forums.juniper.net Open in urlscan Pro
208.74.207.25 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Submission: On February 20 via api (February 20th 2020, 8:13:33 am UTC) from DE

Summary HTTP 161 Redirects Links 115 Behaviour Indicators

Summary

This website contacted 41 IPs in 8 countries across 33 domains to perform 161 HTTP transactions. The main IP is 208.74.207.25, located in United States and belongs to LITHIUM, US. The main domain is forums.juniper.net.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on August 16th 2019. Valid for: a year.

This is the only time forums.juniper.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	208.74.207.25 208.74.207.25	40402 (LITHIUM) (LITHIUM)
21	23.210.248.45 23.210.248.45	16625 (AKAMAI-AS) (AKAMAI-AS)
3	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
1	2a00:1450:400... 2a00:1450:4001:81b::200a	15169 (GOOGLE) (GOOGLE)
2	2001:4de0:ac1... 2001:4de0:ac19::1:b:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
27	93.184.220.97 93.184.220.97	15133 (EDGECAST) (EDGECAST)
1 13	2a02:26f0:6c0... 2a02:26f0:6c00:180::720	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	93.184.220.41 93.184.220.41	15133 (EDGECAST) (EDGECAST)
2	52.208.212.211 52.208.212.211	16509 (AMAZON-02) (AMAZON-02)
2	13.35.253.82 13.35.253.82	16509 (AMAZON-02) (AMAZON-02)
1	143.204.202.70 143.204.202.70	16509 (AMAZON-02) (AMAZON-02)
2	18.139.76.45 18.139.76.45	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
2	208.74.205.254 208.74.205.254	40402 (LITHIUM) (LITHIUM)
1	2a00:1450:400... 2a00:1450:4001:81e::200a	15169 (GOOGLE) (GOOGLE)
6	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 5	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1	65.52.62.25 65.52.62.25	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	34.241.149.220 34.241.149.220	16509 (AMAZON-02) (AMAZON-02)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	185.33.223.218 185.33.223.218	29990 (ASN-APPNEX) (ASN-APPNEX)
1 3	13.35.253.61 13.35.253.61	16509 (AMAZON-02) (AMAZON-02)
1	66.117.29.4 66.117.29.4	15224 (OMNITURE) (OMNITURE)
7	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
3	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	2a00:1450:400... 2a00:1450:4001:817::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:815::2003	15169 (GOOGLE) (GOOGLE)
7	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	104.103.106.126 104.103.106.126	16625 (AKAMAI-AS) (AKAMAI-AS)
9	13.35.253.84 13.35.253.84	16509 (AMAZON-02) (AMAZON-02)
1 2	172.217.22.38 172.217.22.38	15169 (GOOGLE) (GOOGLE)
1 2	172.217.16.134 172.217.16.134	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE)
2 2	209.167.231.17 209.167.231.17	7160 (NETDYNAMICS) (NETDYNAMICS)
1	23.45.237.36 23.45.237.36	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
1 5	2a00:1450:400... 2a00:1450:4001:820::2004	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
2	143.204.202.55 143.204.202.55	16509 (AMAZON-02) (AMAZON-02)
2 2	52.49.193.31 52.49.193.31	16509 (AMAZON-02) (AMAZON-02)
3	52.72.180.134 52.72.180.134	14618 (AMAZON-AES) (AMAZON-AES)
2	13.35.253.48 13.35.253.48	16509 (AMAZON-02) (AMAZON-02)
2	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE)
2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
4	2a00:1450:400... 2a00:1450:4001:81a::2002	15169 (GOOGLE) (GOOGLE)
161	41

5 208.74.207.25 (United States)

ASN40402 (LITHIUM, US)
PTR: jnet.lithium.com

forums.juniper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 23.210.248.45 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-45.deploy.static.akamaitechnologies.com

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac19::1:b:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 93.184.220.97 (London, United Kingdom)

ASN15133 (EDGECAST, US)

jnet.i.lithium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a02:26f0:6c00:180::720 (Ascension Island) 1 redirects

ASN20940 (AKAMAI-ASN1, US)

www.juniper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 93.184.220.41 (London, United Kingdom)

ASN15133 (EDGECAST, US)

cloud.webtype.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.208.212.211 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-212-211.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.35.253.82 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-82.fra6.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.202.70 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-70.fra53.r.cloudfront.net

api.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.139.76.45 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-139-76-45.ap-southeast-1.compute.amazonaws.com

junipernetworks.d2.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 208.74.205.254 (United States)

ASN40402 (LITHIUM, US)
PTR: sjc1-secure06.stage.lithium.com

forumstage.juniper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.112.157 (Frankfurt am Main, Germany) 1 redirects

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.52.62.25 (Chicago, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

pls.webtype.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.241.149.220 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-241-149-220.eu-west-1.compute.amazonaws.com

junipernetworks.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.223.218 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 313.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.35.253.61 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-61.fra6.r.cloudfront.net

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.29.4 (United States)

ASN15224 (OMNITURE, US)

junipernetworks.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:817::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.103.106.126 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-103-106-126.deploy.static.akamaitechnologies.com

img.en25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 13.35.253.84 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-84.fra6.r.cloudfront.net

secure.rmulus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
research.juniper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.22.38 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s16-in-f38.1e100.net

5922977.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.134 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f134.1e100.net

3872718.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.167.231.17 (United States) 2 redirects

ASN7160 (NETDYNAMICS, US)
PTR: e017.en25.com

s1229.t.eloqua.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.45.237.36 (United States)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-237-36.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9a (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:820::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.202.55 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-55.fra53.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.49.193.31 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-193-31.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.72.180.134 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-180-134.compute-1.amazonaws.com

lookups.rmulus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.35.253.48 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-48.fra6.r.cloudfront.net

collect.rmulus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f98.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland)

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
27	lithium.com jnet.i.lithium.com	2 MB
25	juniper.net 1 redirects forums.juniper.net www.juniper.net forumstage.juniper.net research.juniper.net	2 MB
21	adobedtm.com assets.adobedtm.com	107 KB
10	doubleclick.net 3 redirects 5922977.fls.doubleclick.net 3872718.fls.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	8 KB
9	rmulus.com secure.rmulus.com lookups.rmulus.com collect.rmulus.com	30 KB
8	twitter.com 1 redirects platform.twitter.com analytics.twitter.com	2 KB
7	t.co t.co	1 KB
6	facebook.net connect.facebook.net	427 KB
5	google.de www.google.de	549 B
5	google.com 1 redirects www.google.com	620 B
4	company-target.com 1 redirects api.company-target.com segments.company-target.com	3 KB
4	google-analytics.com www.google-analytics.com	18 KB
4	ads-twitter.com static.ads-twitter.com	8 KB
3	googletagmanager.com www.googletagmanager.com	103 KB
3	facebook.com www.facebook.com	354 B
3	omtrdc.net junipernetworks.d2.sc.omtrdc.net junipernetworks.tt.omtrdc.net	1 KB
3	demandbase.com scripts.demandbase.com api.demandbase.com	62 KB
3	demdex.net dpm.demdex.net junipernetworks.demdex.net	2 KB
3	webtype.com cloud.webtype.com pls.webtype.com	65 KB
3	fontawesome.com use.fontawesome.com	13 KB
2	linkedin.com px.ads.linkedin.com	80 B
2	googleadservices.com www.googleadservices.com	20 KB
2	bidr.io 2 redirects match.prod.bidr.io	1019 B
2	eloqua.com 2 redirects s1229.t.eloqua.com	2 KB
2	adnxs.com 2 redirects secure.adnxs.com	2 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com	29 KB
2	googleapis.com ajax.googleapis.com fonts.googleapis.com	30 KB
1	bluekai.com tags.bluekai.com	744 B
1	en25.com img.en25.com	3 KB
1	gstatic.com fonts.gstatic.com	14 KB
1	ml-api.io attr.ml-api.io	484 B
1	ml-attr.com 1 redirects s.ml-attr.com	277 B
1	everesttech.net 1 redirects cm.everesttech.net	554 B
161	33

	Domain	Requested by
27	jnet.i.lithium.com	forums.juniper.net use.fontawesome.com
21	assets.adobedtm.com	forums.juniper.net assets.adobedtm.com
13	www.juniper.net	1 redirects forums.juniper.net forumstage.juniper.net
7	analytics.twitter.com	static.ads-twitter.com
7	t.co	forums.juniper.net static.ads-twitter.com
6	connect.facebook.net	assets.adobedtm.com connect.facebook.net forums.juniper.net
5	research.juniper.net	secure.rmulus.com research.juniper.net
5	www.google.de	forums.juniper.net research.juniper.net
5	www.google.com	1 redirects forums.juniper.net research.juniper.net
5	forums.juniper.net	forums.juniper.net jnet.i.lithium.com
4	googleads.g.doubleclick.net	www.googleadservices.com
4	www.google-analytics.com	forums.juniper.net
4	secure.rmulus.com	assets.adobedtm.com secure.rmulus.com
4	static.ads-twitter.com	assets.adobedtm.com forums.juniper.net
3	lookups.rmulus.com	secure.rmulus.com
3	www.googletagmanager.com	forums.juniper.net research.juniper.net
3	www.facebook.com	forums.juniper.net connect.facebook.net
3	use.fontawesome.com	forums.juniper.net use.fontawesome.com
2	px.ads.linkedin.com	research.juniper.net
2	www.googleadservices.com	www.googletagmanager.com
2	collect.rmulus.com	forums.juniper.net research.juniper.net
2	segments.company-target.com	1 redirects forums.juniper.net
2	match.prod.bidr.io	2 redirects
2	api.company-target.com	scripts.demandbase.com
2	stats.g.doubleclick.net	1 redirects forums.juniper.net
2	s1229.t.eloqua.com	2 redirects
2	3872718.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	5922977.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	secure.adnxs.com	2 redirects
2	forumstage.juniper.net	forums.juniper.net
2	junipernetworks.d2.sc.omtrdc.net	assets.adobedtm.com forums.juniper.net
2	scripts.demandbase.com	assets.adobedtm.com
2	dpm.demdex.net	assets.adobedtm.com forums.juniper.net
2	cloud.webtype.com	forums.juniper.net
2	maxcdn.bootstrapcdn.com	forums.juniper.net
1	tags.bluekai.com	forums.juniper.net
1	img.en25.com	forums.juniper.net
1	fonts.gstatic.com	jnet.i.lithium.com
1	junipernetworks.tt.omtrdc.net	assets.adobedtm.com
1	attr.ml-api.io	forums.juniper.net
1	s.ml-attr.com	1 redirects
1	junipernetworks.demdex.net	assets.adobedtm.com
1	pls.webtype.com	forums.juniper.net
1	platform.twitter.com	1 redirects
1	fonts.googleapis.com	forums.juniper.net
1	cm.everesttech.net	1 redirects
1	api.demandbase.com	assets.adobedtm.com
1	ajax.googleapis.com	forums.juniper.net
161	48

This site contains links to these domains. Also see Links.

Domain
www.juniper.net
support.juniper.net
my.juniper.net
license.juniper.net
entitlementsearch.juniper.net
kb.juniper.net
prsearch.juniper.net
apps.juniper.net
learningportal.juniper.net
openlearning.juniper.net
cloud.contentraven.com
www.certmetrics.com
iam-signin.juniper.net
userregistration.juniper.net
www.facebook.com
twitter.com
plus.google.com
www.linkedin.com
foo.net
www.rfidjournal.com
blog.avast.com
arstechnica.com
www.joesandbox.com
www.hybrid-analysis.com
khoros.com
investor.juniper.net
newsroom.juniper.net
events.juniper.net
partners.juniper.net
www.youtube.com
www.instagram.com

Subject Issuer	Validity	Valid
secure07.lithium.com DigiCert SHA2 High Assurance Server CA	`2019-08-16` - `2020-09-02`	a year	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
*.i.lithium.com Go Daddy Secure Certificate Authority - G2	`2019-11-28` - `2022-01-28`	2 years	crt.sh
www.juniper.net DigiCert SHA2 Secure Server CA	`2019-05-17` - `2020-08-15`	a year	crt.sh
s1.wac.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2018-11-05` - `2020-11-20`	2 years	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
*.demandbase.com Go Daddy Secure Certificate Authority - G2	`2018-09-20` - `2020-11-19`	2 years	crt.sh
*.d2.sc.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2019-04-23` - `2020-04-14`	a year	crt.sh
secure06.stage.lithium.com DigiCert SHA2 High Assurance Server CA	`2019-12-11` - `2020-03-19`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-01-16` - `2020-04-15`	3 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
*.webtype.com Sectigo RSA Domain Validation Secure Server CA	`2019-06-30` - `2021-07-12`	2 years	crt.sh
*.ml-api.io Amazon	`2020-02-06` - `2021-03-06`	a year	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2020-11-25`	3 years	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh
*.en25.com DigiCert SHA2 Secure Server CA	`2019-06-21` - `2020-08-19`	a year	crt.sh
rmulus.com Amazon	`2019-04-23` - `2020-05-23`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
odc-prod-01.oracle.com DigiCert ECC Secure Server CA	`2018-12-10` - `2020-03-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
*.company-target.com Go Daddy Secure Certificate Authority - G2	`2019-06-19` - `2021-08-18`	2 years	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2019-05-29` - `2021-06-29`	2 years	crt.sh
www.google.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Frame ID: A09151E04DF05C8A087DDA96D1E52403
Requests: 119 HTTP requests in this frame

Frame: https://junipernetworks.demdex.net/dest5.html?d_nsid=0
Frame ID: DDC83AE5B30971C39870A3992576A1CF
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5caeb27864746d4fde0010d0.html
Frame ID: ADB1C71028D40C41291DC3BD80C04030
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5d487bc864746d25bd00073a.html
Frame ID: A4E225830CADA4DBED75610ADDCDDFC6
Requests: 1 HTTP requests in this frame

Frame: https://5922977.fls.doubleclick.net/activityi;dc_pre=CLiZhszX3-cCFRzjuwgdWIIH5w;src=5922977;type=pageview;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5554463215346.928
Frame ID: CA651B3F75E58A33E1BE11FF60C4B483
Requests: 1 HTTP requests in this frame

Frame: https://3872718.fls.doubleclick.net/activityi;dc_pre=CJuPg8zX3-cCFRPDuwgd1XEOrw;src=3872718;type=gojpnet;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4508745446987.625
Frame ID: D330FFFC1D11C22A77C2E8BA0C6B61E4
Requests: 1 HTTP requests in this frame

Frame: https://secure.rmulus.com/?_pevId=iq9gaz5IwncjdrSVAg6zajYWO8JWXuOo-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=enabled&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dpgvw%26_pdataSource%3Dweb%26_pqStr%3Denabled%26jnpr_vID%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&jnpr_vID=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pidSource=secure.rmulus.com&_pidName=rmulusId&_pclIp=disabled&_plkpPrfl=disabled
Frame ID: 7BB0231328247D818150D94FDA82F872
Requests: 1 HTTP requests in this frame

Frame: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
Frame ID: 730AA0CF89371551A42B884AC739C537
Requests: 19 HTTP requests in this frame

Frame: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
Frame ID: E1E5F4286B38A0D2C1BEFB2FA522F654
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Adobe DTM (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/assets.adobedtm.com\//i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<script[^>]* src=[^>]+fontawesome(?:\.js)?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

161
Requests

100 %
HTTPS

31 %
IPv6

33
Domains

48
Subdomains

41
IPs

8
Countries

5014 kB
Transfer

12270 kB
Size

0
Cookies

115 Outgoing links

These are links going to different origins than the main page.

URL: https://www.juniper.net/us/en/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/
Title:

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/why-juniper/
Title: Why Juniper?

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/case-studies-customer-success/
Title: Customer Success

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/partners/
Title: Partnership

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/insights/
Title: Thought Leadership

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/how-to-buy/
Title: How to Buy

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/
Title: Products & Solutions

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/ipc/
Title: Identity & Policy Control

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/network-edge-services/
Title: Network Edge Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/nos/
Title: Network Operating System

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/packet-optical/
Title: Packet Optical

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/routing/
Title: Routers

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/management-operations-sdn/
Title: SDN, Management & Operations

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/security/
Title: Security

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/switching/
Title: Switches

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/wireless/
Title: Wireless

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/a-z/
Title: All Products A-Z

Search URL Search Domain Scan URL

URL: https://www.juniper.net/support/eol/
Title: End of Life

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/
Title: Solutions

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/enterprise/
Title: Enterprise

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/cloud/
Title: Cloud Provider

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/service-provider/
Title: Service Provider

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/automation/
Title: Automation

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/metro/
Title: Metro

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/multicloud/
Title: Multicloud

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/security/
Title: Security

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/segment-routing/
Title: Segment Routing

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/sd-wan/
Title: SD-WAN

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/cable/
Title: Cable

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/financial/
Title: Financial Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/federal-government/
Title: Federal Government

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/healthcare/
Title: Healthcare

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/mobile-provider/
Title: Mobile Provider

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/nfv/telco-cloud/
Title: Telco

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/
Title: Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/advisory-services/
Title: Advisory Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/implementation-services/
Title: Implementation Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/maintenance-services/
Title: Maintenance Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/managed-services/
Title: Managed Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/onsite-technical-services/
Title: Onsite Technical Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/remote-operational-services/
Title: Remote Operational Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/taas/
Title: Testing as a Service

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/
Title: Support

Search URL Search Domain Scan URL

URL: https://my.juniper.net/#dashboard/overview
Title: MyJuniper

Search URL Search Domain Scan URL

URL: https://my.juniper.net/#dashboard/servicerequests
Title: Service Request Management

Search URL Search Domain Scan URL

URL: https://my.juniper.net/#dashboard/rmas
Title: RMA Management

Search URL Search Domain Scan URL

URL: https://license.juniper.net/licensemanage/
Title: Product License Keys

Search URL Search Domain Scan URL

URL: https://entitlementsearch.juniper.net/entitlementsearch/
Title: Product Entitlement Search

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/uib/index.page
Title: Update Install Base

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/requesting-support/
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=ex
Title: EX Series

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=mx
Title: MX Series

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=srx
Title: SRX Series

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=space
Title: Junos Space

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=ssg
Title: SSG Series

Search URL Search Domain Scan URL

URL: https://kb.juniper.net/
Title: Knowledge Base

Search URL Search Domain Scan URL

URL: https://www.juniper.net/documentation/
Title: TechLibrary

Search URL Search Domain Scan URL

URL: https://prsearch.juniper.net/InfoCenter/index?page=prsearch
Title: Problem Report Search

Search URL Search Domain Scan URL

URL: https://apps.juniper.net/home/
Title: Pathfinder

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/security/
Title: Security Intelligence

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/security/report-vulnerability/
Title: Report a Vulnerability

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/
Title: Training

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=10735
Title: Schedule of Classes

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=EDU-JUN-ALL-HOME
Title: All Access Training Pass

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=10072
Title: On-demand Courses

Search URL Search Domain Scan URL

URL: https://openlearning.juniper.net/
Title: Open Learning

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=EDU-JUN-LPATHS-HOME
Title: Learning Paths

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=5798
Title: Getting Started

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/certification/
Title: Certification

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/certification/getting-started/
Title: Getting Started

Search URL Search Domain Scan URL

URL: https://cloud.contentraven.com/junosgenius/login
Title: Practice Tests

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/certification/exam_registration.page
Title: Exam Registration

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/certification/recertification/
Title: Recertification

Search URL Search Domain Scan URL

URL: https://www.certmetrics.com/juniper/login.aspx?ReturnUrl=%2fjuniper%2f
Title: Manage My Certs

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/try/
Title: Try Now Risk Free

Search URL Search Domain Scan URL

URL: https://iam-signin.juniper.net/home/junipernetworksinc_forumsjnetlithium_1/0oa1i80jjeoOXVFbx0h8/aln1i80l72sYQypO60h8?RelayState=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478
Title: Sign In

Search URL Search Domain Scan URL

URL: https://userregistration.juniper.net/entitlement/setupAccountInfo.do
Title: Register

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/legal-notices/j-net-terms/
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/legal-notices/j-net-guidelines/
Title: User Guidelines

Search URL Search Domain Scan URL

URL: https://www.juniper.net/customers/support/
Title: Support

Search URL Search Domain Scan URL

URL: http://www.facebook.com/sharer/sharer.php?u=https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Title:

Search URL Search Domain Scan URL

URL: http://twitter.com/share?url=https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478&text=Dota3:%20Is%20your%20Internet%20of%20Things%20device%20moonlighting?via=%3CUSERNAME%3E
Title:

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Title:

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?url=https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478&title=Dota3:%20Is%20your%20Internet%20of%20Things%20device%20moonlighting?&summary=Dissecting%20the%20evolution%20of%20malware%20gives%20researchers%20insights%20into%20the%20knowledge%20of,%20and%20development%20processes%20used%20by,%20malware%20authors.%20Dota3,%20active%20in%20the%20wild,%20offers%20a%20unique%20opportunity%20to%20examine%20a%20strain%20of%20malware%20during%20what%20appears%20to%20be...
Title:

Search URL Search Domain Scan URL

URL: http://foo.net/zhyux22843/rss/message?board.id=threatresearch&message.id=473478
Title:

Search URL Search Domain Scan URL

URL: https://www.rfidjournal.com/articles/view?4986
Title: until around 1999

Search URL Search Domain Scan URL

URL: https://blog.avast.com/iot-devices-around-the-world
Title: Avast provided statistics

Search URL Search Domain Scan URL

URL: https://arstechnica.com/science/2020/01/a-deep-dive-into-the-apollo-guidance-computer-and-the-hack-that-saved-apollo-14/
Title: land Apollo astronauts on the moon

Search URL Search Domain Scan URL

URL: https://www.joesandbox.com/analysis/180632/0/html
Title: is available

Search URL Search Domain Scan URL

URL: https://www.hybrid-analysis.com/sample/0f754eab280e5ff0b65c46bdd1cc16e8aff944c834379df2632cd5f261afe3bb?environmentId=300
Title: reported

Search URL Search Domain Scan URL

URL: https://iam-signin.juniper.net/home/junipernetworksinc_forumsjnetlithium_1/0oa1i80jjeoOXVFbx0h8/aln1i80l72sYQypO60h8?redirectreason=permissiondenied&RelayState=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%23comment-on-this
Title: Comment

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/dm/day-one-million/
Title: Day One Million! Update your Library with our Day One Book Bundles!

Search URL Search Domain Scan URL

URL: https://khoros.com/powered-by-khoros

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/corporate-responsibility/
Title: Corporate Responsibility

Search URL Search Domain Scan URL

URL: https://investor.juniper.net/investor-relations/default.aspx
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://newsroom.juniper.net/
Title: Newsroom

Search URL Search Domain Scan URL

URL: https://events.juniper.net/
Title: Events

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/press-center/images/
Title: Image Library

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/partners/locator/
Title: Find a Partner

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/partners/sell-juniper/
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://partners.juniper.net/partnercenter/index.page
Title: Partner Login

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/forms/opt-in-knowledge-preferences/?utm_medium=website&utm_source=juniper&cid=subscriptionspage
Title: Sign up

Search URL Search Domain Scan URL

URL: https://www.facebook.com/JuniperNetworks/
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/JuniperNetworks/
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/junipernetworks
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/juniper-networks
Title:

Search URL Search Domain Scan URL

URL: https://www.instagram.com/junipernetworks/
Title:

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/feedback/
Title: Feedback

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/site-map/
Title: Site Map

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/legal-notices/
Title: Legal Notices

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://www.juniper.net/techpubs/assets/css/style/style.min.css HTTP 301
https://www.juniper.net/documentation/assets/css/style/style.min.css

Request Chain 26

https://cm.everesttech.net/cm/dd?d_uuid=59814116250527520020707159955634197034 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk4-kQAAAbh16i3-

Request Chain 52

https://platform.twitter.com/oct.js HTTP 301
https://static.ads-twitter.com/oct.js

Request Chain 63

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3djuniper.net%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3djuniper.net%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253djuniper.net%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=juniper.net&pId=1914446610815133731

Request Chain 103

https://5922977.fls.doubleclick.net/activityi;src=5922977;type=pageview;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5554463215346.928 HTTP 302
https://5922977.fls.doubleclick.net/activityi;dc_pre=CLiZhszX3-cCFRzjuwgdWIIH5w;src=5922977;type=pageview;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5554463215346.928

Request Chain 104

https://3872718.fls.doubleclick.net/activityi;src=3872718;type=gojpnet;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4508745446987.625 HTTP 302
https://3872718.fls.doubleclick.net/activityi;dc_pre=CJuPg8zX3-cCFRPDuwgd1XEOrw;src=3872718;type=gojpnet;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4508745446987.625

Request Chain 108

https://s1229.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1229&ref2=elqNone&tzo=-60&ms=969&optin=disabled HTTP 302
https://s1229.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1229&ref2=elqNone&tzo=-60&ms=969&optin=disabled&elqCookie=1 HTTP 302
https://tags.bluekai.com/site/37366?vid=cfc6022b4d2448caae1f1f0f50f63f2d

Request Chain 112

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-2343305-1&cid=2081577110.1582186386&jid=620775597&gjid=1172925325&_gid=534476128.1582186386&_u=YGDAgEAB~&z=1357659231 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=2081577110.1582186386&jid=620775597&_v=j81&z=1357659231 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=2081577110.1582186386&jid=620775597&_v=j81&z=1357659231&slf_rd=1&random=1358653953

Request Chain 115

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AAGSj068nH8AAC94ZbYKVg HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAGSj068nH8AAC94ZbYKVg&verifyHash=aa76dfd0e2932f175a820543203182b1b67ee6d8

161 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set 473478 Show response
forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/ 239 KB
49 KB 899ms
425ms Document
text/html 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to

Full URL

https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

3cbe26cb08e96b3a719322a75e5f0f3e1615f1aabff04bad346b0a08af232194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Host: forums.juniper.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Date: Thu, 20 Feb 2020 08:13:04 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000;includeSubDomains
Set-Cookie: LiSESSIONID=A060E0723F17D3E5B3A7EB3A709F8694; Path=/; Secure; HttpOnly LithiumUserInfo=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ LithiumUserSecure=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ LithiumVisitor=~245su9mvrWuXOpghv~bwVHNOGiaGF0EPDp4El42Bxjb-15mzgeabusPnFBNsaSQGfBkPOgMDP0rR-Pm9kmXb0wHkejortppU-n1ZK89w..; Expires=Sun, 17-Feb-2030 08:13:04 GMT; Path=/; HttpOnly
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, private
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 49606
Connection: close
Content-Type: text/html;charset=UTF-8

GET
H2 200 satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/ 220 KB
56 KB 28ms
25ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7c9a167fcb4f690dc41db9f58f3ee6a20d3bba39316f2b46c8031c6d8ca300f1

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:22 GMT
server: AkamaiNetStorage
etag: "0857b856340d83f6f1ce4a9b3c416da7:1582139302.127986"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 56773
expires: Thu, 20 Feb 2020 09:13:04 GMT

GET
H2 200 878544ee83.js Show response
use.fontawesome.com/ 9 KB
4 KB 38ms
35ms Script
text/javascript 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/878544ee83.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 79e16119ceda988947279eb9addd1869b4270af3967b69ec9e09713ae4b6572b

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Thu, 06 Jul 2017 20:04:23 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 8516237B55A1345E
etag: W/"734c7204bf19e6c6fe89c31ce2ed51a6"
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=0, private, must-revalidate
x-amz-id-2: 7hG4Mt7S1IVbL2byDpZiYCLZME3I6GwctNcdteUIXRNH0RX7D9+4yS+G/7grac9V1ybJ0lWb4Zk=

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.1.4/ 82 KB
29 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:81b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 01 Feb 2020 08:31:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1640469
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29725
x-xss-protection: 0
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 31 Jan 2021 08:31:55 GMT

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 118 KB
19 KB 11ms
8ms Stylesheet
text/css 2001:4de0:ac19::1:b:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: style
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 12 Dec 2018 18:34:07 GMT
access-control-allow-origin: *
etag: "1544639647"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 19740

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 36 KB
10 KB 11ms
8ms Script
text/javascript 2001:4de0:ac19::1:b:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: 53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 12 Dec 2018 18:33:51 GMT
access-control-allow-origin: *
etag: "1544639631"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 9832

GET
H2 200 juniperresponsive.css
jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/ 2 MB
248 KB 81ms
18ms Stylesheet
text/css 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BB8) /

Resource Hash

85d9f9ab745f8b1dd6c6dc27722498c9eaf0f1e864242b01c7f396a5fb3aa3dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Mon, 25 Nov 2019 08:21:03 GMT
server: ECS (amb/6BB8)
age: 473549
vary: Accept-Encoding
x-cache: HIT
content-type: text/css;charset=UTF-8
status: 200
cache-control: s-maxage=1408554
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 253467
expires: Fri, 19 Feb 2021 08:13:04 GMT

GET
H2 200 vtoolkit-extras.css
www.juniper.net/us/en/community/css/ 4 KB
2 KB 55ms
6ms Stylesheet
text/css 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/us/en/community/css/vtoolkit-extras.css

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

626ef4978a3758ced595afe37b89812432ef49fe3f967d2cd8e1321459b3a9b8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
status: 200
access-control-max-age: 1000
strict-transport-security: max-age=31536000
content-length: 1365
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 16 Sep 2014 23:06:53 GMT
server: Apache
date: Thu, 20 Feb 2020 08:13:04 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=152967
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 grunticon.loader.js Show response
www.juniper.net/assets/svg/ 804 B
1001 B 57ms
8ms Script
application/javascript 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/svg/grunticon.loader.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

b1110f2c7ae9f0a22977c4df6431fdfef92d1e8223f9734713e57aeb2ee96fcf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
status: 200
access-control-max-age: 1000
strict-transport-security: max-age=31536000
content-length: 514
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Mon, 02 Oct 2017 07:57:28 GMT
server: Apache
date: Thu, 20 Feb 2020 08:13:04 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=137750
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 lib.min.js Show response
www.juniper.net/assets/library/ 202 KB
65 KB 58ms
10ms Script
application/javascript 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/library/lib.min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

eec3860fdc0bff086a73a04051948c4e76ea29a6b61eaa870083739555b83f64

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
status: 200
access-control-max-age: 1000
strict-transport-security: max-age=31536000
content-length: 66076
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Mon, 02 Oct 2017 07:57:27 GMT
server: Apache
date: Thu, 20 Feb 2020 08:13:04 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=26554
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr.min.js Show response
www.juniper.net/assets/scripts/ 339 KB
103 KB 64ms
16ms Script
application/javascript 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.juniper.net/assets/scripts/jnpr.min.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43 /
Resource Hash: 2c9f1c57bc31c65cdb84a1c44c0c91fc88799512fd87c5bc6e52b21f69abd5d0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Fri, 09 Nov 2018 18:57:29 GMT
server: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43
access-control-allow-origin: *
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: application/javascript
status: 200
access-control-max-age: 1000
cache-control: public, max-age=140083
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
content-length: 104943
x-ua-compatible: IE=edge,chrome=1

GET
H2

200

style.min.css
www.juniper.net/documentation/assets/css/style/
Redirect Chain

https://www.juniper.net/techpubs/assets/css/style/style.min.css
https://www.juniper.net/documentation/assets/css/style/style.min.css

2 MB
405 KB

287ms
287ms

Stylesheet
text/css

2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/documentation/assets/css/style/style.min.css

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

79340c32d5422c3331db60c78f9854b0d9c0a9bd0f9c454b7398734c1b990658

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
status: 200
access-control-max-age: 1000
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Mon, 17 Oct 2016 23:30:57 GMT
server: Apache
date: Thu, 20 Feb 2020 08:13:05 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=259200, public
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

Redirect headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
status: 301
access-control-max-age: 1000
content-length: 275
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
server: Apache
location: https://www.juniper.net/documentation/assets/css/style/style.min.css
date: Thu, 20 Feb 2020 08:13:04 GMT
strict-transport-security: max-age=31536000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: text/html; charset=iso-8859-1
access-control-allow-origin: *
cache-control: max-age=5
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
expires: Thu, 20 Feb 2020 08:13:09 GMT

GET
H2 200 05cb80fc-3221-476f-983d-76dfa0b1370c.css
cloud.webtype.com/css/ 38 KB
9 KB 73ms
18ms Stylesheet
text/css 93.184.220.41
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cloud.webtype.com/css/05cb80fc-3221-476f-983d-76dfa0b1370c.css
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.41 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BC8) /
Resource Hash: 3eadffc329fb1c32ee10e809962cb4114a71d92b0f30db0b9ba9bef6abc91015

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 31 Jan 2018 08:43:22 GMT
server: ECS (amb/6BC8)
age: 225245
etag: "870837579"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
status: 200
cache-control: max-age=604800
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8995
expires: Thu, 27 Feb 2020 08:13:04 GMT

GET
H2 200 lia-scripts-head-min.js Show response
jnet.i.lithium.com/t5/scripts/EF7B13D9B64EB8BBD9C87DD3095E9284/ 12 KB
4 KB 114ms
51ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/EF7B13D9B64EB8BBD9C87DD3095E9284/lia-scripts-head-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B89) /

Resource Hash

01eb8f5a91c70faa5681a3048eab75e78f30b4c4e0c04f8afbb46bfa98371ec0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:14:14 GMT
server: ECS (amb/6B89)
age: 283
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=2364
strict-transport-security: max-age=31536000;includeSubDomains
content-length: 4316
expires: Thu, 18 Feb 2021 11:35:59 GMT

GET
H2 200 lia-scripts-head-min.js Show response
jnet.i.lithium.com/t5/scripts/211F6EC4D6F385A1FE3DDCF161E416CD/ 4 KB
2 KB 112ms
51ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/211F6EC4D6F385A1FE3DDCF161E416CD/lia-scripts-head-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BA6) /

Resource Hash

8febd8b0e9b817a31d401574d8f8aaeb5003d76c2c1afa9da932fa0990685b53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:13:41 GMT
server: ECS (amb/6BA6)
age: 283
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=2371
strict-transport-security: max-age=31536000;includeSubDomains
content-length: 1464
expires: Thu, 18 Feb 2021 11:35:59 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 374 B
1 KB 49ms
49ms XHR
application/json 52.208.212.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=D206123F524450F50A490D45%40AdobeOrg&d_nsid=0&ts=1582186384538

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.208.212.211 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-208-212-211.eu-west-1.compute.amazonaws.com

Software

Resource Hash

e731c0c50fe7048c11f72826a363a5f9d19193996377faa4f8542c0d654a0151

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v061-0f1e440ae.edge-irl1.demdex.com 5.65.0.20200212140016 2ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: 8K8k3r/USJA=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://forums.juniper.net
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 308
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/ 74 KB
27 KB 39ms
38ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9912c03b52a7cb0fc11bde58e200010eca671219552929b31be4c2e26c0e10c3

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:23 GMT
server: AkamaiNetStorage
etag: "b8f6521187f987f1e079c5d7031aabec:1582139303.304738"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 27369
expires: Thu, 20 Feb 2020 09:13:04 GMT

GET
H2 200 satellite-57b12a8364746d4d41000291.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 3 KB
1 KB 40ms
40ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57b12a8364746d4d41000291.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e8a8cd48f7f93a8c8d708eda1f3f9c6ddd886c3f6c38eee67aeac98897b09510

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:42 GMT
server: AkamaiNetStorage
etag: "3b522f8dca2496b57a53408a29d518bb:1582139322.471537"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 984
expires: Thu, 20 Feb 2020 09:13:04 GMT

GET
H2 200 wRPiG49f.min.js Show response
scripts.demandbase.com/adobeanalytics/ 5 KB
2 KB 66ms
20ms Script
application/javascript 13.35.253.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/adobeanalytics/wRPiG49f.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.82 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-82.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c30c04eb35d4ff5c75690016858f8678b3c5ee7c68ec4cd76b71573b50a23943

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: AzsFJIGyGDhT_pDrBVxBwyrIy6KuSZqJ
content-encoding: gzip
last-modified: Tue, 29 Oct 2019 22:00:33 GMT
server: AmazonS3
age: 70871
date: Wed, 19 Feb 2020 12:31:54 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: Bk7rrGH-UMyWaJUKWCcNVpfQSZAsR-F7-_5d6w41UzSudXlTli6mHg==
via: 1.1 08bbe291f260c2b80a00874a80ade07c.cloudfront.net (CloudFront)

GET
H/1.1 200
OK ip.json Show response
api.demandbase.com/api/v2/ 462 B
923 B 140ms
69ms Script
application/javascript 143.204.202.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.demandbase.com/api/v2/ip.json?key=364bbfa27ca300ef9638e9d163c1fb03&callback=Dmdbase_CDC.callback
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.70 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-70.fra53.r.cloudfront.net
Software: nginx /
Resource Hash: abeaf4a2dde5b673ce9957f08cb803a54d6b82b90bc1fa958a8335168d501c8b

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 20 Feb 2020 08:13:04 GMT
Identification-Source: CENTRAL
X-Amz-Cf-Pop: FRA53-C1
Transfer-Encoding: chunked
X-Cache: Miss from cloudfront
Connection: keep-alive
Request-ID: 2dfb0b2c-5478-4680-9eb1-bd5e7093ae44
Content-Encoding: gzip
Pragma: no-cache
Server: nginx
Vary: Accept-Encoding, Origin
Content-Type: application/javascript;charset=utf-8
Via: 1.1 d7524ff4a82155dd51a24800cf39deec.cloudfront.net (CloudFront)
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Api-Version: v2
X-Amz-Cf-Id: XRXn1bkkbHe-z7MY0u-1lXgobvrWmddkiZJ9hPbonUhG08ZiYRVGGw==
Expires: Wed, 19 Feb 2020 08:13:04 GMT

GET
H2 200 satellite-5bd31e9364746d6b860045a0.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 883 B
679 B 39ms
38ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5bd31e9364746d6b860045a0.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 179f42988ae4cab77687b27656fc69ab3fa07efbcf6279ac1bef85ac0688e69d

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:37 GMT
server: AkamaiNetStorage
etag: "b3998ca07afe5ed1d91aa042d31218db:1582139317.320586"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 434
expires: Thu, 20 Feb 2020 09:13:04 GMT

GET
H2 200 satellite-57d9c57464746d4d3e010a86.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 2 KB
1001 B 41ms
40ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57d9c57464746d4d3e010a86.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7ee39e6b76207efc841a6882a2af5241490e1a2161c4e13790f78fb4dbfdde28

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 15:13:07 GMT
server: AkamaiNetStorage
etag: "458ad1cb95d004fd440d76d56ca277df:1582125187.473863"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 755
expires: Thu, 20 Feb 2020 09:13:04 GMT

GET
H2 200 satellite-58a48a3864746d025c00d79f.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 156 B
373 B 45ms
44ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-58a48a3864746d025c00d79f.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7da66ec546c027bfe5b9ca59aa2225cfaa5f0d68f96801f31186878c0fa853f8

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:37 GMT
server: AkamaiNetStorage
etag: "bbf4e24515459a70357a852ca14861ff:1582139317.03016"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 129
expires: Thu, 20 Feb 2020 09:13:04 GMT

GET
H2 200 satellite-5cb8c2a664746d2308000a38.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 628 B
672 B 23ms
23ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5cb8c2a664746d2308000a38.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c74679537a89890b260d93e19aad5f4cc95a230623a945ffcc3d981fc13a1adf

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:34 GMT
server: AkamaiNetStorage
etag: "d0c9f868e386e1a9e35ae77ce39994c4:1582139314.935187"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 427
expires: Thu, 20 Feb 2020 09:13:04 GMT

GET
H2 200 satellite-5ced369c64746d5ad2000705.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 802 B
663 B 24ms
24ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5ced369c64746d5ad2000705.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3e84bcc6469e170029339c0b60b522671ca5d4298578308ec882df95f7badd9c

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:35 GMT
server: AkamaiNetStorage
etag: "95e1885cf743f564cb30ce957416ea37:1582139315.859817"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 417
expires: Thu, 20 Feb 2020 09:13:05 GMT

GET
H2 200 satellite-5da0c41564746d1a08001540.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 421 B
515 B 24ms
23ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5da0c41564746d1a08001540.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e28195ef556c2e1f2d22ff939f487f10a32e608255bbd541be3eda5883b414c3

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Fri, 14 Feb 2020 12:36:54 GMT
server: AkamaiNetStorage
etag: "c6bf9762b7fcef23638a4087e99a0057:1581683814.317035"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 270
expires: Thu, 20 Feb 2020 09:13:05 GMT

GET
H2 200 id Show response
junipernetworks.d2.sc.omtrdc.net/ 2 B
320 B 718ms
181ms XHR
application/x-javascript 18.139.76.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://junipernetworks.d2.sc.omtrdc.net/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=D206123F524450F50A490D45%40AdobeOrg&mid=65498175306365136370015701310677150669&ts=1582186384603

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.139.76.45 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-139-76-45.ap-southeast-1.compute.amazonaws.com

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Thu, 20 Feb 2020 08:13:04 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-665bcdccf8-clwcj
vary: Origin
x-c: master-1169.Ie4359b.M0-349
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://forums.juniper.net
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 2
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Xk4-kQAAAbh16i3-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=59814116250527520020707159955634197034
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk4-kQAAAbh16i3-

42 B
915 B

110ms
38ms

Image
image/gif

52.208.212.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk4-kQAAAbh16i3-

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.208.212.211 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-208-212-211.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v061-05548faba.edge-irl1.demdex.com 5.65.0.20200212140016 1ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: cMkaI0zsRlM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Thu, 20 Feb 2020 08:13:04 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk4-kQAAAbh16i3-
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 878544ee83.css
use.fontawesome.com/ 1 KB
686 B 24ms
23ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/878544ee83.css
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/878544ee83.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 9e5b8d4ced66c172dc84f16051eee4bac1e0fc60781c1ea05d73072b3cc7ddf1

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Thu, 06 Jul 2017 20:04:23 GMT
server: NetDNA-cache/2.2
x-amz-request-id: EC1778A208C64F6D
etag: W/"44b78b10e53fb4ffb2d9c54f11d4eb0f"
x-cache: HIT
content-type: text/css
status: 200
cache-control: max-age=0, private, must-revalidate
x-amz-id-2: T2klv9ma2j25ViD4AF26CrPqAlJVK+CNLfLjR7WzUde9VDdZ0YjB6rGKnxH2lCYWPXWyWMzjW/8=

GET
H2 200 0%2C1%2C366%2C367
jnet.i.lithium.com/t5/image/serverpage/image-id/20793iA4E55323EA3E0773/image-dimensions/150x150/image-coordinates/ 37 KB
37 KB 22ms
19ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20793iA4E55323EA3E0773/image-dimensions/150x150/image-coordinates/0%2C1%2C366%2C367?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BAF) /

Resource Hash

272a2861dab52511f662603420b847ab73e6e13e75e8973c3091bdaa44c51706

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Sat, 15 Feb 2020 00:11:23 GMT
server: ECS (amb/6BAF)
age: 746
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="jesselands.png"; filename*=UTF-8''jesselands.png
accept-ranges: bytes
content-length: 37498
expires: Fri, 19 Feb 2021 08:13:05 GMT

GET
H2 200 684x486
jnet.i.lithium.com/t5/image/serverpage/image-id/20779i3539FA8C153F6E73/image-dimensions/ 533 KB
533 KB 23ms
20ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20779i3539FA8C153F6E73/image-dimensions/684x486?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B94) /

Resource Hash

70c2868114f52cb3b41e70e017c88ee5f5495639db9d495574e8ced55e7b272f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Wed, 12 Feb 2020 13:27:51 GMT
server: ECS (amb/6B94)
age: 746
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="dota3.png"; filename*=UTF-8''dota3.png
accept-ranges: bytes
content-length: 545543
expires: Fri, 19 Feb 2021 08:13:05 GMT

GET
H2 200 503x331
jnet.i.lithium.com/t5/image/serverpage/image-id/20797iC53A9D84A3C97460/image-dimensions/ 115 KB
116 KB 29ms
26ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20797iC53A9D84A3C97460/image-dimensions/503x331?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B93) /

Resource Hash

ec895e944daf4d8226fe560ff1d95437497215d33885fe2d0db0e54ce3db6d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Wed, 19 Feb 2020 13:08:54 GMT
server: ECS (amb/6B93)
age: 746
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="Distribution.png"; filename*=UTF-8''Distribution.png
accept-ranges: bytes
content-length: 118086
expires: Fri, 19 Feb 2021 08:13:05 GMT

GET
H2 200 large
jnet.i.lithium.com/t5/image/serverpage/image-id/20782i42844564DAEF47B7/image-size/ 32 KB
32 KB 35ms
32ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20782i42844564DAEF47B7/image-size/large?v=1.0&px=999

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B95) /

Resource Hash

506339130f152becadfa3ab2fbdbab5261035e4f9c343440ec23bc178cdc164a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Wed, 12 Feb 2020 16:32:43 GMT
server: ECS (amb/6B95)
age: 746
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="dota3-3.png"; filename*=UTF-8''dota3-3.png
accept-ranges: bytes
content-length: 32975
expires: Fri, 19 Feb 2021 08:13:05 GMT

GET
H2 200 large
jnet.i.lithium.com/t5/image/serverpage/image-id/20783i20520A6CAC9212AE/image-size/ 24 KB
24 KB 35ms
32ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20783i20520A6CAC9212AE/image-size/large?v=1.0&px=999

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BBE) /

Resource Hash

4c5ed401667661bca33d013a7bc790e2079bbe0300a1a1d5ad5e5780ae259a4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Wed, 12 Feb 2020 16:34:08 GMT
server: ECS (amb/6BBE)
age: 746
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="dota3-4.png"; filename*=UTF-8''dota3-4.png
accept-ranges: bytes
content-length: 24746
expires: Fri, 19 Feb 2021 08:13:05 GMT

GET
H2 200 large
jnet.i.lithium.com/t5/image/serverpage/image-id/20784i599AEA1C8ECD5925/image-size/ 30 KB
30 KB 35ms
32ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20784i599AEA1C8ECD5925/image-size/large?v=1.0&px=999

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B94) /

Resource Hash

e61de02b5fa3204c2ed29bd12fcdceaff8d33d4e9be52ff1a6c02a03a407baea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Wed, 12 Feb 2020 16:34:19 GMT
server: ECS (amb/6B94)
age: 746
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="dota3-5.png"; filename*=UTF-8''dota3-5.png
accept-ranges: bytes
content-length: 30545
expires: Fri, 19 Feb 2021 08:13:05 GMT

GET
H2 200 755x496
jnet.i.lithium.com/t5/image/serverpage/image-id/20796i80B748112082D58C/image-dimensions/ 246 KB
247 KB 36ms
33ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20796i80B748112082D58C/image-dimensions/755x496?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B93) /

Resource Hash

4a3d7f509f217225975b98891f41fde0b216552b35f9a76460e86aaf52454733

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Wed, 19 Feb 2020 13:07:15 GMT
server: ECS (amb/6B93)
age: 746
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="Distribution.png"; filename*=UTF-8''Distribution.png
accept-ranges: bytes
content-length: 252266
expires: Fri, 19 Feb 2021 08:13:05 GMT

GET
H2 200 0%2C12%2C398%2C410
jnet.i.lithium.com/t5/image/serverpage/image-id/17505i1378C151B2E2CB8F/image-dimensions/40x40/image-coordinates/ 4 KB
5 KB 35ms
32ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/17505i1378C151B2E2CB8F/image-dimensions/40x40/image-coordinates/0%2C12%2C398%2C410?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BAC) /

Resource Hash

30e3f5a97af46d8cb43bf62c9875a8eacfc02c00826ea47549d4e33d0e1aa446

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Fri, 05 Jan 2018 21:00:31 GMT
server: ECS (amb/6BAC)
age: 746
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="paulkimayong.png"; filename*=UTF-8''paulkimayong.png
accept-ranges: bytes
content-length: 4533
expires: Fri, 19 Feb 2021 08:13:05 GMT

GET
H2 200 avatar-17x17.gif
jnet.i.lithium.com/html/images/ 1 KB
1 KB 35ms
32ms Image
image/gif 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/html/images/avatar-17x17.gif

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B9A) /

Resource Hash

bacc031e0bfe9a4084bb166f88193dcdc3498aab6b1d14ebedbb75045afce823

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Tue, 19 Sep 2017 14:30:17 GMT
server: ECS (amb/6B9A)
age: 223533
etag: W/"1089-1505831417000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/gif
status: 200
accept-ranges: bytes
content-length: 1089

GET
H2 200 0%2C64%2C512%2C576
jnet.i.lithium.com/t5/image/serverpage/image-id/17154i981F324E669B8EEF/image-dimensions/40x40/image-coordinates/ 788 B
936 B 35ms
33ms Image
image/jpeg 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/17154i981F324E669B8EEF/image-dimensions/40x40/image-coordinates/0%2C64%2C512%2C576?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B90) /

Resource Hash

1d111313a277d37912be5ec29e0d77426d991feb85a04106694b72f66739885b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Mon, 16 Oct 2017 18:18:34 GMT
server: ECS (amb/6B90)
age: 746
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/jpeg;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="Mounir.jpg"; filename*=UTF-8''Mounir.jpg
accept-ranges: bytes
content-length: 788
expires: Fri, 19 Feb 2021 08:13:05 GMT

GET
H2 200 2%2C0%2C368%2C366
jnet.i.lithium.com/t5/image/serverpage/image-id/20793iA4E55323EA3E0773/image-dimensions/40x40/image-coordinates/ 5 KB
5 KB 61ms
59ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20793iA4E55323EA3E0773/image-dimensions/40x40/image-coordinates/2%2C0%2C368%2C366?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B9A) /

Resource Hash

92dc916bc3b1001de758bc7fa95b57046ab5a80f1da16558fe8c8051d331f211

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Sat, 15 Feb 2020 00:11:23 GMT
server: ECS (amb/6B9A)
age: 577
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="jesselands.png"; filename*=UTF-8''jesselands.png
accept-ranges: bytes
content-length: 4777
expires: Fri, 19 Feb 2021 08:13:05 GMT

GET
H2 200 powered_by_khoros.svg
jnet.i.lithium.com/skins/images/524532C4C4CD942E84BB14CB4AEDF947/responsive_peak/images/ 5 KB
2 KB 62ms
59ms Image
image/svg+xml 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/skins/images/524532C4C4CD942E84BB14CB4AEDF947/responsive_peak/images/powered_by_khoros.svg

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B98) /

Resource Hash

44c53106498ced14c80aab52391120b380216ce24de07bb5a91e659fd3ba8aed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Fri, 14 Feb 2020 20:27:33 GMT
server: ECS (amb/6B98)
age: 46401
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml;charset=UTF-8
status: 200
cache-control: s-maxage=85586
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1759
expires: Fri, 19 Feb 2021 08:13:05 GMT

GET
H/1.1 200
OK global-nav.js Show response
forumstage.juniper.net/html/assets/ 218 KB
61 KB 675ms
183ms Script
text/javascript 208.74.205.254
LITHIUM

General

Check archive.org

Show headers Download Go to

Full URL

https://forumstage.juniper.net/html/assets/global-nav.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.205.254 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

sjc1-secure06.stage.lithium.com

Software

Apache /

Resource Hash

1451b7c400c9e305f589883bbe1b45139abc74e3c977a8b91fa353dda6a642cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 20 Feb 2020 08:13:05 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 Nov 2019 19:39:15 GMT
Server: Apache
ETag: W/"223725-1574451555000-gzip"
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age,Accept-Encoding
Strict-Transport-Security: max-age=31536000;includeSubDomains
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: close
Accept-Ranges: bytes

GET
H2 200 lia-scripts-angularjs-min.js Show response
jnet.i.lithium.com/t5/scripts/30B7B7689E52F3255F63CF558D0B2099/ 170 KB
59 KB 18ms
18ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/30B7B7689E52F3255F63CF558D0B2099/lia-scripts-angularjs-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BC1) /

Resource Hash

18b4b83afed32c0ec228e62a5f1080fbad1ca25addd958a4fc8b30c281fcc031

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:13:46 GMT
server: ECS (amb/6BC1)
age: 3922
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=6754
strict-transport-security: max-age=31536000;includeSubDomains
content-length: 60495
expires: Thu, 18 Feb 2021 18:42:03 GMT

GET
H2 200 lia-scripts-angularjsModules-min.js Show response
jnet.i.lithium.com/t5/scripts/C44E419D0E33CF45E26475BACEAD7B0A/ 399 KB
107 KB 19ms
19ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/C44E419D0E33CF45E26475BACEAD7B0A/lia-scripts-angularjsModules-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BAD) /

Resource Hash

ed3a677654473b8329f8d886993e734d6cef36c4273263b767be878c9ff8ff44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Fri, 14 Feb 2020 20:34:35 GMT
server: ECS (amb/6BAD)
age: 745
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=886
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 109772
expires: Sat, 13 Feb 2021 22:00:50 GMT

GET
H2 200 lia-scripts-common-min.js Show response
jnet.i.lithium.com/t5/scripts/BDB2760D2C0BCBF59775E7581D371A43/ 329 KB
89 KB 336ms
336ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/BDB2760D2C0BCBF59775E7581D371A43/lia-scripts-common-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache /

Resource Hash

9c3e9a35283d074cbf4f873b077e78b5a8cbd9a8bb4caa5ccc09e0142962a65a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:16:17 GMT
server: Apache
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=5
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 91306
expires: Thu, 18 Feb 2021 08:16:46 GMT

GET
H2 200 lia-scripts-body-min.js Show response
jnet.i.lithium.com/t5/scripts/017CCF1E185FD02333D9F6BBEFAD643F/ 45 KB
12 KB 19ms
18ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/017CCF1E185FD02333D9F6BBEFAD643F/lia-scripts-body-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BB8) /

Resource Hash

5b6b9462f29599d5332fa41d67010d03aa0aadb939144caad40e341bd3a2939a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:17:14 GMT
server: ECS (amb/6BB8)
age: 746
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=789
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 12285
expires: Thu, 18 Feb 2021 09:35:27 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
562 B 14ms
13ms Stylesheet
text/css 2a00:1450:4001:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,400,700

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 08:13:04 GMT
server: ESF
date: Thu, 20 Feb 2020 08:13:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 20 Feb 2020 08:13:04 GMT

GET
H2 200 font-awesome-css.min.css
use.fontawesome.com/releases/v4.7.0/css/ 30 KB
8 KB 25ms
25ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v4.7.0/css/font-awesome-css.min.css
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
content-encoding: gzip
last-modified: Tue, 25 Oct 2016 17:21:58 GMT
server: NetDNA-cache/2.2
access-control-allow-origin: *
etag: W/"36082410df2ef7f83932219089dc1443"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
status: 200
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 fontawesome-webfont.woff2
jnet.i.lithium.com/html/assets/fonts/ 55 KB
56 KB 73ms
18ms Font
application/octet-stream 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/html/assets/fonts/fontawesome-webfont.woff2?v=4.3.0

Requested by

Host: use.fontawesome.com
URL: https://use.fontawesome.com/878544ee83.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B7C) /

Resource Hash

aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:13:04 GMT
last-modified: Wed, 05 Feb 2020 08:30:01 GMT
server: ECS (amb/6B7C)
age: 516178
etag: W/"56780-1580891401000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: application/octet-stream
status: 200
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56780

GET
H2 404 fontawesome.woff
jnet.i.lithium.com/skins/4081847/fonts/ 0
0 369ms
315ms Font
text/html 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/skins/4081847/fonts/fontawesome.woff

Requested by

Host: use.fontawesome.com
URL: https://use.fontawesome.com/878544ee83.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 20 Feb 2020 08:13:04 GMT
server: Apache
access-control-allow-origin: *
content-length: 866
strict-transport-security: max-age=31536000;includeSubDomains
content-type: text/html;charset=utf-8

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 126 KB
30 KB 8ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5cb8c2a664746d2308000a38.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: raUFI/o6CJPg70nfZsFaPgrH9qPowb5wextIB3x7tdmToFj6reh/QQ058oE/ulJLnlHEYgZhlsK3gRtQ2I+/mQ==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:13:05 GMT, Thu, 20 Feb 2020 08:13:05 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 fontawesome.ttf
jnet.i.lithium.com/skins/4081847/fonts/ 0
0 297ms
297ms Font
text/html 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/skins/4081847/fonts/fontawesome.ttf

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 20 Feb 2020 08:13:05 GMT
server: Apache
access-control-allow-origin: *
content-length: 866
strict-transport-security: max-age=31536000;includeSubDomains
content-type: text/html;charset=utf-8

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 70ms
20ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5ced369c64746d5ad2000705.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
age: 86362
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-hhn4065-HHN
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582186385.285892,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2

200

oct.js Show response
static.ads-twitter.com/
Redirect Chain

https://platform.twitter.com/oct.js
https://static.ads-twitter.com/oct.js

5 KB
2 KB

20ms
20ms

Script
application/javascript

151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/oct.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
age: 86359
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-hhn4065-HHN
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582186385.334342,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

Redirect headers

date: Thu, 20 Feb 2020 08:13:05 GMT
location: https://static.ads-twitter.com/oct.js
vary
x-cache: HIT
tw-cdn: FT
status: 301
accept-ranges: bytes
content-length: 0
retry-after: 0
x-served-by: cache-hhn4082-HHN

GET
H/1.1 200
OK BBBthreatresearchportal.jpeg
forums.juniper.net/html/assets/ 105 KB
105 KB 503ms
169ms Image
image/jpeg 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forums.juniper.net/html/assets/BBBthreatresearchportal.jpeg

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

ad9e90d9b2ef8c8af06afa88f231a5cf0dff89eb5c47a948dfbde3c856c7db39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 20 Feb 2020 08:13:05 GMT
Last-Modified: Mon, 12 Mar 2018 23:05:28 GMT
Server: Apache
ETag: W/"107422-1520895928000"
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age
Content-Type: image/jpeg
Connection: close
Strict-Transport-Security: max-age=31536000;includeSubDomains
Accept-Ranges: bytes
Content-Length: 107422

GET
H/1.1 200
OK v.gif
pls.webtype.com/ 807 B
1 KB 1341ms
333ms Image
image/gif 65.52.62.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pls.webtype.com/v.gif?ct=182296,182293,182299,182294,182298,182295,182297,182293,182294,182298,182295,182297,182299,182296,182299,182298,182293,182296,182295,182294,182297,182296,182297,182295,182294,182298,182293,182299&r=71911&p=68690&h=Hzc0I5MIWElYX3SnOIHSGw%3d%3d
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 65.52.62.25 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Referer: https://cloud.webtype.com/css/05cb80fc-3221-476f-983d-76dfa0b1370c.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 20 Feb 2020 08:13:06 GMT
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: no-cache
Content-Length: 807
Expires: -1

GET
H2 200 Lato-Regular.woff2
jnet.i.lithium.com/html/assets/ 178 KB
179 KB 18ms
17ms Font
application/octet-stream 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/html/assets/Lato-Regular.woff2

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B97) /

Resource Hash

983b0caf336e8542214fc17019a4fc5e0360864b92806ca14d55c1fc1c2c5a0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Tue, 25 Sep 2018 18:37:35 GMT
server: ECS (amb/6B97)
age: 223957
etag: W/"182708-1537900655000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: application/octet-stream
status: 200
accept-ranges: bytes
access-control-allow-origin: *
content-length: 182708

GET
H/1.1 200
OK Cookie set dest5.html
junipernetworks.demdex.net/ Frame DDC8 0
0 170ms
37ms Document
text/html 34.241.149.220
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://junipernetworks.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.241.149.220 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-241-149-220.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: junipernetworks.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=59814116250527520020707159955634197034
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 19 Feb 2020 10:04:35 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=59814116250527520020707159955634197034;Path=/;Domain=.demdex.net;Expires=Tue, 18-Aug-2020 08:13:05 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: 0j45SdOMT5o=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 search.png
jnet.i.lithium.com/html/assets/ 1 KB
1 KB 18ms
18ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/html/assets/search.png

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BC3) /

Resource Hash

847ad7d2d327222488e06177809a66d0517d53362838b94dfd3f1961d209d8b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Tue, 19 Sep 2017 14:30:17 GMT
server: ECS (amb/6BC3)
age: 223956
etag: W/"1135-1505831417000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 1135

GET
H/1.1 200
OK DayOneMillionBanner.png
forumstage.juniper.net/html/assets/ 970 KB
970 KB 490ms
167ms Image
image/png 208.74.205.254
LITHIUM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forumstage.juniper.net/html/assets/DayOneMillionBanner.png

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.205.254 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

sjc1-secure06.stage.lithium.com

Software

Apache /

Resource Hash

3928a8be3b073b7b4272b3863934222d52f00e782a0d157b9b7edfd7acf1bfbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 20 Feb 2020 08:13:05 GMT
Strict-Transport-Security: max-age=31536000;includeSubDomains
Last-Modified: Fri, 26 Apr 2019 21:22:32 GMT
Server: Apache
ETag: W/"992924-1556313752000"
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 992924

GET
H2 200 AcceptedSolutionsBanner.png
jnet.i.lithium.com/html/assets/ 188 KB
188 KB 18ms
18ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/html/assets/AcceptedSolutionsBanner.png

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BBE) /

Resource Hash

cac7a767eecdd70123f853d74d1fb29d15cb89dfd93215b57dce2606b4cd1c23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Thu, 03 May 2018 22:11:29 GMT
server: ECS (amb/6BBE)
age: 176875
etag: W/"192650-1525385489000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 192650

GET
H2 200 Lato-Bold.woff2
jnet.i.lithium.com/html/assets/ 181 KB
181 KB 18ms
18ms Font
application/octet-stream 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/html/assets/Lato-Bold.woff2

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6B84) /

Resource Hash

ae88fc0d7a961832f809527d30bd3983a6866d42f66a56ade23f543681594db6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Tue, 25 Sep 2018 18:21:34 GMT
server: ECS (amb/6B84)
age: 223954
etag: W/"184912-1537899694000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: application/octet-stream
status: 200
accept-ranges: bytes
access-control-allow-origin: *
content-length: 184912

GET
H2 200 FontAwesome.otf
jnet.i.lithium.com/html/assets/ 48 KB
48 KB 27ms
27ms Font
application/x-font-otf 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/html/assets/FontAwesome.otf

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (amb/6BA0) /

Resource Hash

e5d717d2c24e52afc0e139b41d817580583acad2e3c9d725d1bd46f0f7e5cb1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Tue, 19 Sep 2017 14:30:17 GMT
server: ECS (amb/6BA0)
age: 221615
etag: W/"48748-1505831417000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: application/x-font-otf
status: 200
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48748

GET
H2 200 a0cedc3e-6840-426e-97b1-3c84003749db
cloud.webtype.com/webtype/ff2/3/ 55 KB
55 KB 71ms
18ms Font
application/octet-stream 93.184.220.41
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cloud.webtype.com/webtype/ff2/3/a0cedc3e-6840-426e-97b1-3c84003749db?ec_token=8f7c4c4997246fd7fa920371cd943b561cc1376e933e830d08e6b0683939639d404785f456ee32575101d725923746fca6e69ff51fcfe5b050225f7c73898261a8782877c56c75752b53bd7904d2031d391fe58f03b9699949fd97a6a2ff0e846b9b5f7b238ef0e3e218f881633f84a6df8f6e3c42389b1f2ede2dd7cf99517d94747b6b1931154fae658ce8ed6ce4ae462da9a2caf5829564405b9a4734ebc0468dd1924c31ed0fbbcc1f8f3738b30362a8434fa1f27b11671762c5ca8e3dc1215a83fb6889348f3eb94edaa393481a20d66c33d733092de1f6e0d3d8f7bdc0195d51e35058fd4bd2cd093b03b5bb12f6144c99d0aff4&ec_token=8f7c4c4997246fd7fa920376cc943b5654522473d8a897cacca97149c4e47f6f58194b50d81812299938889f52af0c1606db01f5be73b0deef52167fa79f12b243aff40a15ac84109f59783d30e511148a6dae4a711358f22b6206a2f996042606d5449df7366ee850657c2e998ae60e1825a00958d3ce1c5e7085a3d6eb82a8614189a4023ff9c5bdd7b05a25fe732e7b1b66d3387e3b492e8886adbde3cfee77939e8d1f63817ab735b2504ec31754c9241fa74730508eca7af76aeb3c0a684994a21e0356e79ee6b3bb4ab55048106ca56cd7bb487524c384b9adf60e1944e2450c73f7e1b30ae197ac26
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.41 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BB5) /
Resource Hash: 4ded81a3d2fd6dd9c1240d80be198e98eb78db7dc4e3e525fd21ffc0c05efbcd

Request headers

Referer: https://cloud.webtype.com/css/05cb80fc-3221-476f-983d-76dfa0b1370c.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Fri, 23 Oct 2015 21:28:48 GMT
server: ECS (amb/6BB5)
age: 222446
etag: "657538501"
x-cache: HIT
content-type: application/octet-stream
status: 200
cache-control: max-age=604800
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56080
expires: Thu, 27 Feb 2020 08:13:05 GMT

GET
H/1.1

200
OK

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3djuniper.net%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3djuniper.net%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253djuniper.net%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=juniper.net&pId=1914446610815133731

4 B
484 B

286ms
197ms

Image
image/jpeg

13.35.253.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=juniper.net&pId=1914446610815133731
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.61 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-61.fra6.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 08:13:05 GMT
Via: 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA6-C1
x-amzn-RequestId: b2d7f14f-692e-4f8d-a5eb-dd558a6a048e
X-Cache: Miss from cloudfront
Content-Type: image/jpeg
X-Amzn-Trace-Id: Root=1-5e4e3f91-8c3e7fc85d10638a56be3bca;Sampled=0
Connection: keep-alive
x-amz-apigw-id: IL7ezHcuIAMF1Bg=
Content-Length: 4
X-Amz-Cf-Id: EsvmokabEYdwGWXgLPukAn2w9xz8cKSRg6Se7DetpyUJfIMWDseEqg==

Redirect headers

Pragma: no-cache
Date: Thu, 20 Feb 2020 08:13:07 GMT
AN-X-Request-Uuid: 05bc0098-4b52-4622-b8a2-587a7dbc4b08
Content-Type: text/html; charset=utf-8
Server: nginx/1.13.4
Location: https://attr.ml-api.io/?domain=juniper.net&pId=1914446610815133731
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 82.102.19.134; 82.102.19.134; 313.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.72:80
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 437764526963678 Show response
connect.facebook.net/signals/config/ 447 KB
112 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/437764526963678?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bef8b6a5f4399be5da990490ceee7525da2698723a003af12b7095f03a78a34f

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 114931
x-xss-protection: 0
pragma: public
x-fb-debug: Zu8EcC8qhcn4dbzmIcB99gPet9GW9kjKL+wXDlNRFWv+o/WaQ7pit2Xsc/n60f1Y9wOkngjafakr3QVYImV8TA==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:13:05 GMT, Thu, 20 Feb 2020 08:13:05 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 json Show response
junipernetworks.tt.omtrdc.net/m2/junipernetworks/mbox/ 537 B
799 B 135ms
64ms XHR
application/json 66.117.29.4
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://junipernetworks.tt.omtrdc.net/m2/junipernetworks/mbox/json?mbox=target-global-mbox&mboxSession=16c43adb748b4c509600698386080c28&mboxPC=&mboxPage=ddf2e0439c34470d9751ac7460a37d35&mboxRid=abd6bbcbd4d8418e937abe050dbede87&mboxVersion=1.6.2&mboxCount=1&mboxTime=1582189984806&mboxHost=forums.juniper.net&mboxURL=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=60&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&profile.isp=true&profile.audience=Bot&profile.audience_segment=&at_property=731b0e75-98c0-3152-d94c-88331af4fd48&mboxMCSDID=215E9500D0E0DD7D-3A194D7ED23A9203&vst.trk=junipernetworks.d2.sc.omtrdc.net&vst.trks=junipernetworks.d2.sc.omtrdc.net&mboxMCGVID=65498175306365136370015701310677150669&mboxAAMB=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&mboxMCGLH=6
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 66.117.29.4 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: /
Resource Hash: d2c5dc70ba0ff69d43a4a4a4adde73839bb028c5e978aeb81743b4a3dc825626

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:04 GMT
status: 200
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://forums.juniper.net
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 537
x-request-id: abd6bbcbd4d8418e937abe050dbede87

GET
H2 200 adsct
t.co/i/ 43 B
124 B 176ms
131ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1lnh&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 109
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: dda3e2ad543e71c17ca1544e623d9609
x-transaction: 00e971ec006b0ec0
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
125 B 177ms
133ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 110
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: dda3e2ad543e71c17ca1544e623d9609
x-transaction: 00f676f800b90b75
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
449 B 173ms
128ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nvrg6&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 105
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: dda3e2ad543e71c17ca1544e623d9609
x-transaction: 003ffb8c00d793a4
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
124 B 186ms
141ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o29di&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 117
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: dda3e2ad543e71c17ca1544e623d9609
x-transaction: 002745d2002c1cbc
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
119 B 179ms
134ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o2i9x&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 110
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: dda3e2ad543e71c17ca1544e623d9609
x-transaction: 001ab9ab001ba767
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
250 B 6ms
5ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=437764526963678&ev=PageView&dl=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&rl=&if=false&ts=1582186385478&cd[jnpr_vId]=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&sw=1600&sh=1200&v=2.9.15&r=stable&ec=0&o=29&fbp=fb.1.1582186385477.1207459556&it=1582186385353&coo=false&rqm=GET

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT, Thu, 20 Feb 2020 08:13:05 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-24=":443"; ma=3600
content-length: 44
expires: Thu, 20 Feb 2020 08:13:05 GMT

GET
H2 200 jnpr-logo.svg Show response
www.juniper.net/assets/svg/ 3 KB
2 KB 19ms
6ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.juniper.net/assets/svg/jnpr-logo.svg
Requested by: Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43 /
Resource Hash: 57f53d1b65316e7362b02a42d2a07319fcd3a8d75f2dc91d0094caf98181c741

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Fri, 02 Nov 2018 05:55:25 GMT
server: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43
status: 200
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: public, max-age=30637
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
content-length: 1502
x-ua-compatible: IE=edge,chrome=1

GET
H2 200 jnpr-social-icon_jnet.svg Show response
www.juniper.net/assets/icons/social/ 976 B
1 KB 16ms
9ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_jnet.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

6b8797e0cf30f8a00ff41912ebcc895055ffeb426b34f70c4933b9828b1ca720

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 563
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:13:05 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=138955
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_facebook.svg Show response
www.juniper.net/assets/icons/social/ 366 B
755 B 14ms
7ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_facebook.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

7ff5a2ce1b7603d6e9f61f85587efe96cbed61d71ace91bcc6ca7d0bc07cc7ce

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 273
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:13:05 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=139811
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_twitter.svg Show response
www.juniper.net/assets/icons/social/ 582 B
856 B 18ms
11ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_twitter.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

15c14a35beeabe632f718ce14189ade1b8b6760b977e1e8149b5e1211d3efde5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 374
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:13:05 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=205833
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_youtube.svg Show response
www.juniper.net/assets/icons/social/ 451 B
789 B 13ms
7ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_youtube.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

c6846556479addb85175eb801d75cd64485ccec53b42fac54441fef1895c0408

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 307
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:13:05 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=142758
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_linkedin.svg Show response
www.juniper.net/assets/icons/social/ 724 B
925 B 16ms
10ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_linkedin.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

70349fe86be7c6dcd4062011d02d91185a4a45b60e2826f05985d67f8ae43bd3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 443
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:13:05 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=139157
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_instgram.svg Show response
www.juniper.net/assets/icons/social/ 1 KB
1 KB 14ms
8ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_instgram.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43 /

Resource Hash

e8d5b01af589f68a0f2da663d3efc472fabb22d9ede91a7ffcf74d21e6295506

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 569
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Mon, 03 Dec 2018 20:00:23 GMT
server: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43
date: Thu, 20 Feb 2020 08:13:05 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=38487
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 satellite-5c4d601564746d128d00351a.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 2 KB
1 KB 24ms
23ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5c4d601564746d128d00351a.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8a3e8d4242f53959806c3ebf262affb1bd5a78e361acb2d5bf14be201ee56a3e

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:54 GMT
server: AkamaiNetStorage
etag: "ef3e8222ffd66f5f29d86b509a85a361:1582139334.431118"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 802
expires: Thu, 20 Feb 2020 09:13:05 GMT

GET
H2 200 satellite-5c86baad64746d44c9006139.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 2 KB
1 KB 24ms
24ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5c86baad64746d44c9006139.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5855809ae723b4a35f3120be99dccfc8403b3dd379fd86efeacdad8767ea6320

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:54 GMT
server: AkamaiNetStorage
etag: "64cd50749dbcff7576118000c8ee8376:1582139334.752199"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 831
expires: Thu, 20 Feb 2020 09:13:05 GMT

GET
H2 200 satellite-5a1c307e64746d671f007214.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 970 B
738 B 25ms
25ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5a1c307e64746d671f007214.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: db0031471b3f9181ff21d83674674ac3dd7c128531fae90bc274ad0e17c58c37

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 15:13:20 GMT
server: AkamaiNetStorage
etag: "e98792ce8e8b853475368de93200623c:1582125200.040193"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 493
expires: Thu, 20 Feb 2020 09:13:05 GMT

GET
H2 200 satellite-57ae0e9e64746d5a2c001384.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 756 B
610 B 25ms
25ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57ae0e9e64746d5a2c001384.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4c891889ca55d5cadf9e960d2e40f31f50ac0b6252417a9be7414ff2f26a3880

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:46 GMT
server: AkamaiNetStorage
etag: "32b2fa1768d41f11552b05c7f7bc9543:1582139326.73257"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 365
expires: Thu, 20 Feb 2020 09:13:05 GMT

GET
H2 200 satellite-57b12af264746d361f00027e.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 148 B
391 B 25ms
25ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57b12af264746d361f00027e.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: b8eea75e456823a6e0eebfa1e4f27b56395485fff2bbf27e0344f7bf4fa8e509

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:42 GMT
server: AkamaiNetStorage
etag: "a29c925184c82cbaaeea213863aa74d1:1582139322.029758"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 147
expires: Thu, 20 Feb 2020 09:13:05 GMT

GET
H2 200 s-code-contents-aa1e4404cdb04849f2f22e6dd3789ac4f10a9afd.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/ 35 KB
13 KB 29ms
28ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/s-code-contents-aa1e4404cdb04849f2f22e6dd3789ac4f10a9afd.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e931faaef092c8d98a58ac536216378f58e2a17a4833bbe5f9a29e5bbed849f6

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 15:13:04 GMT
server: AkamaiNetStorage
etag: "0c13f2b0bfa3779da7f5bdb2ff4d1d29:1582125184.807562"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 13480
expires: Thu, 20 Feb 2020 09:13:05 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 247 KB
47 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MHNPL3

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4cdde47aa921b0cc562b8cadb9366ea11d83bd0f27d3aa2e4ab8c22486f592d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 48480
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 20 Feb 2020 08:13:05 GMT

GET
H/1.1 200
OK ng-messages Show response
forums.juniper.net/jnet/api/2.0/ui/lang/ 2 KB
1 KB 475ms
165ms XHR
application/json 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to

Full URL

https://forums.juniper.net/jnet/api/2.0/ui/lang/ng-messages?board.id=threatresearch

Requested by

Host: jnet.i.lithium.com
URL: https://jnet.i.lithium.com/t5/scripts/30B7B7689E52F3255F63CF558D0B2099/lia-scripts-angularjs-min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

4dcc161d0ef98a2c9c1b776a90ab5c284032d8a333964620545bf1ceee13ac89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json
Accept: application/json, text/plain, */*
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Application-Version: 2.0.0
Sec-Fetch-Dest: empty
If-Modified-Since: Thu, 01 Jan 1970 00:00:00 GMT
Application-Identifier: DESKTOP

Response headers

Date: Thu, 20 Feb 2020 08:13:06 GMT
Content-Encoding: gzip
Server: Apache
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age,Accept-Encoding
Content-Type: application/json;charset=UTF-8
Connection: close
Strict-Transport-Security: max-age=31536000;includeSubDomains
Content-Length: 842

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v16/ 14 KB
14 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: jnet.i.lithium.com
URL: https://jnet.i.lithium.com/t5/scripts/BDB2760D2C0BCBF59775E7581D371A43/lia-scripts-common-min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Lato:300,400,700
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 04 Feb 2020 02:02:12 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:45:55 GMT
server: sffe
age: 1404653
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14044
x-xss-protection: 0
expires: Wed, 03 Feb 2021 02:02:12 GMT

GET
H/1.1 204
No Content 165804501641_1582186384377.gif
forums.juniper.net/beacon/ 0
568 B 507ms
162ms Image
image/gif 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forums.juniper.net/beacon/165804501641_1582186384377.gif

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 20 Feb 2020 08:13:06 GMT
Last-Modified: Fri, 02 Nov 2007 00:36:01 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000;includeSubDomains
Content-Type: image/gif
Cache-Control: private, no-cache, no-cache="Set-Cookie", proxy-revalidate
Connection: close
Content-Length: 0
Expires: Thu, 22 Jan 1976 08:28:00 GMT

GET
H2 200 satellite-5955f42064746d6e6f0053bb.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 378 B
529 B 24ms
24ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5955f42064746d6e6f0053bb.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7b08b6c86fb4d51c3e96dd3f06ed35c02b7f0662404fb6b14b9b2b0425a9e28a

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
last-modified: Fri, 14 Feb 2020 12:36:56 GMT
server: AkamaiNetStorage
etag: "3b6d86978dcd31eae399835883bb4dfa:1581683816.749645"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 283
expires: Thu, 20 Feb 2020 09:13:05 GMT

GET
H2 200 satellite-5caeb27864746d4fde0010d0.html
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ Frame ADB1 0
0 24ms
24ms Document
text/html 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5caeb27864746d4fde0010d0.html
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

:method: GET
:authority: assets.adobedtm.com
:scheme: https
:path: /998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5caeb27864746d4fde0010d0.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
accept-ranges: bytes
content-type: text/html
etag: "99efb13f2ce40bcc3d8c60d4557d2185:1582139314.215093"
last-modified: Wed, 19 Feb 2020 19:08:34 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=3600
expires: Thu, 20 Feb 2020 09:13:05 GMT
date: Thu, 20 Feb 2020 08:13:05 GMT
content-length: 810
timing-allow-origin: *

GET
H2 200 satellite-5d487bc864746d25bd00073a.html
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ Frame A4E2 0
0 24ms
24ms Document
text/html 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5d487bc864746d25bd00073a.html
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

:method: GET
:authority: assets.adobedtm.com
:scheme: https
:path: /998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5d487bc864746d25bd00073a.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
accept-ranges: bytes
content-type: text/html
etag: "6f794f7bf8d2cbee9f48532e60fe0435:1582125186.77754"
last-modified: Wed, 19 Feb 2020 15:13:06 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
content-length: 654
cache-control: max-age=3600
expires: Thu, 20 Feb 2020 09:13:05 GMT
date: Thu, 20 Feb 2020 08:13:05 GMT
timing-allow-origin: *

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
237 B 136ms
135ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1lnh&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 114
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 1e0d305d8d152b6a20b22a042a1099f7
x-transaction: 00403fc400191f7d
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
388 B 129ms
128ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 106
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 1e0d305d8d152b6a20b22a042a1099f7
x-transaction: 0019183200b1620f
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
236 B 136ms
136ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nvrg6&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 113
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 1e0d305d8d152b6a20b22a042a1099f7
x-transaction: 00d12d860007cd8d
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
236 B 135ms
134ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o29di&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 112
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 1e0d305d8d152b6a20b22a042a1099f7
x-transaction: 00aae9cb001404f0
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
239 B 142ms
142ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o2i9x&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 1e0d305d8d152b6a20b22a042a1099f7
x-transaction: 009e954b00bfa632
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H/1.1 200
OK blogarticlepage.tagcloudtaplet:lazyrender Show response
forums.juniper.net/t5/blogs/ 20 B
563 B 476ms
177ms XHR
application/json 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to

Full URL

https://forums.juniper.net/t5/blogs/blogarticlepage.tagcloudtaplet:lazyrender?t:ac=blog-id/threatresearch/article-id/72&t:cp=tagging/contributions/page

Requested by

Host: jnet.i.lithium.com
URL: https://jnet.i.lithium.com/t5/scripts/BDB2760D2C0BCBF59775E7581D371A43/lia-scripts-common-min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

7283dcbdf14b954c1e61e173cc8bdb244b2bf508b7f0211ac749857bf47acda3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
X-Requested-With: XMLHttpRequest
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Thu, 20 Feb 2020 08:13:06 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json;charset=UTF-8
Connection: close
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000;includeSubDomains
X-Robots-Tag: noindex, nofollow

GET
DATA 200
OK truncated
/ 667 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: edd8db5c29b96b7a290a5e266d426dca85541b7cd7a62b180e5ec89dc635f05f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H/1.1 200
OK elqCfg.min.js Show response
img.en25.com/i/ 6 KB
3 KB 116ms
37ms Script
application/x-javascript 104.103.106.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://img.en25.com/i/elqCfg.min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.103.106.126 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-103-106-126.deploy.static.akamaitechnologies.com

Software

Resource Hash

6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 22 Jan 2020 17:21:27 GMT
ETag: "164336148d1d51:0"
Vary: Accept-Encoding
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: no-cache, no-store
Date: Thu, 20 Feb 2020 08:13:05 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 2115
Expires: Thu, 20 Feb 2020 08:13:05 GMT

GET
H2 200 pntheon.min.js Show response
secure.rmulus.com/ 9 KB
9 KB 85ms
21ms Script
application/javascript 13.35.253.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5c4d601564746d128d00351a.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.84 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-84.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c785b78817298c70c27829e6903d75fac181ed591e3260c4b1fec35f0cd03c0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:08:46 GMT
via: 1.1 f038e7175be9761825b2eefc2b0a832e.cloudfront.net (CloudFront)
last-modified: Mon, 20 Jan 2020 23:16:42 GMT
server: AmazonS3
age: 261
etag: "0e3d80db82062b64ac3e71d661e18282"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 9338
x-amz-cf-id: 8CVbAwTJhDAx21eVjGSEluHUHmreXyxxNXGWHNB7v4BTnMsFMcKJAA==

GET
H2 200 pntheon.min.js Show response
secure.rmulus.com/ 9 KB
9 KB 100ms
35ms Script
application/javascript 13.35.253.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=active&_pclIp=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5c86baad64746d44c9006139.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.84 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-84.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c785b78817298c70c27829e6903d75fac181ed591e3260c4b1fec35f0cd03c0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 19 Feb 2020 21:03:37 GMT
via: 1.1 f038e7175be9761825b2eefc2b0a832e.cloudfront.net (CloudFront)
last-modified: Mon, 20 Jan 2020 23:16:42 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: "0e3d80db82062b64ac3e71d661e18282"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
content-length: 9338
x-amz-cf-id: qZXBKIDh-gHzb0Jg69_B5xVtGu9tepNANHl-xFAe06T6u-_DUnLTMA==

GET
H2 200 pntheon.min.js Show response
secure.rmulus.com/ 9 KB
9 KB 92ms
33ms Script
application/javascript 13.35.253.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&_pqStr=enabled&jnpr_vID=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5a1c307e64746d671f007214.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.84 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-84.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c785b78817298c70c27829e6903d75fac181ed591e3260c4b1fec35f0cd03c0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 19 Feb 2020 21:03:37 GMT
via: 1.1 f038e7175be9761825b2eefc2b0a832e.cloudfront.net (CloudFront)
last-modified: Mon, 20 Jan 2020 23:16:42 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: "0e3d80db82062b64ac3e71d661e18282"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
content-length: 9338
x-amz-cf-id: jC7jhMzcL8qaMl4KYX0di6SxxRrpAHyeRRpLv0efpbGgy2S4v7nj0w==

GET
H2

200

activityi;dc_pre=CLiZhszX3-cCFRzjuwgdWIIH5w;src=5922977;type=pageview;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is...
5922977.fls.doubleclick.net/ Frame CA65
Redirect Chain

https://5922977.fls.doubleclick.net/activityi;src=5922977;type=pageview;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-...
https://5922977.fls.doubleclick.net/activityi;dc_pre=CLiZhszX3-cCFRzjuwgdWIIH5w;src=5922977;type=pageview;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.n...

0
0

35ms
35ms

Document
text/html

172.217.22.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5922977.fls.doubleclick.net/activityi;dc_pre=CLiZhszX3-cCFRzjuwgdWIIH5w;src=5922977;type=pageview;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5554463215346.928?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57b12a8364746d4d41000291.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s16-in-f38.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5922977.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CLiZhszX3-cCFRzjuwgdWIIH5w;src=5922977;type=pageview;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5554463215346.928?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnkL7qqNdiOQpFfHBcE3aIb38Aj2zMjtTi_pEEz28qS6nCqzTB_ZimDe4zI; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 20 Feb 2020 08:13:06 GMT
expires: Thu, 20 Feb 2020 08:13:06 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 452
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 20 Feb 2020 08:13:06 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5922977.fls.doubleclick.net/activityi;dc_pre=CLiZhszX3-cCFRzjuwgdWIIH5w;src=5922977;type=pageview;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5554463215346.928?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 20-Feb-2020 08:28:06 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2

200

activityi;dc_pre=CJuPg8zX3-cCFRPDuwgd1XEOrw;src=3872718;type=gojpnet;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-...
3872718.fls.doubleclick.net/ Frame D330
Redirect Chain

https://3872718.fls.doubleclick.net/activityi;src=3872718;type=gojpnet;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-I...
https://3872718.fls.doubleclick.net/activityi;dc_pre=CJuPg8zX3-cCFRPDuwgd1XEOrw;src=3872718;type=gojpnet;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.ne...

0
0

38ms
37ms

Document
text/html

172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3872718.fls.doubleclick.net/activityi;dc_pre=CJuPg8zX3-cCFRPDuwgd1XEOrw;src=3872718;type=gojpnet;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4508745446987.625?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57b12a8364746d4d41000291.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f134.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 3872718.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CJuPg8zX3-cCFRPDuwgd1XEOrw;src=3872718;type=gojpnet;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4508745446987.625?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnkL7qqNdiOQpFfHBcE3aIb38Aj2zMjtTi_pEEz28qS6nCqzTB_ZimDe4zI
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 20 Feb 2020 08:13:05 GMT
expires: Thu, 20 Feb 2020 08:13:05 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 451
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 20 Feb 2020 08:13:05 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://3872718.fls.doubleclick.net/activityi;dc_pre=CJuPg8zX3-cCFRPDuwgd1XEOrw;src=3872718;type=gojpnet;cat=pagev0;u1=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4508745446987.625?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: IDE=AHWqTUnkL7qqNdiOQpFfHBcE3aIb38Aj2zMjtTi_pEEz28qS6nCqzTB_ZimDe4zI; expires=Tue, 16-Mar-2021 08:13:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 s89727849980503
junipernetworks.d2.sc.omtrdc.net/b/ss/jnprod/1/JS-2.12.0-D7QN/ 43 B
244 B 182ms
182ms Image
image/gif 18.139.76.45
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://junipernetworks.d2.sc.omtrdc.net/b/ss/jnprod/1/JS-2.12.0-D7QN/s89727849980503?AQB=1&ndh=1&pf=1&t=20%2F1%2F2020%209%3A13%3A5%204%20-60&sdid=215E9500D0E0DD7D-3A194D7ED23A9203&D=D%3D&mid=65498175306365136370015701310677150669&aamlh=6&ce=UTF-8&pageName=forums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&g=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=forums.juniper.net&v5=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&v15=D%3DpageName&v30=ISP%20Visitor&v31=ISP%20Visitor&v32=ISP%20Visitor&v33=ISP%20Visitor&v34=ISP%20Visitor&v35=ISP%20Visitor&v36=ISP%20Visitor&v37=ISP%20Visitor&v38=ISP%20Visitor&v39=ISP%20Visitor&v40=ISP%20Visitor&v41=ISP%20Visitor&v42=ISP%20Visitor&v43=ISP%20Visitor&v44=ISP%20Visitor&v45=Bot&v46=ISP%20Visitor&v84=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=D206123F524450F50A490D45%40AdobeOrg&AQE=1

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.139.76.45 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-139-76-45.ap-southeast-1.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:05 GMT
x-content-type-options: nosniff
x-c: master-1169.Ie4359b.M0-349
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 21 Feb 2020 08:13:06 GMT
server: jag
xserver: anedge-665bcdccf8-tq52s
etag: 3397719392108511232-4619858173510642375
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 19 Feb 2020 08:13:06 GMT

GET
H2 200 wRPiG49f.min.js Show response
scripts.demandbase.com/ 58 KB
59 KB 25ms
25ms Script
application/javascript 13.35.253.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/wRPiG49f.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5955f42064746d6e6f0053bb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.82 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-82.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0d815b2e925f887c1210ae79918c2daed72f94cafb870f4fedffcfac47a341b4

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: rBjPpaaLgRwfk.HwhBorpW7VSW9pfD6m
via: 1.1 08bbe291f260c2b80a00874a80ade07c.cloudfront.net (CloudFront)
age: 1862
x-cache: Hit from cloudfront
status: 200
date: Thu, 20 Feb 2020 07:42:04 GMT
content-length: 59517
last-modified: Thu, 16 Jan 2020 17:41:57 GMT
server: AmazonS3
etag: "52b032a7bc001b85e47103b9aa975fa2"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
x-amz-cf-id: 6ZtmBxXjOlVSx5pSqVkpp_yJAzeFombJkVQmpyyUOURUtcUFEYO6iQ==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 5973
date: Thu, 20 Feb 2020 06:33:32 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 18174
expires: Thu, 20 Feb 2020 08:33:32 GMT

GET
H/1.1

200
OK

37366
tags.bluekai.com/site/
Redirect Chain

https://s1229.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1229&ref2=elqNone&tzo=-60&ms=969&optin=disabled
https://s1229.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1229&ref2=elqNone&tzo=-60&ms=969&optin=disabled&elqCookie=1
https://tags.bluekai.com/site/37366?vid=cfc6022b4d2448caae1f1f0f50f63f2d

62 B
744 B

1224ms
177ms

Image
image/gif

23.45.237.36
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/37366?vid=cfc6022b4d2448caae1f1f0f50f63f2d
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.45.237.36 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-45-237-36.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 08:13:16 GMT
Connection: keep-alive
Content-Type: image/gif
Content-Length: 62
BK-Server: be7
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
Date: Thu, 20 Feb 2020 08:13:16 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location: //tags.bluekai.com/site/37366?vid=cfc6022b4d2448caae1f1f0f50f63f2d
Cache-Control: private,no-cache, no-store
Content-Type: text/html; charset=utf-8
Content-Length: 183
Expires: -1

GET
H2 200 collect
www.google-analytics.com/ 35 B
99 B 6ms
5ms Image
image/gif 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j81&a=17341638&t=pageview&_s=1&dl=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&ul=en-us&de=UTF-8&dt=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YGDAgEAB~&jid=1013382476&gjid=1435549905&cid=2081577110.1582186386&tid=UA-2343305-4&_gid=534476128.1582186386&z=1220489783

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Tue, 04 Feb 2020 19:09:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1343003
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
stats.g.doubleclick.net/r/ 35 B
102 B 15ms
14ms Image
image/gif 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-2343305-4&cid=2081577110.1582186386&jid=1013382476&gjid=1435549905&_gid=534476128.1582186386&_u=YGDAgEAB~&z=639123104

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
date: Thu, 20 Feb 2020 08:13:05 GMT
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
93 B 6ms
6ms Image
image/gif 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j81&a=17341638&t=pageview&_s=1&dl=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&ul=en-us&de=UTF-8&dt=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YGDAgEAB~&jid=620775597&gjid=1172925325&cid=2081577110.1582186386&tid=UA-2343305-1&_gid=534476128.1582186386&cd5=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&cd19=gtm%20%2B%20dtm&z=499321618

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Tue, 04 Feb 2020 19:09:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1343003
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-2343305-1&cid=2081577110.1582186386&jid=620775597&gjid=1172925325&_gid=534476128.1582186386&_u=YGDAgEAB~&z=1357659231
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=2081577110.1582186386&jid=620775597&_v=j81&z=1357659231
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=2081577110.1582186386&jid=620775597&_v=j81&z=1357659231&slf_rd=1&random=1358653953

42 B
109 B

18ms
18ms

Image
image/gif

2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=2081577110.1582186386&jid=620775597&_v=j81&z=1357659231&slf_rd=1&random=1358653953

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=2081577110.1582186386&jid=620775597&_v=j81&z=1357659231&slf_rd=1&random=1358653953
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 436 B
938 B 104ms
60ms XHR
application/json 143.204.202.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&page_title=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&key=b04729caf27be3d1f33d91242883c6cd22de73c9&src=tag
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/wRPiG49f.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.55 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-55.fra53.r.cloudfront.net
Software: nginx /
Resource Hash: 8844cfebefa2192e921ac8233c63ab3c0ad98a44823b71d84cd1ec25411a7a40

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
status: 200
request-id: ba3322bd-8d0f-4553-affa-691f2e2616fa
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://forums.juniper.net
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 e7377cc861b31102786678df3616bf69.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8DfSbC-lAps1K6mH30hFFpv0C7z_jnRpG7x4UGN8qLJnf4Z1Q7oVzw==
expires: Wed, 19 Feb 2020 08:13:06 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 436 B
940 B 104ms
60ms XHR
application/json 143.204.202.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&page_title=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&key=2f583737f4267c258cb4cda0abb7f0add09816ce&src=tag
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/wRPiG49f.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.55 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-55.fra53.r.cloudfront.net
Software: nginx /
Resource Hash: 8844cfebefa2192e921ac8233c63ab3c0ad98a44823b71d84cd1ec25411a7a40

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
status: 200
request-id: 7505b32a-2dbe-4ef2-9cb8-4b92ecebfdd1
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://forums.juniper.net
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 e7377cc861b31102786678df3616bf69.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: S63tXkyoFqiGE9RH4XhLfflnD7RCNU4fvEJLzDBOdIZzaUZ6YZvghA==
expires: Wed, 19 Feb 2020 08:13:06 GMT

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AAGSj068nH8AAC94ZbYKVg
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAGSj068nH8AAC94ZbYKVg&verifyHash=aa76dfd0e2932f175a820543203182b1b67ee6d8

26 B
408 B

192ms
191ms

Image
image/gif

13.35.253.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAGSj068nH8AAC94ZbYKVg&verifyHash=aa76dfd0e2932f175a820543203182b1b67ee6d8
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.61 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-61.fra6.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 08:13:06 GMT
Via: 1.1 25c6baf0a31a5ef699c1e219b25ce7b9.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA6-C1
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: a25aa3e25cb1a5c7
X-Amz-Cf-Id: QhfgpBzOunLDOIlhh3ZQyYNE7ob-hDasm755BBtcMl-x3nOieqDrFw==

Redirect headers

Date: Thu, 20 Feb 2020 08:13:06 GMT
Via: 1.1 25c6baf0a31a5ef699c1e219b25ce7b9.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA6-C1
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AAGSj068nH8AAC94ZbYKVg&verifyHash=aa76dfd0e2932f175a820543203182b1b67ee6d8
Connection: keep-alive
trace-id: 556750812aa4b76f
Content-Length: 0
X-Amz-Cf-Id: aR2XljK39wrQ_IuXG_SXAi2KlR9nL61px5JG60QGPFcdR-ujjgs5RQ==

GET
H/1.1 200
OK profiler Show response
lookups.rmulus.com/pntheon/profiles/ 25 B
205 B 428ms
110ms XHR
application/json 52.72.180.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lookups.rmulus.com/pntheon/profiles/profiler?_pclientId=jnpr&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vid&_plkpPrfl=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.180.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-180-134.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 851bd834d24a84c0f4780789e868a65f9db8d9655a7a0cac039dbf3b65ad873f

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 20 Feb 2020 08:13:06 GMT
Server: Apache
Connection: keep-alive
Content-Length: 25
Content-Type: application/json

GET
H2 200 /
secure.rmulus.com/ Frame 7BB0 0
0 22ms
21ms Document
text/html 13.35.253.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.rmulus.com/?_pevId=iq9gaz5IwncjdrSVAg6zajYWO8JWXuOo-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=enabled&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dpgvw%26_pdataSource%3Dweb%26_pqStr%3Denabled%26jnpr_vID%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&jnpr_vID=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pidSource=secure.rmulus.com&_pidName=rmulusId&_pclIp=disabled&_plkpPrfl=disabled
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.84 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-84.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: secure.rmulus.com
:scheme: https
:path: /?_pevId=iq9gaz5IwncjdrSVAg6zajYWO8JWXuOo-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=enabled&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dpgvw%26_pdataSource%3Dweb%26_pqStr%3Denabled%26jnpr_vID%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&jnpr_vID=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pidSource=secure.rmulus.com&_pidName=rmulusId&_pclIp=disabled&_plkpPrfl=disabled
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
content-type: text/html
content-length: 11311
last-modified: Mon, 20 Jan 2020 22:54:47 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 20 Feb 2020 07:48:28 GMT
etag: "b54bfc44e96bae45f2b930edddba58f9"
cache-control: max-age=3600
x-cache: Hit from cloudfront
via: 1.1 f038e7175be9761825b2eefc2b0a832e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: 6LAAhLAktuaweMOnTV_XzvZ-0tbzRc30WUStLVWuDUuzjs6HTmYW_Q==
age: 1479

GET
H/1.1 200
OK jnpr Show response
lookups.rmulus.com/pntheon/ip/ 403 B
592 B 541ms
216ms XHR
text/html 52.72.180.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lookups.rmulus.com/pntheon/ip/jnpr
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.180.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-180-134.compute-1.amazonaws.com
Software: Apache /
Resource Hash: b61257c26264a2d7eea71f0228f96d6a2e3e05d194cd3247342554f2aeeacd8d

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 20 Feb 2020 08:13:06 GMT
Server: Apache
Connection: keep-alive
Content-Length: 403
Content-Type: text/html; charset=UTF-8

GET
H2 200 collect
www.google-analytics.com/ 35 B
99 B 6ms
6ms Image
image/gif 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j81&a=17341638&t=event&ni=1&_s=2&dl=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&ul=en-us&de=UTF-8&dt=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aGDAgEAB~&jid=&gjid=&cid=2081577110.1582186386&tid=UA-2343305-1&_gid=534476128.1582186386&cd5=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&cd19=gtm%20%2B%20dtm&cd6=(Non-Company%20Visitor)&cd7=(Non-Company%20Visitor)&cd8=(Non-Company%20Visitor)&cd9=Bot&cd10=(Non-Company%20Visitor)&cd11=(Non-Company%20Visitor)&cd12=(Non-Company%20Visitor)&cd13=(Non-Company%20Visitor)&cd14=(Non-Company%20Visitor)&cd15=BRU&cd16=(Non-Company%20Visitor)&cd17=(Non-Company%20Visitor)&cd18=Belgium&z=2133968309

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Tue, 04 Feb 2020 19:09:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1343004
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
research.juniper.net/ Frame 730A 11 KB
11 KB 43ms
23ms Document
text/html 13.35.253.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.84 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-84.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: db82939943dfa4e2ddd5cb40b4eef2237e4ff65a12c248db91352b36dbbca8a3

Request headers

:method: GET
:authority: research.juniper.net
:scheme: https
:path: /?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: check=true; AMCVS_D206123F524450F50A490D45%40AdobeOrg=1; jnpr_vID=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385; dmdbase_cdc=DBSET; AMCV_D206123F524450F50A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18313%7CMCMID%7C65498175306365136370015701310677150669%7CMCAAMLH-1582791184%7C6%7CMCAAMB-1582791184%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582193584s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18320%7CvVersion%7C3.1.2; _fbp=fb.1.1582186385477.1207459556; mbox=session#16c43adb748b4c509600698386080c28#1582188246|PC#16c43adb748b4c509600698386080c28.26_0#1645431186; mboxEdgeCluster=26; s_cc=true; _gcl_au=1.1.1291377565.1582186386; _ga=GA1.2.2081577110.1582186386; _gid=GA1.2.534476128.1582186386; _gat_b=1; _gat_jn=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
content-type: text/html
content-length: 11311
last-modified: Mon, 20 Jan 2020 22:54:47 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 20 Feb 2020 08:13:06 GMT
etag: "b54bfc44e96bae45f2b930edddba58f9"
cache-control: max-age=3600
x-cache: Hit from cloudfront
via: 1.1 f038e7175be9761825b2eefc2b0a832e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: ZQtHcGKzhI1ksOHJy0FOeRMRjxyv0DH7m-kyuRUtkcKECCxYFe8FnA==

GET
H2 200 _pclPrint.min.js Show response
research.juniper.net/ Frame 730A 38 KB
39 KB 23ms
23ms Script
application/javascript 13.35.253.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/_pclPrint.min.js
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.84 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-84.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c5aff3477022f781ee765989cdf6abbdd986f331064c59f5655fab8c6f9796c7

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 07:23:52 GMT
via: 1.1 f038e7175be9761825b2eefc2b0a832e.cloudfront.net (CloudFront)
last-modified: Tue, 23 Jul 2019 21:53:49 GMT
server: AmazonS3
age: 2955
etag: "2b2becfbac440238e8ca3a6f7a3b2c50"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 39179
x-amz-cf-id: zg1wJNgapPAb_tonTbYtAAxp0Y79u8HWtDeOUKBZzOdb-I_A0uvxFA==

GET
H/1.1 200
OK profiler Show response
lookups.rmulus.com/pntheon/profiles/ 25 B
205 B 118ms
117ms XHR
application/json 52.72.180.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lookups.rmulus.com/pntheon/profiles/profiler?_pclientId=jnpr&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pmatchedip&_plkpPrfl=82.102.19.134
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.180.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-180-134.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 851bd834d24a84c0f4780789e868a65f9db8d9655a7a0cac039dbf3b65ad873f

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 20 Feb 2020 08:13:06 GMT
Server: Apache
Connection: keep-alive
Content-Length: 25
Content-Type: application/json

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame 730A 74 KB
28 KB 17ms
16ms Script
application/javascript 2a00:1450:4001:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-956680084

Requested by

Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3f62ff9e57b4243edeb728b981a1380a3bbf12d8c18c092fa93cac93a72e5a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28494
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 20 Feb 2020 08:13:06 GMT

GET
H2 200 insight.min.js Show response
research.juniper.net/ Frame 730A 15 KB
15 KB 22ms
22ms Script
application/javascript 13.35.253.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/insight.min.js
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.84 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-84.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0f533082d6b784c7f939ad3fbcafc2faa6a88d96f0b076f7a0e28b431995bff

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 07:23:52 GMT
via: 1.1 f038e7175be9761825b2eefc2b0a832e.cloudfront.net (CloudFront)
last-modified: Fri, 26 Jul 2019 18:43:20 GMT
server: AmazonS3
age: 2955
etag: "5b837d1dc3da4d22567332e2fe693e12"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 15282
x-amz-cf-id: 4EeQjv2TkzHQ6Gicv0BAffwVy81wC5xgp3MaMuYpgQoPtdQYN9cirQ==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 730A 126 KB
30 KB 6ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: raUFI/o6CJPg70nfZsFaPgrH9qPowb5wextIB3x7tdmToFj6reh/QQ058oE/ulJLnlHEYgZhlsK3gRtQ2I+/mQ==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:13:06 GMT, Thu, 20 Feb 2020 08:13:06 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ Frame 730A 5 KB
2 KB 22ms
22ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: gzip
age: 86364
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-hhn4065-HHN
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582186387.690416,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 /
collect.rmulus.com/ Frame 730A 43 B
365 B 21ms
21ms Image
image/gif 13.35.253.48
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://collect.rmulus.com/?_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387&_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=a29d5f7b2fb83ed2db62c131cb65f013&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled&cachebuster=8126804
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.48 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-48.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 19 Feb 2020 19:21:49 GMT
via: 1.1 560d8d35213ac925f8d05c5730db1582.cloudfront.net (CloudFront)
last-modified: Mon, 16 Jan 2017 04:49:32 GMT
server: AmazonS3
age: 46278
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 43
x-amz-cf-id: 6A_lC3v3eI0-aPkiRC0OnQZLk5Xfm1t8UCY8EysSW5ggbc8I8_hDxA==

GET
H2 200 340159566928684 Show response
connect.facebook.net/signals/config/ Frame 730A 447 KB
112 KB 9ms
9ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/340159566928684?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1498e3b254909c3f097fc78de60171d0be0c367e534e0af35c21c359ef6801e7

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 114918
x-xss-protection: 0
pragma: public
x-fb-debug: Vq72Vfz6r5BFvpRQ3TxRbX8unHXds13TSdEmM/ksGFNSCkovMMuRlTkY992qkaLqQqADv8jJwnPcraBt2paL+A==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:13:06 GMT, Thu, 20 Feb 2020 08:13:06 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame 730A 26 KB
10 KB 32ms
32ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-956680084

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f98.1e100.net

Software

cafe /

Resource Hash

e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9931
x-xss-protection: 0
server: cafe
etag: 9478280665056484852
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 20 Feb 2020 08:13:06 GMT

GET
H2 200 / Show response
px.ads.linkedin.com/collect/ Frame 730A 0
40 B 110ms
110ms Script
application/javascript 2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/collect/?time=1582186386713&pid=4751&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_pclPrint%253Dtrue%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%26_pclIp%3Ddisabled&fmt=js&s=1
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: zGvFzCIO9RUwqkprxSoAAA==

POST
H2 200 /
www.facebook.com/tr/ Frame 730A 0
74 B 6ms
6ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
Origin: https://research.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbrt7zwudf7GIQK4

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
access-control-allow-origin: https://research.juniper.net
date: Thu, 20 Feb 2020 08:13:06 GMT
content-type: text/plain
status: 200
access-control-allow-credentials: true
alt-svc: h3-24=":443"; ma=3600
content-length: 0

GET
H2 200 / Show response
research.juniper.net/ Frame E1E5 11 KB
11 KB 22ms
21ms Document
text/html 13.35.253.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.84 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-84.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: db82939943dfa4e2ddd5cb40b4eef2237e4ff65a12c248db91352b36dbbca8a3

Request headers

:method: GET
:authority: research.juniper.net
:scheme: https
:path: /?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: check=true; AMCVS_D206123F524450F50A490D45%40AdobeOrg=1; jnpr_vID=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385; dmdbase_cdc=DBSET; AMCV_D206123F524450F50A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18313%7CMCMID%7C65498175306365136370015701310677150669%7CMCAAMLH-1582791184%7C6%7CMCAAMB-1582791184%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582193584s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18320%7CvVersion%7C3.1.2; _fbp=fb.1.1582186385477.1207459556; mbox=session#16c43adb748b4c509600698386080c28#1582188246|PC#16c43adb748b4c509600698386080c28.26_0#1645431186; mboxEdgeCluster=26; s_cc=true; _gcl_au=1.1.1291377565.1582186386; _ga=GA1.2.2081577110.1582186386; _gid=GA1.2.534476128.1582186386; _gat_b=1; _gat_jn=1; rmulusId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
content-type: text/html
content-length: 11311
last-modified: Mon, 20 Jan 2020 22:54:47 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 20 Feb 2020 08:13:06 GMT
etag: "b54bfc44e96bae45f2b930edddba58f9"
cache-control: max-age=3600
x-cache: Hit from cloudfront
via: 1.1 f038e7175be9761825b2eefc2b0a832e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: Lb2lvZtVBCoc1SEYEfKQ_atEUQ1UOqPlvc8JF0C4sIhrQwF1hT_9lg==

GET
H2 200 adsct Show response
analytics.twitter.com/i/ Frame 730A 31 B
159 B 136ms
136ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&tw_document_referrer=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_pclPrint%253Dtrue%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%26_pclIp%3Ddisabled

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 114
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:06 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 1e0d305d8d152b6a20b22a042a1099f7
x-transaction: 00a0f53e0070d593
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ Frame 730A 43 B
170 B 133ms
132ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&tw_document_referrer=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:06 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: dda3e2ad543e71c17ca1544e623d9609
x-transaction: 00d26aaa003e7609
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/ Frame 730A 3 KB
1 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:81a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582186386747&cv=9&fst=1582186386747&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4681109f9365df556b39480ec9c525e8ab4d48501dcd739b36f2b44ae82a594

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/ Frame 730A 6 KB
2 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:81a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582186386749&cv=9&fst=1582186386749&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dpage_view%3B_pclId%3DtxwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387%3B_pevId%3D7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts%26_plkpKey%5C%3Djnpr_vId%26_plkpPrfl%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_pclPrint%5C%3Dtrue%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts%3B_plkpKey%3Djnpr_vId%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_pclPrint%3Da29d5f7b2fb83ed2db62c131cb65f013%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%3B_pclIp%3Ddisabled&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

66bb91bb79f73ba3d49b70003169ca2ff27731c31ec2acab0add3aec23dca1bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1717
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame E1E5 74 KB
28 KB 16ms
16ms Script
application/javascript 2a00:1450:4001:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-956680084

Requested by

Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3f62ff9e57b4243edeb728b981a1380a3bbf12d8c18c092fa93cac93a72e5a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28494
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 20 Feb 2020 08:13:06 GMT

GET
H2 200 insight.min.js Show response
research.juniper.net/ Frame E1E5 15 KB
15 KB 23ms
23ms Script
application/javascript 13.35.253.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/insight.min.js
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.84 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-84.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0f533082d6b784c7f939ad3fbcafc2faa6a88d96f0b076f7a0e28b431995bff

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 07:23:52 GMT
via: 1.1 f038e7175be9761825b2eefc2b0a832e.cloudfront.net (CloudFront)
last-modified: Fri, 26 Jul 2019 18:43:20 GMT
server: AmazonS3
age: 2955
etag: "5b837d1dc3da4d22567332e2fe693e12"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 15282
x-amz-cf-id: XylfI5lkmeMSN7MxtvSHKhhvr8sw7NIQcnfh_0i2xsg6hlYDPwdSfw==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame E1E5 126 KB
30 KB 6ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: raUFI/o6CJPg70nfZsFaPgrH9qPowb5wextIB3x7tdmToFj6reh/QQ058oE/ulJLnlHEYgZhlsK3gRtQ2I+/mQ==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:13:06 GMT, Thu, 20 Feb 2020 08:13:06 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ Frame E1E5 5 KB
2 KB 21ms
21ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: gzip
age: 86364
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-hhn4065-HHN
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582186387.767568,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 /
collect.rmulus.com/ Frame E1E5 43 B
367 B 21ms
20ms Image
image/gif 13.35.253.48
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://collect.rmulus.com/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387&cachebuster=52650698
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.48 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-48.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 19 Feb 2020 19:21:49 GMT
via: 1.1 560d8d35213ac925f8d05c5730db1582.cloudfront.net (CloudFront)
last-modified: Mon, 16 Jan 2017 04:49:32 GMT
server: AmazonS3
age: 46278
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 43
x-amz-cf-id: O6fN7KVw5CSP8XRbJwcJzBs5A9AvihVkQx8YPIUgCTl0VKRhcM052Q==

GET
H2 200 340159566928684 Show response
connect.facebook.net/signals/config/ Frame E1E5 447 KB
112 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/340159566928684?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1498e3b254909c3f097fc78de60171d0be0c367e534e0af35c21c359ef6801e7

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 114918
x-xss-protection: 0
pragma: public
x-fb-debug: Vq72Vfz6r5BFvpRQ3TxRbX8unHXds13TSdEmM/ksGFNSCkovMMuRlTkY992qkaLqQqADv8jJwnPcraBt2paL+A==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:13:06 GMT, Thu, 20 Feb 2020 08:13:06 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/956680084/ Frame 730A 42 B
110 B 21ms
20ms Image
image/gif 2a00:1450:4001:820::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956680084/?random=1582186386747&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=2309497103&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956680084/ Frame 730A 42 B
110 B 27ms
26ms Image
image/gif 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956680084/?random=1582186386747&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=2309497103&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/956680084/ Frame 730A 42 B
110 B 26ms
23ms Image
image/gif 2a00:1450:4001:820::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956680084/?random=1582186386749&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pclId%3DtxwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387%3B_pevId%3D7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts%26_plkpKey%5C%3Djnpr_vId%26_plkpPrfl%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_pclPrint%5C%3Dtrue%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts%3B_plkpKey%3Djnpr_vId%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_pclPrint%3Da29d5f7b2fb83ed2db62c131cb65f013%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%3B_pclIp%3Ddisabled&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=2200584703&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956680084/ Frame 730A 42 B
110 B 27ms
25ms Image
image/gif 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956680084/?random=1582186386749&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pclId%3DtxwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387%3B_pevId%3D7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts%26_plkpKey%5C%3Djnpr_vId%26_plkpPrfl%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_pclPrint%5C%3Dtrue%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts%3B_plkpKey%3Djnpr_vId%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_pclPrint%3Da29d5f7b2fb83ed2db62c131cb65f013%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%3B_pclIp%3Ddisabled&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=2200584703&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=7a8UzWxavvZ6TkJlJLSV12yZoQAcTO5C-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ Frame E1E5 43 B
120 B 132ms
132ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 110
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:06 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: dda3e2ad543e71c17ca1544e623d9609
x-transaction: 00c8974300a4a64d
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame E1E5 26 KB
10 KB 33ms
32ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-956680084

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f98.1e100.net

Software

cafe /

Resource Hash

e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9931
x-xss-protection: 0
server: cafe
etag: 9478280665056484852
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 20 Feb 2020 08:13:06 GMT

POST
H2 200 /
www.facebook.com/tr/ Frame E1E5 0
30 B 6ms
5ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
Origin: https://research.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarystpbRKlza8OxkIkv

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
access-control-allow-origin: https://research.juniper.net
date: Thu, 20 Feb 2020 08:13:06 GMT
content-type: text/plain
status: 200
access-control-allow-credentials: true
alt-svc: h3-24=":443"; ma=3600
content-length: 0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/ Frame E1E5 3 KB
1 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:81a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582186386822&cv=9&fst=1582186386822&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ea2b894618db02e83c419dd15cfe1aed2c939497504f98b0b43a120a22a98d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1319
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/ Frame E1E5 6 KB
2 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:81a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582186386823&cv=9&fst=1582186386823&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dpage_view%3B_pevId%3D6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%5C%3D_pclIp._pmatchedIP%26_plkpPrfl%5C%3Dactive%26_pclIp%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts_ip%3B_plkpKey%3D_pclIp._pmatchedIP%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pcityName%3DBrussels%3B_pcompanyName%3DM247%20Ltd%3B_pcontinentCode%3DEU%3B_pcontinentName%3DEurope%3B_pcountryISOCode%3DBE%3B_pcountryName%3DBelgium%3B_platitude%3D50.8847%3B_plongitude%3D4.5049%3B_pmatchedIP%3D82.102.19.134%3B_ppostalCode%3D1930%3B_pstateISOCode%3DBRU%3B_pstateName%3DBrussels%20Capital%3B_ptimeZone%3DEurope%2FBrussels%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%3B_pclId%3DtxwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f611a5d472aa1aa7fa4e96f08b6d53381b2ecb77473471b4e8f2408afec7155a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1842
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/956680084/ Frame E1E5 42 B
110 B 23ms
22ms Image
image/gif 2a00:1450:4001:820::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956680084/?random=1582186386822&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=3167943851&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956680084/ Frame E1E5 42 B
110 B 22ms
22ms Image
image/gif 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956680084/?random=1582186386822&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=3167943851&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/956680084/ Frame E1E5 42 B
110 B 24ms
23ms Image
image/gif 2a00:1450:4001:820::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956680084/?random=1582186386823&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pevId%3D6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%5C%3D_pclIp._pmatchedIP%26_plkpPrfl%5C%3Dactive%26_pclIp%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts_ip%3B_plkpKey%3D_pclIp._pmatchedIP%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pcityName%3DBrussels%3B_pcompanyName%3DM247%20Ltd%3B_pcontinentCode%3DEU%3B_pcontinentName%3DEurope%3B_pcountryISOCode%3DBE%3B_pcountryName%3DBelgium%3B_platitude%3D50.8847%3B_plongitude%3D4.5049%3B_pmatchedIP%3D82.102.19.134%3B_ppostalCode%3D1930%3B_pstateISOCode%3DBRU%3B_pstateName%3DBrussels%20Capital%3B_ptimeZone%3DEurope%2FBrussels%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%3B_pclId%3DtxwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=375897175&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956680084/ Frame E1E5 42 B
110 B 25ms
25ms Image
image/gif 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956680084/?random=1582186386823&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pevId%3D6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%5C%3D_pclIp._pmatchedIP%26_plkpPrfl%5C%3Dactive%26_pclIp%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts_ip%3B_plkpKey%3D_pclIp._pmatchedIP%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pcityName%3DBrussels%3B_pcompanyName%3DM247%20Ltd%3B_pcontinentCode%3DEU%3B_pcontinentName%3DEurope%3B_pcountryISOCode%3DBE%3B_pcountryName%3DBelgium%3B_platitude%3D50.8847%3B_plongitude%3D4.5049%3B_pmatchedIP%3D82.102.19.134%3B_ppostalCode%3D1930%3B_pstateISOCode%3DBRU%3B_pstateName%3DBrussels%20Capital%3B_ptimeZone%3DEurope%2FBrussels%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%3B_pclId%3DtxwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=375897175&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:13:06 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
px.ads.linkedin.com/collect/ Frame E1E5 0
40 B 114ms
111ms Script
application/javascript 2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/collect/?time=1582186386919&pid=4751&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pcityName%3DBrussels%26_pcompanyName%3DM247%2520Ltd%26_pcontinentCode%3DEU%26_pcontinentName%3DEurope%26_pcountryISOCode%3DBE%26_pcountryName%3DBelgium%26_platitude%3D50.8847%26_plongitude%3D4.5049%26_pmatchedIP%3D82.102.19.134%26_ppostalCode%3D1930%26_pstateISOCode%3DBRU%26_pstateName%3DBrussels%2520Capital%26_ptimeZone%3DEurope%252FBrussels%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%26_pclId%3DtxwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387&fmt=js&s=1
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:06 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: LldM2SIO9RXQnZFSxSoAAA==

GET
H2 200 adsct Show response
analytics.twitter.com/i/ Frame E1E5 31 B
163 B 147ms
144ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&tw_document_referrer=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3D6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pcityName%3DBrussels%26_pcompanyName%3DM247%2520Ltd%26_pcontinentCode%3DEU%26_pcontinentName%3DEurope%26_pcountryISOCode%3DBE%26_pcountryName%3DBelgium%26_platitude%3D50.8847%26_plongitude%3D4.5049%26_pmatchedIP%3D82.102.19.134%26_ppostalCode%3D1930%26_pstateISOCode%3DBRU%26_pstateName%3DBrussels%2520Capital%26_ptimeZone%3DEurope%252FBrussels%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385%26_pclId%3DtxwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=6hQgIsp8VbGfenyskCUM1i6DUIwkzT2R-1582186386&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Brussels&_pcompanyName=M247%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=BE&_pcountryName=Belgium&_platitude=50.8847&_plongitude=4.5049&_pmatchedIP=82.102.19.134&_ppostalCode=1930&_pstateISOCode=BRU&_pstateName=Brussels%20Capital&_ptimeZone=Europe%2FBrussels&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385&_pclId=txwCjfFhlUAsIHG4cFefsFeMOUA1M8D4-1582186387
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 121
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:13:07 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 1e0d305d8d152b6a20b22a042a1099f7
x-transaction: 0000a37f00577069
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 satellite-57e2f6c764746d7a990154e8.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 1 KB
676 B 47ms
46ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57e2f6c764746d7a990154e8.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 0b30b39cc04a7922ed34d3d567d814c6ea9c8cea7e4ba2302b5d45272c13a483

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:16 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:48 GMT
server: AkamaiNetStorage
etag: "143f04ca053bbbb67e7e7db60384c44e:1582139328.582401"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 431
expires: Thu, 20 Feb 2020 09:13:16 GMT

GET
H2 200 satellite-586d49e464746d11fd002f2c.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 414 B
526 B 47ms
46ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-586d49e464746d11fd002f2c.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: f0ebf94842d7584c1c3c4925765c776bc6acc5345d1c01bdb846b416bad07877

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:16 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:48 GMT
server: AkamaiNetStorage
etag: "73f8288b3e1da89f3ff0360bfca03245:1582139328.788734"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 281
expires: Thu, 20 Feb 2020 09:13:16 GMT

GET
H2 200 satellite-5630f65f64746d185c002af5.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 503 B
579 B 71ms
24ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5630f65f64746d185c002af5.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 1fee2fb3eb1831930f4e325e6f05dc0d322ce37f53cc7da4cd2cdde999ed0b1d

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:13:16 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:36 GMT
server: AkamaiNetStorage
etag: "902ab4d82e29bb124a4127654ea7be62:1582139316.38057"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 335
expires: Thu, 20 Feb 2020 09:13:16 GMT

Verdicts & Comments Add Verdict or Comment

123 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478(Line 5646) Message: Mobile Width. Width is lessthan or equalto 480!
console-api	log	URL: https://forumstage.juniper.net/html/assets/global-nav.js(Line 78) Message: check=true; AMCVS_D206123F524450F50A490D45%40AdobeOrg=1; jnpr_vID=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385; dmdbase_cdc=DBSET; AMCV_D206123F524450F50A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18313%7CMCMID%7C65498175306365136370015701310677150669%7CMCAAMLH-1582791184%7C6%7CMCAAMB-1582791184%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582193584s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18320%7CvVersion%7C3.1.2; _fbp=fb.1.1582186385477.1207459556; mbox=session#16c43adb748b4c509600698386080c28#1582188246\|PC#16c43adb748b4c509600698386080c28.26_0#1645431186; mboxEdgeCluster=26
console-api	log	URL: https://forumstage.juniper.net/html/assets/global-nav.js(Line 78) Message: check=true; AMCVS_D206123F524450F50A490D45%40AdobeOrg=1; jnpr_vID=ubPXlaWtLHvykDpX8LIvcJvJVRjVdtb0-1582186385; dmdbase_cdc=DBSET; AMCV_D206123F524450F50A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18313%7CMCMID%7C65498175306365136370015701310677150669%7CMCAAMLH-1582791184%7C6%7CMCAAMB-1582791184%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582193584s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18320%7CvVersion%7C3.1.2; _fbp=fb.1.1582186385477.1207459556; mbox=session#16c43adb748b4c509600698386080c28#1582188246\|PC#16c43adb748b4c509600698386080c28.26_0#1645431186; mboxEdgeCluster=26
console-api	log	URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478(Line 3242) Message: This is secondary nav bar;
console-api	log	URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478(Line 170) Message: on load

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3872718.fls.doubleclick.net
5922977.fls.doubleclick.net
ajax.googleapis.com
analytics.twitter.com
api.company-target.com
api.demandbase.com
assets.adobedtm.com
attr.ml-api.io
cloud.webtype.com
cm.everesttech.net
collect.rmulus.com
connect.facebook.net
dpm.demdex.net
fonts.googleapis.com
fonts.gstatic.com
forums.juniper.net
forumstage.juniper.net
googleads.g.doubleclick.net
img.en25.com
jnet.i.lithium.com
junipernetworks.d2.sc.omtrdc.net
junipernetworks.demdex.net
junipernetworks.tt.omtrdc.net
lookups.rmulus.com
match.prod.bidr.io
maxcdn.bootstrapcdn.com
platform.twitter.com
pls.webtype.com
px.ads.linkedin.com
research.juniper.net
s.ml-attr.com
s1229.t.eloqua.com
scripts.demandbase.com
secure.adnxs.com
secure.rmulus.com
segments.company-target.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tags.bluekai.com
use.fontawesome.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.juniper.net
104.103.106.126
104.244.42.133
104.244.42.195
13.35.253.48
13.35.253.61
13.35.253.82
13.35.253.84
143.204.202.55
143.204.202.70
151.101.112.157
172.217.16.134
172.217.22.38
172.217.23.98
18.139.76.45
185.33.223.218
2001:4de0:ac19::1:b:2b
208.74.205.254
208.74.207.25
209.167.231.17
23.111.9.35
23.210.248.45
23.45.237.36
2a00:1450:4001:80b::200e
2a00:1450:4001:815::2003
2a00:1450:4001:817::2008
2a00:1450:4001:81a::2002
2a00:1450:4001:81b::200a
2a00:1450:4001:81d::2003
2a00:1450:4001:81e::200a
2a00:1450:4001:820::2004
2a00:1450:400c:c00::9a
2a02:26f0:6c00:180::720
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
34.241.149.220
52.208.212.211
52.49.193.31
52.72.180.134
65.52.62.25
66.117.28.86
66.117.29.4
68.67.153.60
93.184.220.41
93.184.220.97
01eb8f5a91c70faa5681a3048eab75e78f30b4c4e0c04f8afbb46bfa98371ec0
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0b30b39cc04a7922ed34d3d567d814c6ea9c8cea7e4ba2302b5d45272c13a483
0d815b2e925f887c1210ae79918c2daed72f94cafb870f4fedffcfac47a341b4
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1451b7c400c9e305f589883bbe1b45139abc74e3c977a8b91fa353dda6a642cb
1498e3b254909c3f097fc78de60171d0be0c367e534e0af35c21c359ef6801e7
15c14a35beeabe632f718ce14189ade1b8b6760b977e1e8149b5e1211d3efde5
179f42988ae4cab77687b27656fc69ab3fa07efbcf6279ac1bef85ac0688e69d
18b4b83afed32c0ec228e62a5f1080fbad1ca25addd958a4fc8b30c281fcc031
1d111313a277d37912be5ec29e0d77426d991feb85a04106694b72f66739885b
1fee2fb3eb1831930f4e325e6f05dc0d322ce37f53cc7da4cd2cdde999ed0b1d
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
272a2861dab52511f662603420b847ab73e6e13e75e8973c3091bdaa44c51706
2c9f1c57bc31c65cdb84a1c44c0c91fc88799512fd87c5bc6e52b21f69abd5d0
30e3f5a97af46d8cb43bf62c9875a8eacfc02c00826ea47549d4e33d0e1aa446
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
3928a8be3b073b7b4272b3863934222d52f00e782a0d157b9b7edfd7acf1bfbd
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d
3cbe26cb08e96b3a719322a75e5f0f3e1615f1aabff04bad346b0a08af232194
3e84bcc6469e170029339c0b60b522671ca5d4298578308ec882df95f7badd9c
3eadffc329fb1c32ee10e809962cb4114a71d92b0f30db0b9ba9bef6abc91015
3f62ff9e57b4243edeb728b981a1380a3bbf12d8c18c092fa93cac93a72e5a6a
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44c53106498ced14c80aab52391120b380216ce24de07bb5a91e659fd3ba8aed
4a3d7f509f217225975b98891f41fde0b216552b35f9a76460e86aaf52454733
4c5ed401667661bca33d013a7bc790e2079bbe0300a1a1d5ad5e5780ae259a4b
4c891889ca55d5cadf9e960d2e40f31f50ac0b6252417a9be7414ff2f26a3880
4cdde47aa921b0cc562b8cadb9366ea11d83bd0f27d3aa2e4ab8c22486f592d2
4dcc161d0ef98a2c9c1b776a90ab5c284032d8a333964620545bf1ceee13ac89
4ded81a3d2fd6dd9c1240d80be198e98eb78db7dc4e3e525fd21ffc0c05efbcd
506339130f152becadfa3ab2fbdbab5261035e4f9c343440ec23bc178cdc164a
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
57f53d1b65316e7362b02a42d2a07319fcd3a8d75f2dc91d0094caf98181c741
5855809ae723b4a35f3120be99dccfc8403b3dd379fd86efeacdad8767ea6320
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
5b6b9462f29599d5332fa41d67010d03aa0aadb939144caad40e341bd3a2939a
5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350
626ef4978a3758ced595afe37b89812432ef49fe3f967d2cd8e1321459b3a9b8
66bb91bb79f73ba3d49b70003169ca2ff27731c31ec2acab0add3aec23dca1bf
6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae
6b8797e0cf30f8a00ff41912ebcc895055ffeb426b34f70c4933b9828b1ca720
70349fe86be7c6dcd4062011d02d91185a4a45b60e2826f05985d67f8ae43bd3
70c2868114f52cb3b41e70e017c88ee5f5495639db9d495574e8ced55e7b272f
7283dcbdf14b954c1e61e173cc8bdb244b2bf508b7f0211ac749857bf47acda3
79340c32d5422c3331db60c78f9854b0d9c0a9bd0f9c454b7398734c1b990658
79e16119ceda988947279eb9addd1869b4270af3967b69ec9e09713ae4b6572b
7b08b6c86fb4d51c3e96dd3f06ed35c02b7f0662404fb6b14b9b2b0425a9e28a
7c9a167fcb4f690dc41db9f58f3ee6a20d3bba39316f2b46c8031c6d8ca300f1
7da66ec546c027bfe5b9ca59aa2225cfaa5f0d68f96801f31186878c0fa853f8
7ee39e6b76207efc841a6882a2af5241490e1a2161c4e13790f78fb4dbfdde28
7ff5a2ce1b7603d6e9f61f85587efe96cbed61d71ace91bcc6ca7d0bc07cc7ce
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
847ad7d2d327222488e06177809a66d0517d53362838b94dfd3f1961d209d8b1
851bd834d24a84c0f4780789e868a65f9db8d9655a7a0cac039dbf3b65ad873f
85d9f9ab745f8b1dd6c6dc27722498c9eaf0f1e864242b01c7f396a5fb3aa3dc
8844cfebefa2192e921ac8233c63ab3c0ad98a44823b71d84cd1ec25411a7a40
8a3e8d4242f53959806c3ebf262affb1bd5a78e361acb2d5bf14be201ee56a3e
8c785b78817298c70c27829e6903d75fac181ed591e3260c4b1fec35f0cd03c0
8febd8b0e9b817a31d401574d8f8aaeb5003d76c2c1afa9da932fa0990685b53
92dc916bc3b1001de758bc7fa95b57046ab5a80f1da16558fe8c8051d331f211
983b0caf336e8542214fc17019a4fc5e0360864b92806ca14d55c1fc1c2c5a0f
9912c03b52a7cb0fc11bde58e200010eca671219552929b31be4c2e26c0e10c3
9c3e9a35283d074cbf4f873b077e78b5a8cbd9a8bb4caa5ccc09e0142962a65a
9e5b8d4ced66c172dc84f16051eee4bac1e0fc60781c1ea05d73072b3cc7ddf1
9ea2b894618db02e83c419dd15cfe1aed2c939497504f98b0b43a120a22a98d6
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c
abeaf4a2dde5b673ce9957f08cb803a54d6b82b90bc1fa958a8335168d501c8b
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad9e90d9b2ef8c8af06afa88f231a5cf0dff89eb5c47a948dfbde3c856c7db39
ae88fc0d7a961832f809527d30bd3983a6866d42f66a56ade23f543681594db6
b1110f2c7ae9f0a22977c4df6431fdfef92d1e8223f9734713e57aeb2ee96fcf
b4681109f9365df556b39480ec9c525e8ab4d48501dcd739b36f2b44ae82a594
b61257c26264a2d7eea71f0228f96d6a2e3e05d194cd3247342554f2aeeacd8d
b8eea75e456823a6e0eebfa1e4f27b56395485fff2bbf27e0344f7bf4fa8e509
bacc031e0bfe9a4084bb166f88193dcdc3498aab6b1d14ebedbb75045afce823
bef8b6a5f4399be5da990490ceee7525da2698723a003af12b7095f03a78a34f
c0f533082d6b784c7f939ad3fbcafc2faa6a88d96f0b076f7a0e28b431995bff
c30c04eb35d4ff5c75690016858f8678b3c5ee7c68ec4cd76b71573b50a23943
c5aff3477022f781ee765989cdf6abbdd986f331064c59f5655fab8c6f9796c7
c6846556479addb85175eb801d75cd64485ccec53b42fac54441fef1895c0408
c74679537a89890b260d93e19aad5f4cc95a230623a945ffcc3d981fc13a1adf
cac7a767eecdd70123f853d74d1fb29d15cb89dfd93215b57dce2606b4cd1c23
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d2c5dc70ba0ff69d43a4a4a4adde73839bb028c5e978aeb81743b4a3dc825626
db0031471b3f9181ff21d83674674ac3dd7c128531fae90bc274ad0e17c58c37
db82939943dfa4e2ddd5cb40b4eef2237e4ff65a12c248db91352b36dbbca8a3
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e28195ef556c2e1f2d22ff939f487f10a32e608255bbd541be3eda5883b414c3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5d717d2c24e52afc0e139b41d817580583acad2e3c9d725d1bd46f0f7e5cb1b
e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a
e61de02b5fa3204c2ed29bd12fcdceaff8d33d4e9be52ff1a6c02a03a407baea
e731c0c50fe7048c11f72826a363a5f9d19193996377faa4f8542c0d654a0151
e8a8cd48f7f93a8c8d708eda1f3f9c6ddd886c3f6c38eee67aeac98897b09510
e8d5b01af589f68a0f2da663d3efc472fabb22d9ede91a7ffcf74d21e6295506
e931faaef092c8d98a58ac536216378f58e2a17a4833bbe5f9a29e5bbed849f6
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ec895e944daf4d8226fe560ff1d95437497215d33885fe2d0db0e54ce3db6d96
ed3a677654473b8329f8d886993e734d6cef36c4273263b767be878c9ff8ff44
edd8db5c29b96b7a290a5e266d426dca85541b7cd7a62b180e5ec89dc635f05f
eec3860fdc0bff086a73a04051948c4e76ea29a6b61eaa870083739555b83f64
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0ebf94842d7584c1c3c4925765c776bc6acc5345d1c01bdb846b416bad07877
f611a5d472aa1aa7fa4e96f08b6d53381b2ecb77473471b4e8f2408afec7155a
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6

forums.juniper.net Open in urlscan Pro 208.74.207.25 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

161 Requests

100 %HTTPS

31 %IPv6

33 Domains

48 Subdomains

41 IPs

8 Countries

5014 kBTransfer

12270 kBSize

0 Cookies

115 Outgoing links

Redirected requests

161 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

forums.juniper.net Open in urlscan Pro
208.74.207.25 Public Scan

Screenshot
Live screenshot

Full Image

161
Requests

100 %
HTTPS

31 %
IPv6

33
Domains

48
Subdomains

41
IPs

8
Countries

5014 kB
Transfer

12270 kB
Size

0
Cookies

161 HTTP transactions
1 data transactions