29 GMT server cloudflare etag W/"1700274315" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 57a294923b33dc3b-LHR expires Thu, 07 Nov 2019 07:15:15 GMT
GET H2	200	collect www.google-analytics.com/r/	35 B 101 B	14ms 14ms	Image image/gif	2a00:1450:4001:817::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/r/collect?v=1&_v=j81&a=13275579&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&ul=en-us&de=UTF-8&dt=Emotet%20Gets%20Ready%20for%20Tax%20Season%20With%20Malicious%20W-9%20Forms&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=1942130818&gjid=1822608958&cid=1642485379.1585243625&tid=UA-91740-1&_gid=1019027545.1585243625&_r=1&gtm=2ou3i0&z=2134344573 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:05 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 access-control-allow-origin * content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	favicon.ico ad.doubleclick.net/	1 KB 477 B	173ms 54ms	Image image/x-icon	216.58.207.38 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.207.38 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s24-in-f6.1e100.net Software sffe / Resource Hash d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 06:19:05 GMT content-encoding gzip x-content-type-options nosniff age 40080 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 104 x-xss-protection 0 last-modified Tue, 08 May 2012 13:08:06 GMT server sffe vary Accept-Encoding content-type image/x-icon access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes expires Fri, 27 Mar 2020 06:19:05 GMT
GET H2	200	cmp-3pc-check.html static.quantcast.mgr.consensu.org/v32/ Frame ECED	0 0	60ms 36ms	Document text/html	2600:9000:214f:6600:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.quantcast.mgr.consensu.org/v32/cmp-3pc-check.html Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:214f:6600:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers :method GET :authority static.quantcast.mgr.consensu.org :scheme https :path /v32/cmp-3pc-check.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 content-type text/html content-length 645 last-modified Tue, 24 Mar 2020 19:10:15 GMT x-amz-server-side-encryption AES256 accept-ranges bytes server AmazonS3 date Thu, 26 Mar 2020 17:16:20 GMT etag "55b98270d639ef0c34781d9f03cce91f" x-cache Hit from cloudfront via 1.1 850ccace60916919bf31313cb9176e01.cloudfront.net (CloudFront) x-amz-cf-pop FRA53-C1 x-amz-cf-id aTOSxp9B0vBHQcN-Hc1gzkS_x7SuuBbNW6AwUDP0g_BeQ_wJnXALHw== age 728
GET H2	200	moatframe.js Show response z.moatads.com/addthismoatframe568911941483/	2 KB 1 KB	93ms 29ms	Script application/x-javascript	95.101.185.246 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/addthismoatframe568911941483/moatframe.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.185.246 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-185-246.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding gzip last-modified Fri, 08 Nov 2019 20:13:52 GMT server AmazonS3 x-amz-request-id 3DA20F33DFB043F4 etag "f14b4e1f799b14f798a195f43cf58376" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=12367 accept-ranges bytes content-length 948 x-amz-id-2 g7+QTkfgFpKXdjIV1ns3PedgNVHG4mi9TLupYfjziOmGieTRD5DTu0V21U3C4oqBbTG5njMGxL0=
GET H2	200	_ate.track.config_resp Show response v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/	2 KB 855 B	239ms 239ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/_ate.track.config_resp Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software / Resource Hash 6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding gzip etag -1659864586--gzip vary Accept-Encoding content-type application/javascript;charset=utf-8 status 200 cache-control public, max-age=51, s-maxage=86400 content-disposition attachment; filename=1.txt content-length 678
GET H/1.1	200 OK	cookie Show response d.pub.network/	36 B 472 B	3286ms 2551ms	XHR text/plain	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/cookie Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash 07f61de7c6cddd4b0148af4491f264315b68ee3017be3885667004dcd4e676ef Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 17:27:06 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H2	200	gpt.js Show response www.googletagservices.com/tag/js/	43 KB 14 KB	42ms 42ms	Script text/javascript	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 989e0f1e493bc96574d606d07c5ea20db5536e20a091f0237f7e4d8a71915f1a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "467 / 520 of 1000 / last-modified: 1585081375" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 14458 x-xss-protection 0 expires Thu, 26 Mar 2020 17:27:05 GMT
GET H/1.1	200 OK	gallery.js Show response freestar-io.videoplayerhub.com/	101 KB 26 KB	166ms 38ms	Script application/javascript	99.84.155.31 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://freestar-io.videoplayerhub.com/gallery.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.84.155.31 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-84-155-31.txl52.r.cloudfront.net Software AmazonS3 / Resource Hash ad4d57b8c2ac583a0b890f4bd88990ecbe76a7e1463f2508dd7cde85fa55aad9 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-amz-version-id HyfDQPRwTVUvKVqE3e.nnmfw7fIrXN8d Content-Encoding gzip Last-Modified Tue, 24 Mar 2020 16:08:09 GMT Server AmazonS3 Age 84 Date Thu, 26 Mar 2020 17:26:14 GMT Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/javascript Via 1.1 fa133af2508a341e1ff6bfff526ba095.cloudfront.net (CloudFront) Transfer-Encoding chunked X-Amz-Cf-Pop TXL52-C1 Connection keep-alive X-Amz-Cf-Id sxPfHCPQBXvm0PSaeKFORrTsVlXpHhZ2EwuZxmCR0umEL--eg2cEWA==
GET H2	200	prebid-analytics-3.6.2.js Show response a.pub.network/core/	350 KB 106 KB	211ms 211ms	Script text/html	2606:4700:20::681a:18b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://a.pub.network/core/prebid-analytics-3.6.2.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8bfc61f56cf987bfbf5e1c86e6746d24c7dcd6ad98806dfca9d63c6110810582 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding br cf-cache-status BYPASS status 200 x-guploader-uploadid AEnB2Uo--pAZWWqieH4DeqYHwIJ5FSZX5QZr0y23aq3OSqI8VLZHQbqfthoPEZ4-sPu_uaRtCeYb3J5eG9fWOdCVo7lQV0sU2Q x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 3 x-goog-stored-content-encoding identity last-modified Fri, 28 Feb 2020 20:11:08 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=zs10DQ==, md5=a/aOr3cetk5W0I0PmuPrIQ== content-type text/html x-goog-generation 1582920668771105 cache-control private x-goog-stored-content-length 358240 cf-ray 57a294933fbf324c-FRA expires Fri, 26 Mar 2021 17:27:05 GMT
GET H/1.1	200 OK	location Show response d.pub.network/	49 B 496 B	551ms 114ms	XHR application/json	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/location Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash 50bd812525c0b8bd3d27581e8a46a0f1d0281bcdfdaae770eb8e3e3677e7e5cd Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 17:27:05 GMT Access-Control-Allow-Credentials true Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Transfer-Encoding chunked Content-Type application/json
GET H2	200	g Show response ck.connatix.com/	46 B 170 B	34ms 32ms	Script text/plain	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://ck.connatix.com/g?callback=cnxJSONP_80d9f136d78b8f009dac1585243625461 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash af9bb19e2076236beebf1db847b580214f68312f46b235a3ebec602ce04e8c8f Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT via 1.1 varnish server Varnish age 0 x-cache HIT status 200 cache-control no-cache, no-store, must-revalidate, max-age=0 x-cache-hits 0 accept-ranges bytes x-timer S1585243625.477911,VS0,VE0 content-length 46 retry-after 0 x-served-by cache-fra19123-FRA
GET H2	200	cmpui-popup.js Show response static.quantcast.mgr.consensu.org/v32/	266 KB 75 KB	25ms 25ms	Script text/javascript	2600:9000:214f:6600:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.quantcast.mgr.consensu.org/v32/cmpui-popup.js Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:214f:6600:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 10e73f57ed1405cdfe501a57b808fe434d5c073966be89bd7cc917e485c8bda6 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:18:49 GMT content-encoding gzip last-modified Tue, 24 Mar 2020 19:10:15 GMT server AmazonS3 age 998 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript;charset=UTF-8 status 200 x-amz-cf-pop FRA53-C1 x-amz-cf-id VGYJibjIkmk9qQuz07dcPKPK1-OxVUkavxPNetwflLedg8Fu8qAWvQ== via 1.1 850ccace60916919bf31313cb9176e01.cloudfront.net (CloudFront)
GET H2	200	fontawesome-webfont.woff www.bleepstatic.com/fonts/	64 KB 64 KB	67ms 25ms	Font application/octet-stream	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/fonts/fontawesome-webfont.woff?v=4.2.0 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200319/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1 Request headers Referer https://www.bleepstatic.com/css/redesign/font-awesome.css Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT last-modified Thu, 23 Apr 2015 09:36:00 GMT server cloudflare age 126 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/octet-stream status 200 accept-ranges bytes cf-ray 57a29493abbfdbe3-LHR access-control-allow-origin * content-length 65452
GET H2	200	pubads_impl_2020030501.js Show response securepubads.g.doubleclick.net/gpt/	165 KB 60 KB	196ms 71ms	Script text/javascript	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065761 Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software sffe / Resource Hash 8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 05 Mar 2020 14:08:10 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 61481 x-xss-protection 0 expires Thu, 26 Mar 2020 17:27:05 GMT
GET H2	200	pls Show response core.connatix.com/ Frame 277D	5 KB 3 KB	297ms 103ms	Script text/plain	34.196.219.220 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://core.connatix.com/pls?callback=jQuery32104835537099287113_1585243625459&token=83c6e833-8c07-474c-b10f-079d46320a80&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&c_v=1911_1_0_0_0&page_guid=e4473130fe6eb4effa8b1585243625522&spp=1&_=1585243625460 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.196.219.220 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-196-219-220.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash bd389ac9529bdadd341f055ce4058a81590205175e1b3a03e7b42a25fb51cee4 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers status 200 date Thu, 26 Mar 2020 17:27:05 GMT content-encoding gzip server nginx/1.15.9 (Ubuntu) access-control-allow-origin *
GET H2	200	vendorlist.json Show response vendorlist.consensu.org/	95 KB 18 KB	102ms 42ms	XHR application/json	2600:9000:214f:3600:1:af78:4c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vendorlist.consensu.org/vendorlist.json Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:214f:3600:1:af78:4c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 1f71cda9ecc5006fb453c9761058c0828d30d4a7f891283718da1b545ab2afb1 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 16:13:24 GMT content-encoding gzip vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method age 4422 x-cache Hit from cloudfront status 200 access-control-allow-origin * last-modified Thu, 26 Mar 2020 16:00:32 GMT server AmazonS3 access-control-max-age 604800 access-control-allow-methods GET x-amz-version-id EUWGyjsu5r7VdMzn2Ehby5QynGejxuEd via 1.1 73f3a23156999272233949c078c30859.cloudfront.net (CloudFront) cache-control max-age=604800 x-amz-cf-pop FRA53-C1 content-type application/json; charset=utf-8 x-amz-cf-id tlBxltEjlqmZc35vtIM9stA4d5DmySUb3lLv9cUceuQgfq7IDA2VbA==
GET H2	200	layers.ab5cd98fe1b9a38a4a9f.js Show response s7.addthis.com/static/	263 KB 76 KB	44ms 43ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Wed, 18 Sep 2019 14:16:17 GMT server nginx/1.15.8 etag W/"5d823c31-41b9f" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=86313600 date Thu, 26 Mar 2020 17:27:05 GMT x-host s7.addthis.com timing-allow-origin * content-length 77528
GET H2	404	CookieAccess Show response api.quantcast.mgr.consensu.org/	30 B 597 B	219ms 141ms	XHR application/json	143.204.202.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.quantcast.mgr.consensu.org/CookieAccess Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.94 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-94.fra53.r.cloudfront.net Software / Resource Hash 5a4061ff8312e2ad494bd984b7df966438232be64a3b284ab69f66c6705009a6 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:05 GMT content-encoding gzip x-amz-cf-pop FRA53-C1 x-amzn-requestid 4c450547-b3af-4ed3-86a4-fa4f9a36bf6c x-cache Error from cloudfront status 404 x-amz-apigw-id KAjciEpQIAMFuSA= content-length 50 access-control-allow-origin https://www.bleepingcomputer.com x-amzn-trace-id Root=1-5e7ce5e9-fd9b47725dc6735e628855f6;Sampled=0 vary Origin access-control-allow-methods GET, POST content-type application/json via 1.1 a3c2566f9e36ad3cdf79fc6307fcf567.cloudfront.net (CloudFront) cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-headers Content-Type x-amz-cf-id XkRoYpsv-UElUaqD7fzdjdBWNfsNxTQYcjOhLBbYiTEbEH7wehoOlA==
GET H2	200	beacon.js Show response ad-delivery.net/	1 KB 987 B	121ms 41ms	Script application/x-javascript	99.84.155.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ad-delivery.net/beacon.js Requested by Host: freestar-io.videoplayerhub.com URL: https://freestar-io.videoplayerhub.com/gallery.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.84.155.39 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-84-155-39.txl52.r.cloudfront.net Software AmazonS3 / Resource Hash 7e94fbebf526effec4239c82e5435a412d81ffc4bc9bddf13f9aa1170f6d803e Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-amz-version-id null content-encoding gzip last-modified Tue, 31 Jan 2017 15:06:54 GMT server AmazonS3 age 2207 date Thu, 26 Mar 2020 16:50:19 GMT vary Accept-Encoding x-cache Hit from cloudfront content-type application/x-javascript status 200 cache-control max-age=3600 x-amz-cf-pop TXL52-C1 x-amz-cf-id 9eigAKBL1GUnUTRcr3ocQR4AYj8s2LFef0cxYFiCWRDawNUT2LThLg== via 1.1 aec69d2871c7aeb74988020f07480fa4.cloudfront.net (CloudFront)
GET H2	200	apstag.js Show response c.amazon-adsystem.com/aax2/	87 KB 25 KB	124ms 47ms	Script application/javascript	99.86.0.120 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/aax2/apstag.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-0-120.fra6.r.cloudfront.net Software Server / Resource Hash ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 25 Mar 2020 22:00:55 GMT content-encoding gzip server Server age 69970 etag 1dcfbf3986ee8b9c3abbc67eb808ab43 x-cache Hit from cloudfront content-type application/javascript status 200 cache-control public, max-age=86400 x-amz-cf-pop FRA6-C1 accept-ranges bytes x-amz-cf-id -u2P1yTMVqKcjhubXmHDiwpaVuDofuZ2V01MkevZbD9jhPMXAXHe-A== via 1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront)
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/	89 KB 19 KB	98ms 31ms	Script text/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash cd03bf876378b7033176ad70eba1d47654f1c780ad6b7a2191e3c08b2f7bb9e2 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 26 Mar 2020 17:27:05 GMT Content-Encoding gzip Age 2846 X-Cache HIT Connection keep-alive Content-Length 19040 x-amz-id-2 eV+F825ZXJP6NAiaUTBKJmsoTkQxzqP11NlcYS/qneAZhJ0VOdVaa4rW9zzhl/iJauCTmvH0/3Q= X-Served-By cache-fra19169-FRA Last-Modified Thu, 26 Mar 2020 16:28:55 GMT Server AmazonS3 X-Timer S1585243626.886174,VS0,VE0 ETag "ed3a9918f5b89d6bb7423cfe2f3eb679" x-amz-request-id 5ABE7F43213FBF7F Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 85
GET H/1.1	200 OK	v2 Show response d.pub.network/floors/	2 KB 2 KB	2184ms 1836ms	XHR application/json	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/floors/v2?key=535desktop Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash de653a4c0ef4db4ea4b8febf435c02768c3c525bbe1edf20d4db4c068904693a Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 17:27:06 GMT Access-Control-Allow-Credentials true Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Transfer-Encoding chunked Content-Type application/json
GET DATA	200 OK	truncated /	175 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	715 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	g Show response rtb.connatix.com/	130 B 324 B	412ms 125ms	Script text/plain	54.209.155.90 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=469&c_tk=414C33DE-F293-46CF-ABF8-135274D262E2&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&c_ivt=0&connatix_sess=pima91vDScrJ_ikU7rpJhf2Ic5dU3ylXdQZ_xxANXoPtjJkMVeR-VlG52oAbbreQ7ffM8OlugGt844LQ9MjyHmtCLi-vOHnEj19KkjzDLYYD6dryfc2zY-duS4iAiJOuWNSXx3q-K0Bv27l3fiqsGVH5q6A_0aWNKan4ftN4qN_cnrXNKhxXfPfJZhgbtmu5&notServed=false&xplr=false&c_s=false&c_pl=fyS7nQVgxcJD7m3lYQqhh8c2jxEvsODB0fiEaos8_LvId82kFxGtAjn8DUAel-RKN1OvdvVDH1-1dlEvqXNxXZajymLVe6Ha056yKEACzZ9xfKWKBQGSVbGd5Qlh7No1-mtNCJrVCtvy3dHB7a2XDig8unn44d_roBv6eeTaUuJUKF4rp-U-d_T9rgit8zoJCnYyeUa4hR5AoAg8cK6v4DgN3mW4-jwU8PzsxYYnjOupvahIxoLyIjoQk51Vc--W3DXqnmmnOuLbHzN0XUdtUg&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=0&v=1&c_pt=1&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-f&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_cf2670445ef87dce13f71585243625871 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.209.155.90 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-209-155-90.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash d3c6502fb81d2ab6e30ded271a9582c55cb64281002cff30205b0faafd53ea49 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Thu, 26 Mar 2020 17:27:06 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 136
GET H2	200	426.jpg i.connatix.com/s3/connatix-uploads/af391ba1-47b0-4ff1-87cb-08a6df11845f/	30 KB 30 KB	45ms 43ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/af391ba1-47b0-4ff1-87cb-08a6df11845f/426.jpg?mode=stretch&connatiximg=true&scale=both&height=469&width=834 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1f1772d674817c27fc3c9e552fbe73172d7116cb3d80ecd46d1dc14f765ecf8f Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT via 1.1 varnish, 1.1 varnish age 52012 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 4, 1 accept-ranges bytes x-timer S1585243626.888438,VS0,VE1 access-control-allow-origin * content-length 30917 x-served-by cache-sjc10041-SJC, cache-fra19123-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/8a5a24be-fc62-47f3-a6fd-2e5f17ef8f7e/	37 KB 37 KB	44ms 42ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/8a5a24be-fc62-47f3-a6fd-2e5f17ef8f7e/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash f4e812683b1e73a9facd0cbdba2f3d7429924d301695896b76c21143fdfa3ee8 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT via 1.1 varnish, 1.1 varnish age 52012 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 2, 1 accept-ranges bytes x-timer S1585243626.888466,VS0,VE1 access-control-allow-origin * content-length 38201 x-served-by cache-sjc10025-SJC, cache-fra19123-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/ab35f508-7fc3-42ab-98b0-a0f84b0f9919/	95 KB 96 KB	44ms 43ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/ab35f508-7fc3-42ab-98b0-a0f84b0f9919/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 3d0d5682c4800b9b9da7bc15c66d9a7383a32308d034664fd3f9f3eae3483dad Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT via 1.1 varnish, 1.1 varnish age 52011 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 3, 1 accept-ranges bytes x-timer S1585243626.888425,VS0,VE1 access-control-allow-origin * content-length 97654 x-served-by cache-sjc10024-SJC, cache-fra19123-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/d27100ae-c776-4356-abc5-6a6bea1601b3/	17 KB 17 KB	44ms 42ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/d27100ae-c776-4356-abc5-6a6bea1601b3/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8258ab6dca6e481db10703021930ca8b0e484c50213ea4c42f8f01fd64e3e57d Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT via 1.1 varnish, 1.1 varnish age 52011 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 2, 1 accept-ranges bytes x-timer S1585243626.888404,VS0,VE1 access-control-allow-origin * content-length 17157 x-served-by cache-sjc10020-SJC, cache-fra19123-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/f5dec755-0f1b-4c0c-9974-f28594758ffd/	39 KB 39 KB	37ms 35ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/f5dec755-0f1b-4c0c-9974-f28594758ffd/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 0c6e8fed85b8d4eacd6452e9180bcfce8c63b219a0b792ddf28608362dbebdf6 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT via 1.1 varnish, 1.1 varnish age 52011 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 3, 1 accept-ranges bytes x-timer S1585243626.888421,VS0,VE1 access-control-allow-origin * content-length 40194 x-served-by cache-sjc10031-SJC, cache-fra19123-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/c50e0049-2ba1-4cb6-82c7-7ed0da779ae4/	64 KB 65 KB	44ms 43ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/c50e0049-2ba1-4cb6-82c7-7ed0da779ae4/1.jpg?mode=crop&width=1001&height=563 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 9af35b772f64c1cd435f5bf4ba413fca2c2c65cd57cf4a66fe5412732a16a89a Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT via 1.1 varnish, 1.1 varnish age 52012 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 2, 1 accept-ranges bytes x-timer S1585243626.888384,VS0,VE1 access-control-allow-origin * content-length 65958 x-served-by cache-sjc10038-SJC, cache-fra19123-FRA
GET H2	200	bleeping-computerlogo-lg.png www.bleepstatic.com/logos/	7 KB 7 KB	23ms 22ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/logos/bleeping-computerlogo-lg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a56e644a617b2d1e4e7d808dfc334a7ea8622979f22999dc9eccd21c61958b3 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT cf-cache-status HIT age 686969 cf-polished origFmt=png, origSize=15281 status 200 content-disposition inline; filename="bleeping-computerlogo-lg.webp" cf-bgj imgq:85 content-length 7156 last-modified Wed, 07 Jan 2015 22:52:15 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 57a29495bd33dc3b-LHR expires Fri, 17 Apr 2020 18:37:36 GMT
GET H2	200	0_th_1.jpg i.connatix.com/s3/connatix-videos/af391ba1-47b0-4ff1-87cb-08a6df11845f/ Frame 277D	23 KB 23 KB	41ms 41ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-videos/af391ba1-47b0-4ff1-87cb-08a6df11845f/0_th_1.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c3034d0370c5faa09e7a8d7b0c48925afa0371cf17e4827dde23059f56019dae Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 26 Mar 2020 17:27:05 GMT via 1.1 varnish, 1.1 varnish age 24392662 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 1 accept-ranges bytes x-timer S1585243626.927020,VS0,VE1 access-control-allow-origin * content-length 23507 x-served-by cache-sjc3144-SJC, cache-fra19123-FRA
GET H/1.1	200 OK	p2 sb.scorecardresearch.com/ Frame 277D Redirect Chain https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585243625888&ns_st_ec=1&ns_st_sp=1&ns... https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585243625888&ns_st_ec=1&ns_st_sp=1&n...	43 B 309 B	29ms 28ms	Image image/gif	23.11.238.95 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585243625888&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1585243625889&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&c8=&c9=&cs_ucfr=0 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.11.238.95 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-11-238-95.deploy.static.akamaitechnologies.com Software / Resource Hash 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:05 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Expires Mon, 01 Jan 1990 00:00:00 GMT Connection keep-alive Content-Length 43 Content-Type image/gif Redirect headers Location https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585243625888&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1585243625889&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&c8=&c9=&cs_ucfr=0 Pragma no-cache Date Thu, 26 Mar 2020 17:27:05 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	g Show response rtb.connatix.com/	91 B 293 B	385ms 97ms	Script text/plain	54.209.155.90 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=470&c_tk=414C33DE-F293-46CF-ABF8-135274D262E2&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&c_ivt=0&connatix_sess=pima91vDScrJ_ikU7rpJhf2Ic5dU3ylXdQZ_xxANXoPtjJkMVeR-VlG52oAbbreQ7ffM8OlugGt844LQ9MjyHmtCLi-vOHnEj19KkjzDLYYD6dryfc2zY-duS4iAiJOuWNSXx3q-K0Bv27l3fiqsGVH5q6A_0aWNKan4ftN4qN_cnrXNKhxXfPfJZhgbtmu5&notServed=false&xplr=false&c_s=false&c_pl=fyS7nQVgxcJD7m3lYQqhh8c2jxEvsODB0fiEaos8_LvId82kFxGtAjn8DUAel-RKN1OvdvVDH1-1dlEvqXNxXZajymLVe6Ha056yKEACzZ9xfKWKBQGSVbGd5Qlh7No1-mtNCJrVCtvy3dHB7a2XDig8unn44d_roBv6eeTaUuJUKF4rp-U-d_T9rgit8zoJCnYyeUa4hR5AoAg8cK6v4DgN3mW4-jwU8PzsxYYnjOupvahIxoLyIjoQk51Vc--W3DXqnmmnOuLbHzN0XUdtUg&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=1&v=2&c_pt=1&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-f&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_e65abebf8ac9b7516a5a1585243625891 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.209.155.90 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-209-155-90.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash 07876c312ef2235a7ff7aa6680fec54472e32e209510178b673799c2b415847d Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Thu, 26 Mar 2020 17:27:06 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 105
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 87562d3773ffab3d0716a70faa73c38b322fde3b8f265c3d646a3cea976ef67e Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	r trk.connatix.com/ Frame 277D	0 162 B	411ms 100ms	Image text/plain	52.3.183.77 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://trk.connatix.com/r?connatix_sess=pima91vDScrJ_ikU7rpJhf2Ic5dU3ylXdQZ_xxANXoPtjJkMVeR-VlG52oAbbreQ7ffM8OlugGt844LQ9MjyHmtCLi-vOHnEj19KkjzDLYYD6dryfc2zY-duS4iAiJOuWNSXx3q-K0Bv27l3fiqsGVH5q6A_0aWNKan4ftN4qN_cnrXNKhxXfPfJZhgbtmu5&videoID=639404&c_pl=fyS7nQVgxcJD7m3lYQqhh8c2jxEvsODB0fiEaos8_LvId82kFxGtAjn8DUAel-RKN1OvdvVDH1-1dlEvqXNxXZajymLVe6Ha056yKEACzZ9xfKWKBQGSVbGd5Qlh7No1-mtNCJrVCtvy3dHB7a2XDig8unn44d_roBv6eeTaUuJUKF4rp-U-d_T9rgit8zoJCnYyeUa4hR5AoAg8cK6v4DgN3mW4-jwU8PzsxYYnjOupvahIxoLyIjoQk51Vc--W3DXqnmmnOuLbHzN0XUdtUg&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-f&c_v=1911_1_0_0_0&spp=1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.3.183.77 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-3-183-77.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Access-Control-Allow-Origin * Date Thu, 26 Mar 2020 17:27:06 GMT Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 0
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gpt/202003251303/	106 KB 36 KB	32ms 31ms	Script application/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gpt/202003251303/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 563e810f9f335949b38eb56ca70a8b7e17d4bc5e4a897883e945260f929a086f Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 26 Mar 2020 17:27:05 GMT Content-Encoding gzip Age 448 X-Cache HIT Connection keep-alive Content-Length 36363 x-amz-id-2 VnN1SNOYsVs92+0IzHs6Lgtrwjfxav1EwahlKGmdhRvBdVzr20jF/cOsW54DbI+/Mmw3DaIicJc= X-Served-By cache-fra19169-FRA Last-Modified Wed, 25 Mar 2020 19:34:39 GMT Server AmazonS3 X-Timer S1585243626.942719,VS0,VE0 ETag "a7a4d991ef5cb3b6afa336418179b5b1" x-amz-request-id 2D6FCBC0DCEC9A68 Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 561
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/prebid/202003251304/	33 KB 13 KB	75ms 32ms	Script application/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/prebid/202003251304/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 44cf43205b3b0b693b2696606c8b06f28da542a23a10ff3cd346ff529a7cd60c Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 26 Mar 2020 17:27:05 GMT Content-Encoding gzip Age 448 X-Cache HIT Connection keep-alive Content-Length 12471 x-amz-id-2 LowYjSOTvDSrWk7QQHe2tuFri2wPgOkkEC0Nm1Gg2VVfdMeDfZ+elruyAnTc5KqvrODyDfgS2Wo= X-Served-By cache-fra19169-FRA Last-Modified Wed, 25 Mar 2020 19:34:40 GMT Server AmazonS3 X-Timer S1585243626.989815,VS0,VE0 ETag "27c6e6819d441fd68b0821499dea8b13" x-amz-request-id B2D87ACED3229309 Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 549
GET H2	200	aps_csm.js Show response c.amazon-adsystem.com/bao-csm/aps-comm/	6 KB 3 KB	118ms 37ms	XHR application/javascript	99.86.0.120 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-0-120.fra6.r.cloudfront.net Software AmazonS3 / Resource Hash 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 02:05:17 GMT content-encoding gzip vary Origin age 55310 x-cache Hit from cloudfront status 200 access-control-allow-origin * last-modified Thu, 05 Mar 2020 08:28:46 GMT server AmazonS3 access-control-max-age 3000 access-control-allow-methods GET content-type application/javascript via 1.1 b8e900270aa30d899882e71796feca9c.cloudfront.net (CloudFront) cache-control public, max-age=86400 x-amz-cf-pop FRA6-C1 x-amz-cf-id Pxzg8H_s1WIyb_5zZ60JS6ihOIy3ScF61NuYsgbKU7oy9ED_wVpMkg==
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	88ms 88ms	XHR text/javascript	99.86.0.120 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&pid=9HtgzUz2PcKR6&cb=0&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_1%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-0-120.fra6.r.cloudfront.net Software Server / Resource Hash 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:06 GMT via 1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA6-C1 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id 1h9MqhW1xhiEZJu7HnJxLUFHE3ZrmrCSJGIJGGZPhqMQ4wtDTn2R4Q==
GET H2	200	ads googleads.g.doubleclick.net/pagead/ Frame 2914	0 0	133ms 133ms	Document text/html	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1580852370&plat=1%3A32776%2C2%3A16809992%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1585243625272&bpp=5&bdt=313&fdt=219&idt=219&shv=r20200319&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4877408007565&frm=20&pv=2&ga_vid=1642485379.1585243625&ga_sid=1585243626&ga_hid=13275579&ga_fc=0&iag=0&icsg=2286984229822464&dssz=55&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=3143284678310081&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&fsb=1&dtd=743 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200319/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1580852370&plat=1%3A32776%2C2%3A16809992%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1585243625272&bpp=5&bdt=313&fdt=219&idt=219&shv=r20200319&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4877408007565&frm=20&pv=2&ga_vid=1642485379.1585243625&ga_sid=1585243626&ga_hid=13275579&ga_fc=0&iag=0&icsg=2286984229822464&dssz=55&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=3143284678310081&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&fsb=1&dtd=743 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Thu, 26 Mar 2020 17:27:06 GMT server cafe content-length 34 x-xss-protection 0 set-cookie test_cookie=CheckForPermission; expires=Thu, 26-Mar-2020 17:42:06 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 expires Thu, 26 Mar 2020 17:27:06 GMT cache-control private
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/	74 KB 27 KB	44ms 43ms	Script text/javascript	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200319/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f2e60d0a77f1d63a9fd3b21fbb9d21345a61dc43d6c9b749e45753c5d993a6e8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:06 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1585165059237800" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28015 x-xss-protection 0 expires Thu, 26 Mar 2020 17:27:06 GMT
GET H2	200	/ Show response audit.quantcast.mgr.consensu.org/	80 B 487 B	89ms 28ms	XHR text/html	99.86.7.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://audit.quantcast.mgr.consensu.org/?log=;1585243626144;BleepingComputer.com;https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F;;;;;p,off,false,,1,en,32,195,true,false,false;displayConsentUi:mandatory,;GDPR-en4zzsk0e9wjbptpq6am Requested by Host: static.quantcast.mgr.consensu.org URL: https://static.quantcast.mgr.consensu.org/v32/cmpui-popup.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.86.7.44 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-7-44.fra6.r.cloudfront.net Software AmazonS3 / Resource Hash 2d0f6b590917e7d27ddeb026b280d62dde9d03bb92f47f56342fc5f68f0c24eb Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 02:06:35 GMT via 1.1 560d8d35213ac925f8d05c5730db1582.cloudfront.net (CloudFront) vary Origin age 55232 x-cache Hit from cloudfront status 200 content-length 80 last-modified Mon, 11 Jun 2018 22:07:34 GMT server AmazonS3 etag "0614149d8033903db5de46d6c184bbfd" access-control-max-age 3000 access-control-allow-methods GET content-type text/html access-control-allow-origin * x-amz-cf-pop FRA6-C1 accept-ranges bytes x-amz-cf-id -q8g8QB8wzR8Lfh7ouHqtNrFqQq3yXYZYA1FqU0FRUuezSTCoyxg-g==
GET H/1.1	200 OK	jquery.color-2.1.2.min.js Show response cluster-na.cdnjquery.com/color/	93 B 357 B	729ms 427ms	Script text/javascript	52.2.175.122 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://cluster-na.cdnjquery.com/color/jquery.color-2.1.2.min.js?integrity=btjsonpcallback1585243626190&checksum=%7B%22cbc%22%3A0%2C%22st%22%3A2%2C%22au%22%3A%5B%5D%2C%22hau%22%3A%5B%5D%2C%22ref%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F%22%2C%22aa%22%3A3%2C%22pgid%22%3A%2203641952-6f87-11ea-a569-2001b083256a%22%2C%22v%22%3A1%2C%22format%22%3A%22jsonp%22%7D&o=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&csVersion=1.21.48&clearThroughOptions=undefined Requested by Host: freestar-io.videoplayerhub.com URL: https://freestar-io.videoplayerhub.com/gallery.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.2.175.122 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-2-175-122.compute-1.amazonaws.com Software nginx/1.12.1 / Resource Hash 4d368d3cf70908e6dc669e879a1036d2fdc46721d566f21a62b53146abe5a6dd Security Headers Name Value X-Frame-Options DENY Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Thu, 26 Mar 2020 17:27:06 GMT Content-Encoding gzip Server nginx/1.12.1 ETag W/"5d-i9aDGIUCoG9Xx+QleQaJQftvCyE" X-Frame-Options DENY Content-Type text/javascript; charset=utf-8 Charset utf8 Connection keep-alive Content-Length 85
GET H2	200	px.gif ad-delivery.net/	43 B 386 B	39ms 39ms	Image image/gif	99.84.155.39 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ad-delivery.net/px.gif?ch=1&e=0.8767931973729493 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.84.155.39 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-84-155-39.txl52.r.cloudfront.net Software AmazonS3 / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers x-amz-version-id null via 1.1 aec69d2871c7aeb74988020f07480fa4.cloudfront.net (CloudFront) last-modified Thu, 27 Jul 2017 18:59:05 GMT server AmazonS3 age 16131 etag "ad4b0f606e0f8465bc4c4c170b37e1a3" x-cache Hit from cloudfront content-type image/gif status 200 date Thu, 26 Mar 2020 12:58:15 GMT x-amz-cf-pop TXL52-C1 accept-ranges bytes content-length 43 x-amz-cf-id 387RSAH7fULjhXneBqe547b-O-hw5mISNSVU12ILUgEcMaMzr_WlVg==
GET H2	200	48.008759e9efe1c1b693dd.js Show response s7.addthis.com/static/	281 B 486 B	36ms 36ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/static/48.008759e9efe1c1b693dd.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Wed, 18 Sep 2019 14:16:17 GMT server nginx/1.15.8 etag W/"5d823c31-119" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=86313600 date Thu, 26 Mar 2020 17:27:06 GMT x-host s7.addthis.com timing-allow-origin * content-length 246
GET H2	200	/ Show response graph.facebook.com/	307 B 413 B	149ms 133ms	Script text/javascript	2a03:2880:f02d:e:face:b00c:0:2 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://graph.facebook.com/?id=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_hjqw0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash df678a2cd2bf6454e615c9efea25a51a067b3e83b0a51f556780e6ea46a725f3 Security Headers Name Value Strict-Transport-Security max-age=15552000; preload Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15552000; preload content-encoding br x-app-usage {"call_count":0,"total_cputime":0,"total_time":0} status 200 date Thu, 26 Mar 2020 17:27:06 GMT, Thu, 26 Mar 2020 17:27:06 GMT x-fb-rev 1001901918 alt-svc h3-27=":443"; ma=3600 content-length 212 pragma no-cache x-fb-debug 0WMWEe4OadKutqhNPMQr2gtcj4/nlC7JGel2WRjUiLOL30AdLrXJW4zOXPXlUEg0PbVOxfzAHTuHWVlPaWuKwQ== x-fb-trace-id CYy/C1rX0eb etag "144ea7664d0090fff6babbc939f7445c2983e0c3" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * x-fb-request-id Ayx3CyD_05qFfvpdnaHeEs5 cache-control private, no-cache, no-store, must-revalidate facebook-api-version v2.12 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	info.json Show response www.reddit.com/api/	4 KB 2 KB	225ms 177ms	Script application/javascript	199.232.53.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.reddit.com/api/info.json?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&jsonp=_ate.cbs.rcb_btrl0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.53.140 Manchester, United Kingdom, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 90db292ff62e6bf3fa590c33c4ab323538545b72598cb770ad1673843fc140ec Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:06 GMT content-encoding gzip x-content-type-options nosniff via 1.1 varnish x-cache MISS status 200 x-cache-hits 0 strict-transport-security max-age=15552000; includeSubDomains; preload content-length 1706 x-xss-protection 1; mode=block x-served-by cache-man4120-MAN x-moose majestic server snooserv x-timer S1585243627.506769,VS0,VE153 x-frame-options SAMEORIGIN vary accept-encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers X-Moose cache-control private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate x-ua-compatible IE=edge accept-ranges bytes expires -1
GET H2	200	/ Show response graph.facebook.com/	145 B 602 B	57ms 44ms	Script text/javascript	2a03:2880:f02d:e:face:b00c:0:2 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://graph.facebook.com/?id=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_d7mq0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 6e88e8f7e3fc192bbfb66282d22a9c8db37aa159c4b6f71ecf159a66d3c4bd29 Security Headers Name Value Strict-Transport-Security max-age=15552000; preload Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15552000; preload x-app-usage {"call_count":0,"total_cputime":0,"total_time":0} status 200 date Thu, 26 Mar 2020 17:27:06 GMT, Thu, 26 Mar 2020 17:27:06 GMT x-fb-rev 1001901918 alt-svc h3-27=":443"; ma=3600 content-length 145 pragma no-cache x-fb-debug RNSsUDE7x82YlGQ4HjOONDjVsgWYs/bGJIgo9zLhT/keRkI5vkDUEq2jgMt9uoL4gQ40Np3Q+OlxoB4LtnqcTw== x-fb-trace-id DaNsGvOXsGs etag "fa4f90857d8ac08752a9cd736cd7bac982be5766" content-type text/javascript; charset=UTF-8 access-control-allow-origin * x-fb-request-id A8-u7VY0j1A61fMfjZGtwZ7 cache-control private, no-cache, no-store, must-revalidate facebook-api-version v2.12 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	info.json Show response www.reddit.com/api/	126 B 668 B	197ms 150ms	Script application/javascript	199.232.53.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.reddit.com/api/info.json?url=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&jsonp=_ate.cbs.rcb_4pq10 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.53.140 Manchester, United Kingdom, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 95c00a5e7adee951ad7a9766248522c843e9708cadac0cff59a606aea0c9b35a Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:06 GMT via 1.1 varnish x-content-type-options nosniff x-cache MISS status 200 x-cache-hits 0 strict-transport-security max-age=15552000; includeSubDomains; preload content-length 126 x-xss-protection 1; mode=block x-served-by cache-man4120-MAN x-moose majestic server snooserv x-timer S1585243627.506741,VS0,VE127 x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers X-Moose cache-control private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate x-ua-compatible IE=edge accept-ranges bytes expires -1
GET H2	200	sodar Show response pagead2.googlesyndication.com/getconfig/	7 KB 5 KB	20ms 20ms	XHR application/json	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200319&st=env Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200319/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash d082c9d282fb478b7f2d66adf81a7fd8834f0b6f5121d2763c65e7a64fa421bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Thu, 26 Mar 2020 17:27:06 GMT content-encoding gzip x-content-type-options nosniff server cafe status 200 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 5190 x-xss-protection 0
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	14 KB 5 KB	14ms 14ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200319/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:06 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1582746470043195" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 5456 x-xss-protection 0 expires Thu, 26 Mar 2020 17:27:06 GMT
GET H2	200	runner.html tpc.googlesyndication.com/sodar/sodar2/209/ Frame E4FB	0 0	6ms 6ms	Document text/html	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/209/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html content-length 5727 date Thu, 26 Mar 2020 17:00:55 GMT expires Fri, 26 Mar 2021 17:00:55 GMT last-modified Tue, 25 Feb 2020 17:32:01 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 1571 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
GET H2	204	gen_204 pagead2.googlesyndication.com/pagead/	0 49 B	18ms 17ms	Image image/gif	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200319&jk=3143284678310081&bg=!XV6lXkZY-q5rwEIcB98CAAAAMVIAAAAJmQFk25fDRA1H9TpCKdMF-gy1ui25QMPNvGvJBoS-nQpZSOS5MQFgMjKcXkFpXOHZEnzhD0sjlnWeczTGEEsKk7-0qU6x-0vLWXA8kWvp9YVatd7eeHW8pwXhkbR2zXMAqTX21dITrTHytwFudcE0w6nDUkj5CtbHgzZ8uzE0ONa1NuaHehrUDdGae5V5RZvtbcV4dU1vmENrstr4k1qM3JrB14-UHiSMxQ0HSqGHhXUf1y5e6tIX6Oc1jsdHiQPO7uHNnYotfU-qLIcE7fMbYe_0O9NbRvdgH-ePp9PJCYA6ZuKwOSl253DZ8FuKmlt1hDc65ssnB2O4regYwzXG-JMxtT8GUEbspwgJ7opVcqGuY5KB1YbwZevcXPcz2gdgeLLPhozdKKh-KczmLkKs8St6C6ky9ADvMJ2JQXQN_17yCLCpBVaXT0j2ywp8VhcJmlfGanHvBn_5g4nn4hMvrl62w0_XrGY Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:07 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 204 cache-control no-cache, must-revalidate timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET		arj freestar-d.openx.net/w/1.0/	0 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	717 B 1 KB	98ms 50ms	XHR application/json	185.33.223.215 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 6edb2aeddf46c3a84b75fc6e35a95bdd16730f60ea42679e82d5e02037d66977 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Thu, 26 Mar 2020 17:27:09 GMT Content-Encoding gzip Transfer-Encoding chunked P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Connection keep-alive X-Proxy-Origin 89.238.150.150; 89.238.150.150; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.177:80 X-XSS-Protection 0 Pragma no-cache AN-X-Request-Uuid e24261f6-3f04-4267-8233-2ec9b5eb104e Server nginx/1.13.4 Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	730 B 1 KB	96ms 47ms	XHR application/json	185.33.223.215 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 9ee7c850d8e10e17919cf9cad9be4f7ef5dea7e79c8efd5b21ac471170e23eb1 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Thu, 26 Mar 2020 17:27:09 GMT Content-Encoding gzip Transfer-Encoding chunked P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Connection keep-alive X-Proxy-Origin 89.238.150.150; 89.238.150.150; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.85:80 X-XSS-Protection 0 Pragma no-cache AN-X-Request-Uuid 25314b4e-10a4-41b1-ab26-021401cbaf1a Server nginx/1.13.4 Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	522 B 713 B	42ms 14ms	XHR application/json	2a02:fa8:8806:16::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 72e4e0af8af62feda7208142dc7a1858cb0d999df4ad9b4ed8c9800d90eceb5e Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:07 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 522 expires 0
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	306 B 798 B	147ms 42ms	XHR application/json	69.173.144.141 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=ec3ac28e-6e33-47b2-9961-3326fe8ea38c&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.3037638253140036 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash fdae7966c0d60e250895f35499acbfd368eedda0f03122ee2161f0c134074267 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:07 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=389 Content-Length 306 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	306 B 798 B	156ms 48ms	XHR application/json	69.173.144.141 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=7dc42de3-d4ec-4398-a378-5448dff3d03c&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.30874752807190253 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 392f629250186e8f5e1aa01ca645ecb567d927a97aca00a6abea04ee01031056 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:07 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=179 Content-Length 306 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	304 B 796 B	155ms 47ms	XHR application/json	69.173.144.141 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=5dedf4c2-322d-4f77-b761-43fa7eb0a597&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.27349069937572246 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash dd04864cfdd3d043a1e9164556dde52183ab353c154e1ab5f419e82128e9298d Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:07 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=319 Content-Length 304 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	304 B 796 B	154ms 44ms	XHR application/json	69.173.144.141 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=6b99d3e5-4977-4146-bc10-64cbd11efae2&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.13819434233641714 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 8939fb85b24f1cd9815f950e518cd558e68683fbcf92c61b8067bb97e50570e8 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:07 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=492 Content-Length 304 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	283 B 775 B	153ms 43ms	XHR application/json	69.173.144.141 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=b2ee0526-04e1-48e8-a616-de313c424860&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.8855239785376157 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 60f700d2923bb239a38965ae23a37f9c31b4956d7d9ab71f5899fc4170c9de89 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:07 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=111 Content-Length 283 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	304 B 796 B	156ms 44ms	XHR application/json	69.173.144.141 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=4d7a11cf-55f2-482b-9217-e87576304201&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.201914184904598 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash b940403e85e509fc9af4b0531c9ba04f65d9bf8d88cf3f184e1f3f5f8bea06e7 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:07 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=151 Content-Length 304 Expires Wed, 17 Sep 1975 21:32:10 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 483 B	440ms 377ms	XHR application/json	35.157.249.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.249.193 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-249-193.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:07 GMT status 200 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-type application/json; charset=utf-8 content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 32 B	1073ms 29ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Thu, 26 Mar 2020 17:27:08 GMT server cloudflare cf-ray 57a294a418dd6a65-LHR expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding
POST H2	204	v1 Show response dmx.districtm.io/b/	0 261 B	1068ms 25ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Thu, 26 Mar 2020 17:27:08 GMT server cloudflare cf-ray 57a294a418df6a65-LHR expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	25 B 998 B	411ms 350ms	XHR application/json	95.101.185.51 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%2269fa8d975f4de29%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22701a219fb0d02c6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22711fdcc3fee1768%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22723765866531b1a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2273365ab03dc7c3e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2274aa76eb5693bb3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22754f4ee1a6c5e9e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2276810512c87ad56%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%227792bd72b9edcda%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22788ceda7290d4d%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22796375a78ef2614%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22805d5c896589fc2%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22811358145ae24b6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2282f92c2d6e512ea%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-185-51.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 0b72f2e128bfdead8a6a7edab30ff6f217c86d1f30236f16d1450c5f3125b31f Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:07 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 45 Expires Thu, 26 Mar 2020 17:27:07 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	52 KB 13 KB	797ms 797ms	XHR text/plain	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3143284678310081&correlator=2081757497049611&output=ldjh&impl=fifs&adsid=NT&eid=21065761%2C21062832%2C21065658&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_300x250_300x600_160x600_Right_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_1x1%2Cbleepingcomputer_300x250_300x600_160x600_Right_3&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7&prev_iu_szs=728x90%7C970x90%7C970x250%2C728x90%7C970x90%7C970x250%2C300x250%7C300x600%2C300x250%7C300x600%2C728x90%2C1x1%2C300x250%7C300x600&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie_enabled=1&bc=31&abxe=1&lmt=1580852370&dt=1585243627514&dlt=1585243624959&idt=832&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C436%2C1082%2C1082%2C268%2C800%2C1082&adys=146%2C6348%2C327%2C1136%2C4917%2C6854%2C1661&adks=960084856%2C976516616%2C771041174%2C2389526111%2C4047242158%2C2635258439%2C523518761&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&ifi=2&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&dssz=59&icsg=140737664524288&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1170x120%7C1200x90%7C306x250%7C306x250%7C834x90%7C1600x6855%7C306x250&msz=1170x90%7C1170x90%7C306x250%7C306x250%7C834x90%7C1600x1%7C306x250&ga_vid=1642485379.1585243625&ga_sid=1585243626&ga_hid=13275579&fws=4%2C4%2C4%2C4%2C4%2C4%2C516&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065761 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software cafe / Resource Hash 576be8e2ec4c294472c5b1a651ef58fb8384c675863a0c78dbb31dde7dca0e82 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:08 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2,-2,-2,-2,-2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 13051 x-xss-protection 0 google-lineitem-id -2,-2,-2,-2,-1,4893662829,-2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2,-2,-2,-2,-1,138254592126,-2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pubads_impl_rendering_2020030501.js Show response securepubads.g.doubleclick.net/gpt/	69 KB 25 KB	75ms 75ms	Script text/javascript	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js?21065761 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065761 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software sffe / Resource Hash ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:07 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 05 Mar 2020 14:08:10 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 25689 x-xss-protection 0 expires Thu, 26 Mar 2020 17:27:07 GMT
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/	0 0	7ms 7ms	Other text/html	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065761 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest empty Response headers
GET H/1.1	200 OK	p2 sb.scorecardresearch.com/ Frame 277D Redirect Chain https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585243625888&ns_st_ec=2&ns_st_sp=1&ns... https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585243625888&ns_st_ec=2&ns_st_sp=1&n...	43 B 309 B	30ms 30ms	Image image/gif	23.11.238.95 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585243625888&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=1651&ns_st_cl=30000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=1651&ns_st_dpt=1651&ns_st_ipt=1651&ns_st_et=1651&ns_st_det=1651&ns_st_upc=1651&ns_st_dupc=1651&ns_st_iupc=1651&ns_st_upa=1651&ns_st_dupa=1651&ns_st_iupa=1651&ns_st_lpc=1651&ns_st_dlpc=1651&ns_st_lpa=1651&ns_st_dlpa=1651&ns_st_pa=1651&ns_ts=1585243627540&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&c8=&c9=&cs_ucfr=0 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.11.238.95 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-11-238-95.deploy.static.akamaitechnologies.com Software / Resource Hash 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:07 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Expires Mon, 01 Jan 1990 00:00:00 GMT Connection keep-alive Content-Length 43 Content-Type image/gif Redirect headers Location https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1585243625888&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=1651&ns_st_cl=30000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=1651&ns_st_dpt=1651&ns_st_ipt=1651&ns_st_et=1651&ns_st_det=1651&ns_st_upc=1651&ns_st_dupc=1651&ns_st_iupc=1651&ns_st_upa=1651&ns_st_dupa=1651&ns_st_iupa=1651&ns_st_lpc=1651&ns_st_dlpc=1651&ns_st_lpa=1651&ns_st_dlpa=1651&ns_st_pa=1651&ns_ts=1585243627540&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&c8=&c9=&cs_ucfr=0 Pragma no-cache Date Thu, 26 Mar 2020 17:27:07 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	72ms 72ms	XHR text/javascript	99.86.0.120 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&pid=mdSaaH81auuji&cb=1&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-0-120.fra6.r.cloudfront.net Software Server / Resource Hash 89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:08 GMT via 1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA6-C1 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id c5l1XSPDX0BqqCbJXWtP2kMXnTZ15pUMXCO3j22DnnuFIds9SvXBhw==
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 375 B	80ms 80ms	XHR text/javascript	99.86.0.120 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&pid=PAcJt4yi47Pxc&cb=2&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-0-120.fra6.r.cloudfront.net Software Server / Resource Hash 5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:08 GMT via 1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA6-C1 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id fM4GDXtE1cejpxqG0zkxNR9IYAkud7l4c-E1gHB8lBExRF5zdyQ0dg==
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	72ms 71ms	XHR text/javascript	99.86.0.120 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&pid=qEOHoJw9clurS&cb=3&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x600%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_1%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-0-120.fra6.r.cloudfront.net Software Server / Resource Hash 1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:08 GMT via 1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA6-C1 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id XWkb0IvxZzT3KP_TAidVqVx0Hf7Vz7cuMkufL4bx-LnWakpLueAJvA==
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	75ms 74ms	XHR text/javascript	99.86.0.120 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&pid=wJNqFCNsbFSgI&cb=4&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x600%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-0-120.fra6.r.cloudfront.net Software Server / Resource Hash 6139dddd3b6b6b847bccd476918dc8fb4f4f5a10908e5707c704f155e0918e84 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:08 GMT via 1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA6-C1 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id QQZL5SbeE64EUvuEanarufbGQNSiH2HCgtrkI_OxFINJvC_yRKDISg==
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003101714470/ Frame 0CA6	200 KB 55 KB	31ms 7ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003251303/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 4036 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 55811 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 16:19:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "789295de90cb321e" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 16:19:52 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003101714470/ Frame 0CA6	200 KB 55 KB	43ms 19ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003251303/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 4036 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 55811 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 16:19:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "789295de90cb321e" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 16:19:52 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame 0CA6	16 KB 6 KB	42ms 18ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003251303/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d0c18b56d3b9bd3640250af1ce1e624bda890531f830d64c99d45e6c07bb349 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5326 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 5728 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 15:58:22 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "36d96c2d19cb35a6" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 15:58:22 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame 0CA6	92 KB 28 KB	36ms 12ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003251303/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 4013 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28328 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 16:20:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "f4788313c10056ed" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 16:20:15 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame 0CA6	3 KB 1 KB	35ms 12ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003251303/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7b8ef4f3c2daa40e68de70096105302da24a586c1d75b620dff0ff579db73ba8 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5326 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 1414 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 15:58:22 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "ea7b1c90fec06498" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 15:58:22 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003101714470/v0/ Frame 0CA6	46 KB 15 KB	34ms 11ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003251303/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eada136c924874367d33d22fb496800b3f6f4e97f457829d2c18b5d41f1019a5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 5325 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 14863 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 15:58:23 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "db7c050f8b3f760d" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 15:58:23 GMT
GET H2	200	css fonts.googleapis.com/ Frame 0CA6	5 KB 764 B	20ms 19ms	Stylesheet text/css	2a00:1450:4001:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003251303/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 26 Mar 2020 17:27:08 GMT server ESF date Thu, 26 Mar 2020 17:27:08 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 26 Mar 2020 17:27:08 GMT
GET DATA	200 OK	truncated / Frame 0CA6	217 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b6cf185a4a1c00cd5811e84f967443e430103ef8a3c546956e4899f20e61330e Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	amp4ads-host-v0.js Show response cdn.ampproject.org/rtv/012003101714470/	20 KB 7 KB	13ms 13ms	Script text/javascript	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003101714470/amp4ads-host-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065761 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c2b0d171a4179bf00898c430c1c15464e528aff5762fc70a5d02184834c82eff Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 4003 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 7178 x-xss-protection 0 server sffe date Thu, 26 Mar 2020 16:20:25 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "9d3d923337ef7e9b" accept-ranges bytes timing-allow-origin * expires Fri, 26 Mar 2021 16:20:25 GMT
GET H2	200	view securepubads.g.doubleclick.net/pcs/ Frame 8FA8	0 0	71ms 71ms	Fetch image/gif	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstN4z8U5bvYj4lRPYPzYdgUbf9xmOKjlSNYtSkAjWeRLLhmE8RX1CMlokLxol8ujshlm9T_epa1w6WCiV61z2-1ffCB-773CylnonkpTbyq1m1cXkDAp-GervYuguRLngLYF9bjxVrGnNPz8Ni8wsUTBkjtMZLKsUEwoKJ4oEpxgYIm-gO3yST5VZ9tKcB6_4qefqNWTe_lyPPMHhZv92uMCYVQr1NM0VXxKWjOMaNd9ekPXo4LKs6tefolFkslLw6KUwoTwnEFl6rKrzx4fPKozoIxoAAksxJn&sai=AMfl-YSOpZm3d0cGUFVvwMhXJsaizd5gfOpIYxm_hiJWTkzmkJ4GqF2GFKm_i1rqSXj2TV6g_wk3AYFsIM6kyfSqo2pA91DeDwnzwRN2g6Pkig&sig=Cg0ArKJSzHtkTSH-jtr7EAE&urlfix=1&adurl= Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest empty Response headers timing-allow-origin * date Thu, 26 Mar 2020 17:27:08 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Thu, 26 Mar 2020 17:27:08 GMT
GET H2	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 8FA8	74 KB 28 KB	41ms 41ms	Script text/javascript	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 26 Mar 2020 17:27:08 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1585165059237800" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28264 x-xss-protection 0 expires Thu, 26 Mar 2020 17:27:08 GMT
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	99ms 97ms	XHR text/javascript	99.86.0.120 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&pid=rEtf9uyw3KNo8&cb=5&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22300x600%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.86.0.120 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-0-120.fra6.r.cloudfront.net Software Server / Resource Hash 111041158b9290ae7cc0c6da69d7c4f5600e8a73b4c7399d675df7f15ba7b063 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:08 GMT via 1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA6-C1 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id xpoN7l4vQ7mvz-CBPwDqpMpxwlAvwJDcaqRLkM_DFa3nJXytttz-YA==
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 0CA6	2 KB 3 KB	8ms 7ms	Image image/png	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 25 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 64400 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Thu, 26 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 0CA6	295 B 522 B	8ms 7ms	Image image/png	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 25 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 70428 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Thu, 26 Mar 2020 21:53:20 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 0CA6	0 0	72ms 71ms	Image text/html	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=C3_eV6-V8XrD6JtLA7gPRgZzADsWa4vNbzvbE9voKwaGPlQEQASDHg_wBYLu-roPQCqABj5SzlwPIAQHgAgCoAwHIAwqqBLYCT9AIOsKLVRAh_LCYDiqf6ViYpyMSDGTJ3uIoCNAKe7CfS5Kask-n_Ujruy1h7ILse9HsUgrZE-3_MI_dgXmFBnv7dytIWfgNbpCHld3bym2DixcFLuujvqZfd0PywooQMGsR6H_p87F_DJDDmV1U-kSGqll8GNX209MmUDzEwAqEsc_9jWD2rPGdO4bEFI2m59R863KcvOco7gioceZ0_0oImFc3A7Qhk1Dy5YssT3d-ZxDlWGKO4k-yr4LMH0Eu66n2S70qNrY9zb5NfMVaYMS--saFwpRgH1QpCEZPb6hGd0gycXdboUOpyO1YRTTYojaqTy9qHizPtWs_V8TN8v9nPJXc1CGNrqH0Lavh4Y3x0aXX4p1dNirJNyNb5MtbDDDt7hbA2r76v59PfwdgPPFx3w7wmMAEzf-SxaYC4AQBkgUECAQYAZIFBAgFGASAB9nrzGioB47OG6gH1ckbqAeT2BuoB5_bG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAfIHBBCOkwXSCAkIgOGAEBABGB2ACgHICwHYEwyIFAE&sigh=XG5u-QrS6Zw&tpd=AGWhJmvIdqOSrhLaEUXVx5wqefL5xFIASRQkqBb3LJE6qWYTng Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 0CA6	11 KB 11 KB	10ms 6ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1865669 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 0CA6	11 KB 11 KB	11ms 6ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 2450402 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 33 B	22ms 22ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Thu, 26 Mar 2020 17:27:08 GMT server cloudflare cf-ray 57a294a5ea206a65-LHR expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	174 B 577 B	118ms 117ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=267d7bf8-cc3e-432c-9899-e61c418968fd&nocache=1585243628462&pubcid=9edf26d3-9a25-4ecd-87cb-6bb17b9da013&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_ATF&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash 989b0d207ddc0e86a8a0ebf6f3ecc1ec10730917bbcd5261d20263ecc163c168 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT content-encoding gzip server OXGW/16.182.1 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	145 B 1 KB	47ms 46ms	XHR application/json	185.33.223.215 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 6497b0dd0fad253e95eb3695731d5218e15266f3cd7185c788d1f51a9058cf81 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:10 GMT X-Proxy-Origin 89.238.150.150; 89.238.150.150; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.81:80 AN-X-Request-Uuid ef2d91e8-d126-4665-91ab-eaf108c93195 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 145 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 483 B	147ms 147ms	XHR application/json	35.157.249.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.249.193 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-249-193.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT status 200 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-type application/json; charset=utf-8 content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	25 B 1 KB	254ms 254ms	XHR application/json	95.101.185.51 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%2298de9dd807e542a%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22990854b26e18f5d%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2210047180f23a21c5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22101e7c311511f175%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-185-51.deploy.static.akamaitechnologies.com Software Apache / Resource Hash ae14e4baccfeeac20c540d2d7a1dfdefa8e6e969f64b57d75d2a5704ceb728db Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:08 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 45 Expires Thu, 26 Mar 2020 17:27:08 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	194 B 384 B	14ms 13ms	XHR application/json	2a02:fa8:8806:16::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash f2d9d059c961e141fcca3ce44a4df7870a3af1ba206a27f4eb80638ec104b3ba Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 194 expires 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	55ms 55ms	XHR application/json	185.33.223.215 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash e7cc64216e7d814ec7bc1ef1dff20e8c82e84f65b1adae837bb7574fa68cdc7d Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:10 GMT X-Proxy-Origin 89.238.150.150; 89.238.150.150; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.145:80 AN-X-Request-Uuid 75324cfe-adbf-46f6-8d36-889e6781fb47 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	306 B 798 B	49ms 49ms	XHR application/json	69.173.144.141 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=267d7bf8-cc3e-432c-9899-e61c418968fd&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.18961237115861485 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 56194cfc431ea1155df93399fb8b378c83b495bff53e92d88c725abab70befdd Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:08 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=445 Content-Length 306 Expires Wed, 17 Sep 1975 21:32:10 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 483 B	127ms 127ms	XHR application/json	35.157.249.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.249.193 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-249-193.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT status 200 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-type application/json; charset=utf-8 content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	194 B 384 B	15ms 14ms	XHR application/json	2a02:fa8:8806:16::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash d51af287e80fa6cfc26db1a645bd5a507163f7344d59a2386a3fb3894a6a4260 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 194 expires 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	85ms 44ms	XHR application/json	185.33.223.215 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 80fb03c0f346e1e4d852d190675c26721c7deb063c359bc76796a90aadf73a07 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:10 GMT X-Proxy-Origin 89.238.150.150; 89.238.150.150; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.26:80 AN-X-Request-Uuid 5a815e91-3a8c-4905-8048-a7ace8dde4ca Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 33 B	28ms 28ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Thu, 26 Mar 2020 17:27:08 GMT server cloudflare cf-ray 57a294a5fa286a65-LHR expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	144ms 100ms	XHR application/json	185.33.223.215 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash e260c7d8e389a6eee0a3ad2b78d3678fd09ba717bdca488d5b9a06f2e4299a76 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:10 GMT X-Proxy-Origin 89.238.150.150; 89.238.150.150; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.40:80 AN-X-Request-Uuid eb261e8b-c2d1-4311-942c-4b0e4e15bc05 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	306 B 798 B	43ms 43ms	XHR application/json	69.173.144.141 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=46a87fc9-daa8-47b1-b6e7-85774e9ba185&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.8731400503471409 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 9d1ff7096ccb7582a3ab104e113c019e608361d2c920288375b2afd688b7dfd7 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:08 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=397 Content-Length 306 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	26 B 1 KB	426ms 370ms	XHR application/json	95.101.185.51 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%22127d6bc6b422afef%22%2C%22imp%22%3A%5B%7B%22id%22%3A%221286044524fe46f%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22129e77fbaa30fb19%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%221303040216ef7144%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-185-51.deploy.static.akamaitechnologies.com Software Apache / Resource Hash e2eae36480be18bf052f7145307584db1bd2598b61bc55939ebeb8649edcca88 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:08 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 46 Expires Thu, 26 Mar 2020 17:27:08 GMT
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	175 B 370 B	234ms 234ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=46a87fc9-daa8-47b1-b6e7-85774e9ba185&nocache=1585243628472&pubcid=9edf26d3-9a25-4ecd-87cb-6bb17b9da013&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_BTF&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash fa0ad8df1cadf536454dd868d906d7b23bcef20230216427a02bc2af4e1cea78 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT content-encoding gzip server OXGW/16.182.1 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 164 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 0CA6 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	40ms 39ms	Image text/html	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Thu, 26 Mar 2020 17:27:08 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	26 B 1 KB	311ms 253ms	XHR application/json	95.101.185.51 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%2213776c8998094f9c%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22138e6a1d5e24e75b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2213919ed2313084ef%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-185-51.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 0eec32b1698481ac21b021d3bb2219979dea4d1a9d0d0bf43b4449ac0a19b5ae Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:08 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 46 Expires Thu, 26 Mar 2020 17:27:08 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 483 B	180ms 179ms	XHR application/json	35.157.249.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.249.193 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-249-193.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT status 200 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-type application/json; charset=utf-8 content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 33 B	22ms 21ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Thu, 26 Mar 2020 17:27:08 GMT server cloudflare cf-ray 57a294a64a5a6a65-LHR expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	304 B 796 B	43ms 42ms	XHR application/json	69.173.144.141 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=9cf6a15b-ac58-486d-99de-676ef687d861&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9061012426535877 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 88d721c29e57ebac20b69eea1f1b71c49285b5a8b2cc2f7e434e6e31db33e70f Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:08 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=199 Content-Length 304 Expires Wed, 17 Sep 1975 21:32:10 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	194 B 384 B	14ms 14ms	XHR application/json	2a02:fa8:8806:16::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 29d90fe6577b31c2934ea50f6fbe2d5c0802ca98c1bb067a3f9e45146b5ec2ee Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 194 expires 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	145 B 1 KB	64ms 64ms	XHR application/json	185.33.223.215 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 05097d9b4df2b8c60675739b630e49514fea96848319c77203610a1736148726 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:10 GMT X-Proxy-Origin 89.238.150.150; 89.238.150.150; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.40:80 AN-X-Request-Uuid 84aa2c7a-9a32-4af9-9e5e-a46e9574411d Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 145 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	175 B 367 B	157ms 156ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=9cf6a15b-ac58-486d-99de-676ef687d861&nocache=1585243628517&pubcid=9edf26d3-9a25-4ecd-87cb-6bb17b9da013&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=300x250%2C300x600&divIds=bleepingcomputer_300x250_300x600_160x600_Right_1&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash 8b8979d3b4ee04696b2a96cfea1b0aeccec78c0c9f06b3f2a1336a60bfb5b4dd Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT content-encoding gzip server OXGW/16.182.1 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	140 B 999 B	31ms 28ms	XHR application/json	185.33.223.215 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 054dc150d73fcb7fff927887c299eca986d2249d79b81121b8ec817e6cb9158f Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:10 GMT X-Proxy-Origin 89.238.150.150; 89.238.150.150; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.102:80 AN-X-Request-Uuid 1e5e4989-cb38-4d8a-8dd0-e68af3082c11 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 140 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	26 B 1 KB	385ms 328ms	XHR application/json	95.101.185.51 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%221615e2b65201e235%22%2C%22imp%22%3A%5B%7B%22id%22%3A%221625c275b79a8648%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22163f12a65e64cb55%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-185-51.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 7cd49bfc7ab412f02d8acfa7a851cd30c5131e76c84ed9ece90287828bcf0b4a Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:08 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 46 Expires Thu, 26 Mar 2020 17:27:08 GMT
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	174 B 367 B	127ms 126ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=51376f80-d6e2-441c-9173-89af9fd73657&nocache=1585243628554&pubcid=9edf26d3-9a25-4ecd-87cb-6bb17b9da013&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=300x250%2C300x600&divIds=bleepingcomputer_300x250_300x600_160x600_Right_2&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash 56ab46d17a665555f4c6656e4bd4359901edf5b5bedcab19d9c3c897df5584b0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT content-encoding gzip server OXGW/16.182.1 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	139 B 998 B	30ms 30ms	XHR application/json	185.33.223.215 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 4c5f8d0bc756ae119b0205d98064ce6af05867d9381529d57ae3cf2ec5569872 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:10 GMT X-Proxy-Origin 89.238.150.150; 89.238.150.150; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.145:80 AN-X-Request-Uuid 9cbe5cf8-2f5f-4ea1-b1a5-cff46b7cfceb Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 139 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 33 B	20ms 20ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Thu, 26 Mar 2020 17:27:08 GMT server cloudflare cf-ray 57a294a68a996a65-LHR expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	304 B 795 B	47ms 47ms	XHR application/json	69.173.144.141 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=51376f80-d6e2-441c-9173-89af9fd73657&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.6799970300200886 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 1ee3d881cc85a8a46c92887771f5f6461fea6cbd58cd93e898c96100529e292d Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:08 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=53 Content-Length 304 Expires Wed, 17 Sep 1975 21:32:10 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	41ms 41ms	XHR application/json	185.33.223.215 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash bba477e9c4aaea5ac34c9ab8d40ab093e638ccdfb069e9547b5820eeab7b1db0 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:10 GMT X-Proxy-Origin 89.238.150.150; 89.238.150.150; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.233:80 AN-X-Request-Uuid 63493cf3-0fc8-4219-8c5e-1add23c32f8e Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	194 B 384 B	14ms 13ms	XHR application/json	2a02:fa8:8806:16::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 5a2a823ebda3721913461882478b9092d74092cd760cd4e61c21787da8a64920 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 194 expires 0
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 483 B	126ms 126ms	XHR application/json	35.157.249.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.249.193 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-249-193.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT status 200 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-type application/json; charset=utf-8 content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	455ms 111ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash 07f61de7c6cddd4b0148af4491f264315b68ee3017be3885667004dcd4e676ef Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 17:27:09 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	304 B 796 B	47ms 47ms	XHR application/json	69.173.144.141 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=94941b6a-6c55-4a8e-b66c-fba4f9878135&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.4890682607412762 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 8390ed8196c41ffd4c29ae966259287875dee17d53ef85483df5a182d1dcd135 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:08 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=140 Content-Length 304 Expires Wed, 17 Sep 1975 21:32:10 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 33 B	27ms 27ms	XHR text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Thu, 26 Mar 2020 17:27:08 GMT server cloudflare cf-ray 57a294a78b9f6a65-LHR expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	26 B 875 B	205ms 204ms	XHR application/json	95.101.185.51 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%2218933610e4e6c0ba%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22190f6470c027e5f5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%221911e8d93b757e6a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.185.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-185-51.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 5aa2ee9f4f40b898b3d8ca1f54252c8d5d7cde45c588ac901df80cac00dfa565 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:08 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 46 Expires Thu, 26 Mar 2020 17:27:08 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	194 B 384 B	14ms 13ms	XHR application/json	2a02:fa8:8806:16::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:16::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 9125b7535de74377d5339bf367ec7c63971566efb75edb0078978a43a71603bb Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 194 expires 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	140 B 998 B	28ms 28ms	XHR application/json	185.33.223.215 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 99c7bfd473026762061e12866051c2d4683faa84b6d7a5e3992d7254f6c68c84 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:10 GMT X-Proxy-Origin 89.238.150.150; 89.238.150.150; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.36:80 AN-X-Request-Uuid 9117504e-c605-41bb-a5c7-9e7ca33ba1e8 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 140 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	174 B 367 B	115ms 115ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=94941b6a-6c55-4a8e-b66c-fba4f9878135&nocache=1585243628723&pubcid=9edf26d3-9a25-4ecd-87cb-6bb17b9da013&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=300x250%2C300x600&divIds=bleepingcomputer_300x250_300x600_160x600_Right_3&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash 04f4a29d990d0c36640a604c6f5cc6a0d81cff03089d09bda5cffc047341267d Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT content-encoding gzip server OXGW/16.182.1 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 165 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	74ms 74ms	XHR application/json	185.33.223.215 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash dd41f902ced606c9081bc18e69570c92b00a643adbc7e9f4abb1ec786e0f7ec6 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Thu, 26 Mar 2020 17:27:10 GMT X-Proxy-Origin 89.238.150.150; 89.238.150.150; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.102:80 AN-X-Request-Uuid ca19ac3b-9462-4c7d-b29f-3add026e5a4d Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 483 B	126ms 126ms	XHR application/json	35.157.249.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.249.193 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-249-193.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 26 Mar 2020 17:27:08 GMT status 200 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-type application/json; charset=utf-8 content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 239 B	562ms 562ms	XHR text/plain	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3143284678310081&correlator=2081757497049611&output=ldjh&impl=fifs&adsid=NT&eid=21065761%2C21062832%2C21065658&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_ATF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C970x250&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3D851803d5a26ce299%3AT%3D1585243627%3AS%3DALNI_MbX-kUOIzZF3V8F5UuDrIF9yMnVMA&cookie_enabled=1&bc=31&abxe=1&lmt=1580852370&dt=1585243629228&dlt=1585243624959&idt=832&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=146&adks=960084856&ucis=8&ifi=3&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&dssz=59&icsg=140737664524288&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1170x120&msz=1170x90&psts=ABP-KfTJC_3xcAyM3boTIbd3WU8hy51Ar0qimvkGC6GWXBdvSy9Na4R2tesF9BVmbyWQ48kfb-V7oML3IzcE&ga_vid=1642485379.1585243625&ga_sid=1585243626&ga_hid=13275579&fws=4&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065761 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software cafe / Resource Hash d888e43d7000abcf3b02fed48e1e69b68353252878e584c6b380a3748188c225 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:09 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 150 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 233 B	803ms 802ms	XHR text/plain	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3143284678310081&correlator=2081757497049611&output=ldjh&impl=fifs&adsid=NT&eid=21065761%2C21062832%2C21065658&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=15184186%2Cbleepingcomputer_300x250_300x600_160x600_Right_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3D851803d5a26ce299%3AT%3D1585243627%3AS%3DALNI_MbX-kUOIzZF3V8F5UuDrIF9yMnVMA&cookie_enabled=1&bc=31&abxe=1&lmt=1580852370&dt=1585243629329&dlt=1585243624959&idt=832&frm=20&biw=1600&bih=1200&oid=3&adxs=1082&adys=327&adks=771041174&ucis=9&ifi=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&dssz=59&icsg=140737664524288&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=306x250&msz=306x250&psts=ABP-KfTJC_3xcAyM3boTIbd3WU8hy51Ar0qimvkGC6GWXBdvSy9Na4R2tesF9BVmbyWQ48kfb-V7oML3IzcE&ga_vid=1642485379.1585243625&ga_sid=1585243626&ga_hid=13275579&fws=4&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065761 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software cafe / Resource Hash 77fb0265b9e65251259530f34d8686b667699575f33388ce291345fc305a20e2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:10 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 155 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	17 KB 9 KB	1068ms 1067ms	XHR text/plain	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3143284678310081&correlator=2081757497049611&output=ldjh&impl=fifs&adsid=NT&eid=21065761%2C21062832%2C21065658&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C970x250&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3D851803d5a26ce299%3AT%3D1585243627%3AS%3DALNI_MbX-kUOIzZF3V8F5UuDrIF9yMnVMA&cookie_enabled=1&bc=31&abxe=1&lmt=1580852370&dt=1585243629403&dlt=1585243624959&idt=832&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=6348&adks=976516616&ucis=a&ifi=5&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&dssz=59&icsg=140737664524288&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1200x90&msz=1170x90&psts=ABP-KfTJC_3xcAyM3boTIbd3WU8hy51Ar0qimvkGC6GWXBdvSy9Na4R2tesF9BVmbyWQ48kfb-V7oML3IzcE&ga_vid=1642485379.1585243625&ga_sid=1585243626&ga_hid=13275579&fws=4&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065761 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software cafe / Resource Hash d212c4f09dcddf654cc4a59b5f2f0c5d06fc684016386c26b33191997264e84a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:10 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 8740 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 229 B	1324ms 1323ms	XHR text/plain	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3143284678310081&correlator=2081757497049611&output=ldjh&impl=fifs&adsid=NT&eid=21065761%2C21062832%2C21065658&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=15184186%2Cbleepingcomputer_300x250_300x600_160x600_Right_3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3D851803d5a26ce299%3AT%3D1585243627%3AS%3DALNI_MbX-kUOIzZF3V8F5UuDrIF9yMnVMA&cookie_enabled=1&bc=31&abxe=1&lmt=1580852370&dt=1585243629431&dlt=1585243624959&idt=832&frm=20&biw=1600&bih=1200&oid=3&adxs=1082&adys=1661&adks=523518761&ucis=b&ifi=6&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&dssz=59&icsg=140737664524288&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=306x250&msz=306x250&psts=ABP-KfTJC_3xcAyM3boTIbd3WU8hy51Ar0qimvkGC6GWXBdvSy9Na4R2tesF9BVmbyWQ48kfb-V7oML3IzcE&ga_vid=1642485379.1585243625&ga_sid=1585243626&ga_hid=13275579&fws=516&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065761 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software cafe / Resource Hash a7b5a825cbb2d9569a712807c8d029324bfde2a060fc0c8ab379a16dd02454c0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:10 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 155 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 232 B	1674ms 1673ms	XHR text/plain	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3143284678310081&correlator=2081757497049611&output=ldjh&impl=fifs&adsid=NT&eid=21065761%2C21062832%2C21065658&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=15184186%2Cbleepingcomputer_300x250_300x600_160x600_Right_2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3D851803d5a26ce299%3AT%3D1585243627%3AS%3DALNI_MbX-kUOIzZF3V8F5UuDrIF9yMnVMA&cookie_enabled=1&bc=31&abxe=1&lmt=1580852370&dt=1585243629442&dlt=1585243624959&idt=832&frm=20&biw=1600&bih=1200&oid=3&adxs=1082&adys=1136&adks=2389526111&ucis=c&ifi=7&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&dssz=59&icsg=140737664524288&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=306x250&msz=306x250&psts=ABP-KfTJC_3xcAyM3boTIbd3WU8hy51Ar0qimvkGC6GWXBdvSy9Na4R2tesF9BVmbyWQ48kfb-V7oML3IzcE&ga_vid=1642485379.1585243625&ga_sid=1585243626&ga_hid=13275579&fws=4&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js?21065761 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software cafe / Resource Hash 4d9a4db73c7f4d2a7e0dc3d3e73b4181fb0f6244cefd153751c025766afade1f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 26 Mar 2020 17:27:11 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 154 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	116ms 115ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash 07f61de7c6cddd4b0148af4491f264315b68ee3017be3885667004dcd4e676ef Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 17:27:09 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	111ms 111ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash 07f61de7c6cddd4b0148af4491f264315b68ee3017be3885667004dcd4e676ef Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 17:27:10 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 0F2D	0 0	7ms 6ms	Document text/html	2a00:1450:4001:81b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003251303/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /safeframe/1-0-37/html/container.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html timing-allow-origin * content-length 2973 date Thu, 26 Mar 2020 17:00:54 GMT expires Fri, 26 Mar 2021 17:00:54 GMT last-modified Thu, 21 Nov 2019 16:01:11 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 1576 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	114ms 114ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash 07f61de7c6cddd4b0148af4491f264315b68ee3017be3885667004dcd4e676ef Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 17:27:10 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	111ms 111ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash 07f61de7c6cddd4b0148af4491f264315b68ee3017be3885667004dcd4e676ef Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Thu, 26 Mar 2020 17:27:11 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame 037D Redirect Chain https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1	0 0	27ms 27ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US cookie i=067b406d-ab33-03f4-3155-32b102e8eee0|1585243634 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=067b406d-ab33-03f4-3155-32b102e8eee0|1585243634; Version=1; Expires=Fri, 26-Mar-2021 17:27:14 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585243634|mOsLgqgikin0fcmWiygu; Version=1; Expires=Fri, 10-Apr-2020 17:27:14 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.182.1 p3p CP="CUR ADM OUR NOR STA NID" date Thu, 26 Mar 2020 17:27:14 GMT content-type text/html content-length 483 content-encoding gzip via 1.1 google alt-svc clear Redirect headers status 302 set-cookie i=08617edb-efa7-0ccf-3c63-937a0520fe2f|1585243634; Version=1; Expires=Fri, 26-Mar-2021 17:27:14 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.182.1 p3p CP="CUR ADM OUR NOR STA NID" location https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 date Thu, 26 Mar 2020 17:27:14 GMT content-length 0 via 1.1 google alt-svc clear
GET H2	200	pd u.openx.net/w/1.0/ Frame CF59 Redirect Chain https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent= https://u.openx.net/w/1.0/pd?cc=1&gdpr=0&gdpr_consent=	0 0	27ms 27ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://u.openx.net/w/1.0/pd?cc=1&gdpr=0&gdpr_consent= Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash Request headers :method GET :authority u.openx.net :scheme https :path /w/1.0/pd?cc=1&gdpr=0&gdpr_consent= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US cookie i=067b406d-ab33-03f4-3155-32b102e8eee0|1585243634 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=067b406d-ab33-03f4-3155-32b102e8eee0|1585243634; Version=1; Expires=Fri, 26-Mar-2021 17:27:14 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585243634|mOgikimWiygu; Version=1; Expires=Fri, 10-Apr-2020 17:27:14 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.182.1 p3p CP="CUR ADM OUR NOR STA NID" date Thu, 26 Mar 2020 17:27:14 GMT content-type text/html content-length 374 content-encoding gzip via 1.1 google alt-svc clear Redirect headers status 302 set-cookie i=2ed57b76-39d7-4d9a-806a-4cf90a865f93|1585243634; Version=1; Expires=Fri, 26-Mar-2021 17:27:14 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.182.1 p3p CP="CUR ADM OUR NOR STA NID" location https://u.openx.net/w/1.0/pd?cc=1&gdpr=0&gdpr_consent= date Thu, 26 Mar 2020 17:27:14 GMT content-length 0 via 1.1 google alt-svc clear
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 3D30	0 0	88ms 29ms	Document text/html	95.101.184.231 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.184.231 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-184-231.deploy.static.akamaitechnologies.com Software nginx/1.13.10 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers Server nginx/1.13.10 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT Vary Accept-Encoding ETag W/"573e714d-3e3" Access-Control-Allow-Origin * Content-Encoding gzip Content-Length 506 Cache-Control max-age=31536000 Expires Fri, 26 Mar 2021 17:27:14 GMT Date Thu, 26 Mar 2020 17:27:14 GMT Connection keep-alive
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame 6559 Redirect Chain https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1	0 0	29ms 29ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US cookie i=067b406d-ab33-03f4-3155-32b102e8eee0|1585243634 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=067b406d-ab33-03f4-3155-32b102e8eee0|1585243634; Version=1; Expires=Fri, 26-Mar-2021 17:27:14 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585243634|mOsLgqgikin0fcmWiygu; Version=1; Expires=Fri, 10-Apr-2020 17:27:14 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.182.1 p3p CP="CUR ADM OUR NOR STA NID" date Thu, 26 Mar 2020 17:27:14 GMT content-type text/html content-length 483 content-encoding gzip via 1.1 google alt-svc clear Redirect headers status 302 set-cookie i=4c126980-1476-038b-0686-438bc4a898b1|1585243634; Version=1; Expires=Fri, 26-Mar-2021 17:27:14 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.182.1 p3p CP="CUR ADM OUR NOR STA NID" location https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 date Thu, 26 Mar 2020 17:27:14 GMT content-length 0 via 1.1 google alt-svc clear
GET H2	200	sync eb2.3lift.com/ Frame 3867 Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	32ms 30ms	Document text/html	35.157.209.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.209.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-209-134.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=11872247517897350024 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 date Thu, 26 Mar 2020 17:27:14 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQgPaIv5EuCgoI4gEQgPaIv5EuCgoI5gEQgPaIv5EuCgkICRCA9oi_kS4KCgipARCA9oi_kS4KCQg5EID2iL-RLgoJCDoQgPaIv5EuCgkICxCA9oi_kS4KCgjOARCA9oi_kS4KCQgfEID2iL-RLg==; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=11872247517897350024; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Thu, 26 Mar 2020 17:27:14 GMT content-length 0 set-cookie tluid=11477306754029525530; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	sync eb2.3lift.com/ Frame 5484 Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	32ms 30ms	Document text/html	35.157.209.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.209.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-209-134.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=11139455474633538807 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 date Thu, 26 Mar 2020 17:27:14 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQgPaIv5EuCgoI4gEQgPaIv5EuCgoI5gEQgPaIv5EuCgkICRCA9oi_kS4KCgipARCA9oi_kS4KCQg5EID2iL-RLgoJCDoQgPaIv5EuCgkICxCA9oi_kS4KCgjOARCA9oi_kS4KCQgfEID2iL-RLg==; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=11139455474633538807; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Thu, 26 Mar 2020 17:27:14 GMT content-length 0 set-cookie tluid=1138174342267156259; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	sync eb2.3lift.com/ Frame 1C0C Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	34ms 32ms	Document text/html	35.157.209.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.209.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-209-134.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=11139455474633538807 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 date Thu, 26 Mar 2020 17:27:14 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQgPaIv5EuCgoI4gEQgPaIv5EuCgoI5gEQgPaIv5EuCgkICRCA9oi_kS4KCgipARCA9oi_kS4KCQg5EID2iL-RLgoJCDoQgPaIv5EuCgkICxCA9oi_kS4KCgjOARCA9oi_kS4KCQgfEID2iL-RLg==; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=11139455474633538807; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Thu, 26 Mar 2020 17:27:14 GMT content-length 0 set-cookie tluid=11872247517897350024; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame FA10 Redirect Chain https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1	0 0	29ms 29ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US cookie i=067b406d-ab33-03f4-3155-32b102e8eee0|1585243634 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=067b406d-ab33-03f4-3155-32b102e8eee0|1585243634; Version=1; Expires=Fri, 26-Mar-2021 17:27:14 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585243634|mOsLgqgikin0fcmWiygu; Version=1; Expires=Fri, 10-Apr-2020 17:27:14 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.182.1 p3p CP="CUR ADM OUR NOR STA NID" date Thu, 26 Mar 2020 17:27:14 GMT content-type text/html content-length 483 content-encoding gzip via 1.1 google alt-svc clear Redirect headers status 302 set-cookie i=067b406d-ab33-03f4-3155-32b102e8eee0|1585243634; Version=1; Expires=Fri, 26-Mar-2021 17:27:14 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.182.1 p3p CP="CUR ADM OUR NOR STA NID" location https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 date Thu, 26 Mar 2020 17:27:14 GMT content-length 0 via 1.1 google alt-svc clear
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 10AF	0 0	87ms 29ms	Document text/html	95.101.184.231 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.184.231 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-184-231.deploy.static.akamaitechnologies.com Software nginx/1.13.10 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers Server nginx/1.13.10 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT Vary Accept-Encoding ETag W/"573e714d-3e3" Access-Control-Allow-Origin * Content-Encoding gzip Content-Length 506 Cache-Control max-age=31536000 Expires Fri, 26 Mar 2021 17:27:14 GMT Date Thu, 26 Mar 2020 17:27:14 GMT Connection keep-alive
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 0C45	0 0	89ms 29ms	Document text/html	95.101.184.231 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.184.231 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-184-231.deploy.static.akamaitechnologies.com Software nginx/1.13.10 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers Server nginx/1.13.10 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT Vary Accept-Encoding ETag W/"573e714d-3e3" Access-Control-Allow-Origin * Content-Encoding gzip Content-Length 506 Cache-Control max-age=31536000 Expires Fri, 26 Mar 2021 17:27:14 GMT Date Thu, 26 Mar 2020 17:27:14 GMT Connection keep-alive
GET H2	204	index.html cdn.districtm.io/ids/ Frame 4D22	0 0	24ms 23ms	Document text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 204 date Thu, 26 Mar 2020 17:27:14 GMT set-cookie __cfduid=d4e936dec686ad1f3097f9bd81fc617181585243634; expires=Sat, 25-Apr-20 17:27:14 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare cf-ray 57a294caa9bc6a65-LHR
GET H/1.1	200 OK	usync.html eus.rubiconproject.com/ Frame 0B51	0 0	112ms 35ms	Document text/html	23.8.15.54 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://eus.rubiconproject.com/usync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.8.15.54 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a23-8-15-54.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / PHP/5.3.3 Resource Hash Request headers Host eus.rubiconproject.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers Server Apache/2.2.15 (CentOS) X-Powered-By PHP/5.3.3 p3p CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT" Last-Modified Wed, 04 Mar 2020 22:48:14 GMT Content-Encoding gzip Content-Length 7617 Content-Type text/html; charset=UTF-8 Cache-Control max-age=39564 Expires Fri, 27 Mar 2020 04:26:38 GMT Date Thu, 26 Mar 2020 17:27:14 GMT Connection keep-alive Vary Accept-Encoding
GET H2	204	index.html cdn.districtm.io/ids/ Frame 6521	0 0	21ms 19ms	Document text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 204 date Thu, 26 Mar 2020 17:27:14 GMT set-cookie __cfduid=d4e936dec686ad1f3097f9bd81fc617181585243634; expires=Sat, 25-Apr-20 17:27:14 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare cf-ray 57a294caa9be6a65-LHR
GET H2	200	sync eb2.3lift.com/ Frame 28A8 Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	33ms 31ms	Document text/html	35.157.209.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.209.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-209-134.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=11872247517897350024 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 date Thu, 26 Mar 2020 17:27:14 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQgPaIv5EuCgoI4gEQgPaIv5EuCgoI5gEQgPaIv5EuCgkICRCA9oi_kS4KCgipARCA9oi_kS4KCQg5EID2iL-RLgoJCDoQgPaIv5EuCgkICxCA9oi_kS4KCgjOARCA9oi_kS4KCQgfEID2iL-RLg==; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=11872247517897350024; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Thu, 26 Mar 2020 17:27:14 GMT content-length 0 set-cookie tluid=8010418479030288753; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 99A8	0 0	87ms 29ms	Document text/html	95.101.184.231 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.184.231 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-184-231.deploy.static.akamaitechnologies.com Software nginx/1.13.10 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers Server nginx/1.13.10 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT Vary Accept-Encoding ETag W/"573e714d-3e3" Access-Control-Allow-Origin * Content-Encoding gzip Content-Length 506 Cache-Control max-age=31536000 Expires Fri, 26 Mar 2021 17:27:14 GMT Date Thu, 26 Mar 2020 17:27:14 GMT Connection keep-alive
GET H2	204	index.html cdn.districtm.io/ids/ Frame 3F56	0 0	20ms 20ms	Document text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 204 date Thu, 26 Mar 2020 17:27:14 GMT set-cookie __cfduid=d4e936dec686ad1f3097f9bd81fc617181585243634; expires=Sat, 25-Apr-20 17:27:14 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare cf-ray 57a294cab9ca6a65-LHR
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 2F02	0 0	88ms 30ms	Document text/html	95.101.184.231 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.184.231 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-101-184-231.deploy.static.akamaitechnologies.com Software nginx/1.13.10 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers Server nginx/1.13.10 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT Vary Accept-Encoding ETag W/"573e714d-3e3" Access-Control-Allow-Origin * Content-Encoding gzip Content-Length 506 Cache-Control max-age=31536000 Expires Fri, 26 Mar 2021 17:27:14 GMT Date Thu, 26 Mar 2020 17:27:14 GMT Connection keep-alive
GET H2	204	index.html cdn.districtm.io/ids/ Frame A9E9	0 0	26ms 26ms	Document text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 204 date Thu, 26 Mar 2020 17:27:14 GMT set-cookie __cfduid=d4e936dec686ad1f3097f9bd81fc617181585243634; expires=Sat, 25-Apr-20 17:27:14 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare cf-ray 57a294cab9d66a65-LHR
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame EF8D	0 0	33ms 33ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.182.1 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US cookie i=4c126980-1476-038b-0686-438bc4a898b1|1585243634 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=4c126980-1476-038b-0686-438bc4a898b1|1585243634; Version=1; Expires=Fri, 26-Mar-2021 17:27:14 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1585243634|mOsLgqgikin0fcmWiygu; Version=1; Expires=Fri, 10-Apr-2020 17:27:14 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.182.1 p3p CP="CUR ADM OUR NOR STA NID" date Thu, 26 Mar 2020 17:27:14 GMT content-type text/html content-length 483 content-encoding gzip via 1.1 google alt-svc clear
GET H2	204	index.html cdn.districtm.io/ids/ Frame 678A	0 0	24ms 24ms	Document text/plain	104.16.190.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 204 date Thu, 26 Mar 2020 17:27:14 GMT set-cookie __cfduid=d4e936dec686ad1f3097f9bd81fc617181585243634; expires=Sat, 25-Apr-20 17:27:14 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare cf-ray 57a294cac9dc6a65-LHR
GET H2	200	sync eb2.3lift.com/ Frame A372 Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	33ms 31ms	Document text/html	35.157.209.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.209.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-209-134.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=11139455474633538807 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ Response headers status 200 date Thu, 26 Mar 2020 17:27:14 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQgfaIv5EuCgoI4gEQgfaIv5EuCgoI5gEQgfaIv5EuCgkICRCB9oi_kS4KCgipARCB9oi_kS4KCQg5EIH2iL-RLgoJCDoQgfaIv5EuCgkICxCB9oi_kS4KCgjOARCB9oi_kS4KCQgfEIH2iL-RLg==; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=11139455474633538807; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Thu, 26 Mar 2020 17:27:14 GMT content-length 0 set-cookie tluid=11139455474633538807; Max-Age=7776000; Expires=Wed, 24 Jun 2020 17:27:14 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H/1.1	200 OK	g Show response rtb.connatix.com/	81 B 288 B	94ms 94ms	Script text/plain	54.209.155.90 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=470&c_tk=414C33DE-F293-46CF-ABF8-135274D262E2&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&c_ivt=0&connatix_sess=pima91vDScrJ_ikU7rpJhf2Ic5dU3ylXdQZ_xxANXoPtjJkMVeR-VlG52oAbbreQ7ffM8OlugGt844LQ9MjyHmtCLi-vOHnEj19KkjzDLYYD6dryfc2zY-duS4iAiJOuWNSXx3q-K0Bv27l3fiqsGVH5q6A_0aWNKan4ftN4qN_cnrXNKhxXfPfJZhgbtmu5&notServed=false&xplr=false&c_s=false&c_pl=fyS7nQVgxcJD7m3lYQqhh8c2jxEvsODB0fiEaos8_LvId82kFxGtAjn8DUAel-RKN1OvdvVDH1-1dlEvqXNxXZajymLVe6Ha056yKEACzZ9xfKWKBQGSVbGd5Qlh7No1-mtNCJrVCtvy3dHB7a2XDig8unn44d_roBv6eeTaUuJUKF4rp-U-d_T9rgit8zoJCnYyeUa4hR5AoAg8cK6v4DgN3mW4-jwU8PzsxYYnjOupvahIxoLyIjoQk51Vc--W3DXqnmmnOuLbHzN0XUdtUg&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=2&v=1&c_pt=1&c_f=[{id:14424,r:2,i:0,f:5.29}]&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-f&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_7e905538f2f0f81c7ca91585243635887 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.209.155.90 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-209-155-90.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash bc3137e5dcd2e03ce08c5e7781592a27a3477042ea2e08d28a585d971bacdaed Request headers Referer https://www.bleepingcomputer.com/news/security/emotet-gets-ready-for-tax-season-with-malicious-w-9-forms/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Thu, 26 Mar 2020 17:27:15 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 100

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

freestar-d.openx.net

URL

https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Femotet-gets-ready-for-tax-season-with-malicious-w-9-forms%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=ec3ac28e-6e33-47b2-9961-3326fe8ea38c%2C7dc42de3-d4ec-4398-a378-5448dff3d03c%2C5dedf4c2-322d-4f77-b761-43fa7eb0a597%2C6b99d3e5-4977-4146-bc10-64cbd11efae2%2Cb2ee0526-04e1-48e8-a616-de313c424860%2C4d7a11cf-55f2-482b-9217-e87576304201&nocache=1585243627117&pubcid=9edf26d3-9a25-4ecd-87cb-6bb17b9da013&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C300x250%2C300x600%7C300x250%2C300x600%7C728x90%7C300x250%2C300x600&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_300x250_300x600_160x600_Right_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_3&auid=540959250%2C540959250%2C540959250%2C540959250%2C540959250%2C540959250&