urlscan.io logo urlscan.io
SecurityTrails logo

securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289  Public Scan

Go To Rescan Add Verdict Report
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Submission: On April 14 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 101 IPs in 11 countries across 80 domains to perform 409 HTTP transactions. The main IP is 2001:8d8:100f:f000::289, located in Germany and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is securityaffairs.co. The Cisco Umbrella rank of the primary domain is 383026.
TLS certificate: Issued by GeoTrust TLS DV RSA Mixed SHA256 2020... on March 24th 2022. Valid for: a year.
This is the only time securityaffairs.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
43 2001:8d8:100f... 8560 (IONOS-AS ...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2600:9000:215... 16509 (AMAZON-02)
1 108.157.4.79 16509 (AMAZON-02)
20 23.35.228.23 16625 (AKAMAI-AS)
11 68.183.31.14 14061 (DIGITALOC...)
10 192.0.77.2 2635 (AUTOMATTIC)
2 192.0.76.3 2635 (AUTOMATTIC)
2 2a03:2880:f02... 32934 (FACEBOOK)
2 35.156.233.6 16509 (AMAZON-02)
1 2600:9000:215... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a04:fa87:fff... 2635 (AUTOMATTIC)
2 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
1 18.185.251.21 16509 (AMAZON-02)
1 2 2a02:2638::1c 44788 (ASN-CRITE...)
2 178.250.2.146 44788 (ASN-CRITE...)
1 51.89.21.8 16276 (OVH)
2 3 52.223.40.198 16509 (AMAZON-02)
3 5 185.33.221.90 29990 (ASN-APPNEX)
6 157.245.94.128 14061 (DIGITALOC...)
9 34.98.64.218 15169 (GOOGLE)
4 34.107.148.139 15169 (GOOGLE)
4 185.86.138.122 201081 (SMARTADSE...)
3 3.64.152.215 16509 (AMAZON-02)
2 10 216.52.2.19 29791 (VOXEL-DOT...)
4 18.193.172.152 16509 (AMAZON-02)
4 17 185.33.221.14 29990 (ASN-APPNEX)
4 178.162.133.150 60781 (LEASEWEB-...)
4 185.64.189.112 62713 (AS-PUBMATIC)
4 2602:803:c004... 26667 (RUBICONPR...)
4 34.149.20.76 15169 (GOOGLE)
2 35.157.246.167 16509 (AMAZON-02)
1 2 46.249.52.249 50673 (SERVERIUS-AS)
1 66.155.71.150 13768 (COGECO-PEER1)
2 5 34.202.74.122 14618 (AMAZON-AES)
1 2 138.201.8.249 24940 (HETZNER-AS)
1 5.178.65.246 50673 (SERVERIUS-AS)
1 205.234.175.175 30081 (CACHENETW...)
3 12 51.89.9.251 16276 (OVH)
4 4 216.200.232.253 30419 (MEDIAMATH...)
2 6 69.173.144.139 26667 (RUBICONPR...)
5 6 37.157.3.29 198622 (ADFORM)
3 4 52.59.41.116 16509 (AMAZON-02)
17 35 142.250.181.226 15169 (GOOGLE)
1 185.86.137.107 201081 (SMARTADSE...)
3 35.244.174.68 15169 (GOOGLE)
2 4 209.54.176.128 16509 (AMAZON-02)
1 104.36.113.35 62713 (AS-PUBMATIC)
4 5 18.156.0.31 16509 (AMAZON-02)
7 7 3.124.34.143 16509 (AMAZON-02)
1 5.178.65.245 50673 (SERVERIUS-AS)
1 5.178.65.253 50673 (SERVERIUS-AS)
31 2a00:1450:400... 15169 (GOOGLE)
1 51.15.145.115 12876 (Online SAS)
3 142.250.186.98 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
10 2a00:1450:400... 15169 (GOOGLE)
19 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
3 5 184.87.213.8 16625 (AKAMAI-AS)
14 2a00:1450:400... 15169 (GOOGLE)
4 217.79.188.59 24961 (MYLOC-AS ...)
4 85.114.159.98 24961 (MYLOC-AS ...)
2 142.250.186.130 15169 (GOOGLE)
3 2a02:fa8:8806... 41041 (VCLK-EU-SE)
2 2 135.125.160.160 16276 (OVH)
1 35.186.253.211 15169 (GOOGLE)
1 174.137.133.49 27257 (WEBAIR-IN...)
1 34.250.9.127 16509 (AMAZON-02)
2 3.125.70.222 16509 (AMAZON-02)
2 104.92.106.130 16625 (AKAMAI-AS)
2 3 185.94.180.125 35220 (SPOTX-AMS)
2 104.92.74.8 16625 (AKAMAI-AS)
4 151.101.129.108 54113 (FASTLY)
5 184.87.212.214 16625 (AKAMAI-AS)
4 104.17.119.107 13335 (CLOUDFLAR...)
1 67.202.105.21 32748 (STEADFAST)
2 2 104.45.178.220 8075 (MICROSOFT...)
1 1 81.222.128.214 20597 (ELTEL-AS)
1 1 2600:9000:224... 16509 (AMAZON-02)
1 192.82.242.209 62713 (AS-PUBMATIC)
1 2 2620:116:800d... 16509 (AMAZON-02)
2 66.155.71.25 13768 (COGECO-PEER1)
2 2 54.77.7.200 16509 (AMAZON-02)
1 178.162.133.149 60781 (LEASEWEB-...)
2 2 13.248.245.213 16509 (AMAZON-02)
1 1 193.0.160.129 54312 (ROCKETFUEL)
4 4 69.173.144.165 26667 (RUBICONPR...)
1 2 2a05:d018:d29... 16509 (AMAZON-02)
1 2a00:1288:80:... 203220 (YAHOO-DEB)
2 3 54.239.37.45 16509 (AMAZON-02)
1 2620:1ec:21::14 8068 (MICROSOFT...)
2 2 151.101.66.49 54113 (FASTLY)
2 13 104.36.113.107 62713 (AS-PUBMATIC)
2 3 54.171.228.20 16509 (AMAZON-02)
1 63.251.232.165 29791 (VOXEL-DOT...)
1 178.250.0.163 44788 (ASN-CRITE...)
1 38.91.45.7 398989 (DEEPINTENT)
1 1 154.59.122.79 174 (COGENT-174)
2 2 3.122.208.3 16509 (AMAZON-02)
1 2 23.75.246.168 16625 (AKAMAI-AS)
1 2 2606:4700:440... 13335 (CLOUDFLAR...)
1 38.27.122.101 174 (COGENT-174)
5 185.64.189.110 62713 (AS-PUBMATIC)
1 2 44.199.37.161 14618 (AMAZON-AES)
1 1 23.88.75.186 24940 (HETZNER-AS)
3 185.64.190.81 62713 (AS-PUBMATIC)
1 169.50.137.182 36351 (SOFTLAYER)
1 1 2001:678:cb4:... 56396 (AMOBEE)
1 1 54.146.66.83 14618 (AMAZON-AES)
2 2 193.232.150.60 48061 (UMA-TECH-AS)
1 2 204.2.255.233 2914 (NTT-LTD-2914)
1 1 34.102.253.54 15169 (GOOGLE)
409 101
43    2001:8d8:100f:f000::289 (Germany)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
securityaffairs.co
1    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
1    2600:9000:2156:7600:3:c04e:c780:93a1 (United States)

ASN16509 (AMAZON-02, US)
ws.sharethis.com
1    108.157.4.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-79.dus51.r.cloudfront.net
platform-api.sharethis.com
20    23.35.228.23 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-228-23.deploy.static.akamaitechnologies.com
contextual.media.net
lg3.media.net
11    68.183.31.14 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
served-by.pixfuture.com
10    192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com
i0.wp.com
2    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
2    2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
2    35.156.233.6 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-233-6.eu-central-1.compute.amazonaws.com
l.sharethis.com
1    2600:9000:2156:7000:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)
buttons-config.sharethis.com
1    2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
google-analytics.com
2    2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)
secure.gravatar.com
2    2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    2606:4700:20::ac43:4671 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.pixfuture.com
1    18.185.251.21 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-185-251-21.eu-central-1.compute.amazonaws.com
aa.agkn.com
2    2a02:2638::1c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
gum.criteo.com
2    178.250.2.146 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
mug.criteo.com
1    51.89.21.8 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: p29.id5-sync.com
id5-sync.com
3    52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
match.adsrvr.org
5    185.33.221.90 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
secure.adnxs.com
6    157.245.94.128 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
prebidserver.pixfuture.com
9    34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com
pixfuture2-d.openx.net
us-u.openx.net
u.openx.net
4    34.107.148.139 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 139.148.107.34.bc.googleusercontent.com
prebid.media.net
4    185.86.138.122 (France)

ASN201081 (SMARTADSERVER, FR)
prg.smartadserver.com
3    3.64.152.215 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-64-152-215.eu-central-1.compute.amazonaws.com
btlr.sharethrough.com
10    216.52.2.19 (United States)

ASN29791 (VOXEL-DOT-NET, US)
ap.lijit.com
4    18.193.172.152 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-193-172-152.eu-central-1.compute.amazonaws.com
hb.emxdgt.com
17    185.33.221.14 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
ib.adnxs.com
4    178.162.133.150 (Rijswijk, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-apex.go.sonobi.com
apex.go.sonobi.com
4    185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
4    2602:803:c004:200::143 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
4    34.149.20.76 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 76.20.149.34.bc.googleusercontent.com
ssc.33across.com
2    35.157.246.167 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
c2shb.ssp.yahoo.com
2    46.249.52.249 (Amsterdam, Netherlands)

ASN50673 (SERVERIUS-AS, NL)
PTR: ads.us.e-planning.net
ads.us.e-planning.net
1    66.155.71.150 (Portsmouth, United Kingdom)

ASN13768 (COGECO-PEER1, CA)
pixel.sitescout.com
5    34.202.74.122 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-202-74-122.compute-1.amazonaws.com
a.audrte.com
2    138.201.8.249 (Landshut, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.249.8.201.138.clients.your-server.de
sync.richaudience.com
1    5.178.65.246 (Amsterdam, Netherlands)

ASN50673 (SERVERIUS-AS, NL)
PTR: ads.us.e-planning.net
u-ams02.e-planning.net
1    205.234.175.175 (Leesburg, United States)

ASN30081 (CACHENETWORKS, US)
PTR: vip1.G-anycast1.cachefly.net
i.e-planning.net
12    51.89.9.251 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip251.ip-51-89-9.eu
onetag-sys.com
4    216.200.232.253 (Monrovia, United States)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
6    69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel-eu.rubiconproject.com
pixel.rubiconproject.com
6    37.157.3.29 (Denmark)

ASN198622 (ADFORM, DK)
dmp.adform.net
c1.adform.net
4    52.59.41.116 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-41-116.eu-central-1.compute.amazonaws.com
pixel.advertising.com
35    142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net
cm.g.doubleclick.net
1    185.86.137.107 (France)

ASN201081 (SMARTADSERVER, FR)
ssbsync-global.smartadserver.com
3    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com
idsync.rlcdn.com
4    209.54.176.128 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
1    104.36.113.35 (United States)

ASN62713 (AS-PUBMATIC, US)
image8.pubmatic.com
5    18.156.0.31 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
7    3.124.34.143 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-34-143.eu-central-1.compute.amazonaws.com
x.bidswitch.net
1    5.178.65.245 (Amsterdam, Netherlands)

ASN50673 (SERVERIUS-AS, NL)
PTR: ads.us.e-planning.net
sync.e-planning.net
1    5.178.65.253 (Amsterdam, Netherlands)

ASN50673 (SERVERIUS-AS, NL)
PTR: i.e-planning.net
s.e-planning.net
31    2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
1    51.15.145.115 (Paris, France)

ASN12876 (Online SAS, FR)
PTR: 51-15-145-115.rev.poneytelecom.eu
js.cookieless-data.com
3    142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net
partner.googleadservices.com
2    2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
3    2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
10    2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
adservice.google.de
19    2a00:1450:4001:827::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
3    2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
5    2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
5    184.87.213.8 (Milan, Italy)

ASN16625 (AKAMAI-AS, US)
PTR: a184-87-213-8.deploy.static.akamaitechnologies.com
dsum-sec.casalemedia.com
14    2a00:1450:4001:80e::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
s0.2mdn.net
4    217.79.188.59 (Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: imagesrv.adition.com
imagesrv.adition.com
4    85.114.159.98 (Rheinfelden, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: ad9.adfarm1.adition.com
ad9.adfarm1.adition.com
2    142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net
googleads4.g.doubleclick.net
3    2a02:fa8:8806:12::1400 (Singapore)

ASN41041 (VCLK-EU-SE, US)
dclk-match.dotomi.com
pubmatic-match.dotomi.com
2    135.125.160.160 (France)

ASN16276 (OVH, FR)
PTR: ns3198892.ip-135-125-160.eu
c.eu1.dyntrk.com
1    35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com
rtb.openx.net
1    174.137.133.49 (United States)

ASN27257 (WEBAIR-INTERNET, US)
dsp.adkernel.com
1    34.250.9.127 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-250-9-127.eu-west-1.compute.amazonaws.com
ads.yieldmo.com
2    3.125.70.222 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-125-70-222.eu-central-1.compute.amazonaws.com
ps.eyeota.net
2    104.92.106.130 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-92-106-130.deploy.static.akamaitechnologies.com
sync.teads.tv
3    185.94.180.125 (Amsterdam, Netherlands)

ASN35220 (SPOTX-AMS, US)
sync.search.spotxchange.com
2    104.92.74.8 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-92-74-8.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
4    151.101.129.108 (United States)

ASN54113 (FASTLY, US)
acdn.adnxs.com
5    184.87.212.214 (Milan, Italy)

ASN16625 (AKAMAI-AS, US)
PTR: a184-87-212-214.deploy.static.akamaitechnologies.com
ads.pubmatic.com
4    104.17.119.107 (None, )

ASN13335 (CLOUDFLARENET, US)
biddr.brealtime.com
1    67.202.105.21 (United States)

ASN32748 (STEADFAST, US)
PTR: ip21.67-202-105.static.steadfastdns.net
ssc-cms.33across.com
2    104.45.178.220 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
mweb.ck.inmobi.com
1    81.222.128.214 (Russian Federation)

ASN20597 (ELTEL-AS, RU)
PTR: ad14.adriver.ru
ssp.adriver.ru
1    2600:9000:224a:f800:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)
s.ad.smaato.net
1    192.82.242.209 (United States)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
2    2620:116:800d:21:36a9:ecb:e518:b308 (United States)

ASN16509 (AMAZON-02, US)
cms.quantserve.com
pixel.quantserve.com
2    66.155.71.25 (Portsmouth, United Kingdom)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
2    54.77.7.200 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-7-200.eu-west-1.compute.amazonaws.com
r.scoota.co
1    178.162.133.149 (Rijswijk, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-sync.go.sonobi.com
sync.go.sonobi.com
2    13.248.245.213 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com
eb2.3lift.com
1    193.0.160.129 (United States)

ASN54312 (ROCKETFUEL, US)
a.rfihub.com
4    69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
token.rubiconproject.com
2    2a05:d018:d29:3605:9b3d:59c:490d:6d21 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
pr-bh.ybp.yahoo.com
1    2a00:1288:80:807::1 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)
ads.yahoo.com
3    54.239.37.45 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
aax-eu.amazon-adsystem.com
1    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
2    151.101.66.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
13    104.36.113.107 (United States)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
3    54.171.228.20 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-228-20.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
1    63.251.232.165 (United States)

ASN29791 (VOXEL-DOT-NET, US)
cm.adgrx.com
1    178.250.0.163 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
dis.criteo.com
1    38.91.45.7 (United States)

ASN398989 (DEEPINTENT, US)
match.deepintent.com
1    154.59.122.79 (United States)

ASN174 (COGENT-174, US)
ums.acuityplatform.com
2    3.122.208.3 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-122-208-3.eu-central-1.compute.amazonaws.com
pm.w55c.net
2    23.75.246.168 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-75-246-168.deploy.static.akamaitechnologies.com
px.owneriq.net
2    2606:4700:4400::6812:230b (United States)

ASN13335 (CLOUDFLARENET, US)
a.tribalfusion.com
s.tribalfusion.com
1    38.27.122.101 (Chestertown, United States)

ASN174 (COGENT-174, US)
match.bnmla.com
5    185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
2    44.199.37.161 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-199-37-161.compute-1.amazonaws.com
beacon.lynx.cognitivlabs.com
1    23.88.75.186 (Gunzenhausen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.186.75.88.23.clients.your-server.de
csync.loopme.me
3    185.64.190.81 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image4.pubmatic.com
simage4.pubmatic.com
1    169.50.137.182 (United States)

ASN36351 (SOFTLAYER, US)
PTR: b6.89.32a9.ip4.static.sl-reverse.com
um.simpli.fi
1    2001:678:cb4:bbbb::11 (United Kingdom)

ASN56396 (AMOBEE, GB)
ad.turn.com
1    54.146.66.83 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-146-66-83.compute-1.amazonaws.com
sync.ipredictive.com
2    193.232.150.60 (Russian Federation)

ASN48061 (UMA-TECH-AS, RU)
PTR: smtp20.sender.ltmse.com
px.adhigh.net
2    204.2.255.233 (United States)

ASN2914 (NTT-LTD-2914, US)
pmp.mxptint.net
1    34.102.253.54 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 54.253.102.34.bc.googleusercontent.com
ads.playground.xyz
Apex Domain
Subdomains		 Transfer
50 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 98 Failed
tpc.googlesyndication.com — Cisco Umbrella Rank: 128
681 KB
46 doubleclick.net
cm.g.doubleclick.net — Cisco Umbrella Rank: 211
googleads.g.doubleclick.net — Cisco Umbrella Rank: 40
googleads4.g.doubleclick.net — Cisco Umbrella Rank: 293
89 KB
43 securityaffairs.co
securityaffairs.co — Cisco Umbrella Rank: 383026
1 MB
32 pubmatic.com
hbopenbid.pubmatic.com — Cisco Umbrella Rank: 457
image8.pubmatic.com — Cisco Umbrella Rank: 605
ads.pubmatic.com — Cisco Umbrella Rank: 461
image6.pubmatic.com — Cisco Umbrella Rank: 622
simage2.pubmatic.com — Cisco Umbrella Rank: 620
image2.pubmatic.com — Cisco Umbrella Rank: 898
image4.pubmatic.com — Cisco Umbrella Rank: 880
simage4.pubmatic.com
52 KB
26 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 438
ib.adnxs.com — Cisco Umbrella Rank: 248
acdn.adnxs.com — Cisco Umbrella Rank: 597
88 KB
24 media.net
contextual.media.net — Cisco Umbrella Rank: 527
lg3.media.net — Cisco Umbrella Rank: 3387
prebid.media.net — Cisco Umbrella Rank: 1206
125 KB
19 pixfuture.com
served-by.pixfuture.com — Cisco Umbrella Rank: 35113
cdn.pixfuture.com — Cisco Umbrella Rank: 45277
prebidserver.pixfuture.com — Cisco Umbrella Rank: 48369
503 KB
16 rubiconproject.com
fastlane.rubiconproject.com — Cisco Umbrella Rank: 458
pixel-eu.rubiconproject.com — Cisco Umbrella Rank: 2538
pixel.rubiconproject.com — Cisco Umbrella Rank: 350
eus.rubiconproject.com — Cisco Umbrella Rank: 567
token.rubiconproject.com — Cisco Umbrella Rank: 675
17 KB
14 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 262
2 MB
12 onetag-sys.com
onetag-sys.com — Cisco Umbrella Rank: 860
5 KB
12 wp.com
i0.wp.com — Cisco Umbrella Rank: 2767
stats.wp.com — Cisco Umbrella Rank: 2657
pixel.wp.com — Cisco Umbrella Rank: 2521
353 KB
10 yahoo.com
c2shb.ssp.yahoo.com — Cisco Umbrella Rank: 846
ups.analytics.yahoo.com — Cisco Umbrella Rank: 300
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 474
ads.yahoo.com — Cisco Umbrella Rank: 1132
4 KB
10 lijit.com
ap.lijit.com — Cisco Umbrella Rank: 607
4 KB
10 openx.net
pixfuture2-d.openx.net — Cisco Umbrella Rank: 40329
rtb.openx.net — Cisco Umbrella Rank: 1537
us-u.openx.net — Cisco Umbrella Rank: 411 Failed
u.openx.net — Cisco Umbrella Rank: 709
2 KB
8 adition.com
imagesrv.adition.com — Cisco Umbrella Rank: 16391
ad9.adfarm1.adition.com — Cisco Umbrella Rank: 206755
139 KB
8 google.com
adservice.google.com — Cisco Umbrella Rank: 77
www.google.com — Cisco Umbrella Rank: 4
2 KB
7 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 289
4 KB
7 amazon-adsystem.com
s.amazon-adsystem.com — Cisco Umbrella Rank: 281
aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 1212
5 KB
6 adform.net
dmp.adform.net — Cisco Umbrella Rank: 2577
c1.adform.net — Cisco Umbrella Rank: 577
3 KB
6 e-planning.net
ads.us.e-planning.net — Cisco Umbrella Rank: 5400
u-ams02.e-planning.net — Cisco Umbrella Rank: 71417
i.e-planning.net — Cisco Umbrella Rank: 7123
sync.e-planning.net — Cisco Umbrella Rank: 5451
s.e-planning.net — Cisco Umbrella Rank: 7051
3 KB
5 casalemedia.com
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 575
4 KB
5 audrte.com
a.audrte.com — Cisco Umbrella Rank: 2378
9 KB
5 33across.com
ssc.33across.com — Cisco Umbrella Rank: 1496
ssc-cms.33across.com — Cisco Umbrella Rank: 994
806 B
5 sonobi.com
apex.go.sonobi.com — Cisco Umbrella Rank: 1668
sync.go.sonobi.com — Cisco Umbrella Rank: 868
3 KB
5 smartadserver.com
prg.smartadserver.com — Cisco Umbrella Rank: 1356
ssbsync-global.smartadserver.com — Cisco Umbrella Rank: 2407
2 KB
5 criteo.com
gum.criteo.com — Cisco Umbrella Rank: 383
mug.criteo.com — Cisco Umbrella Rank: 2668
dis.criteo.com — Cisco Umbrella Rank: 706
2 KB
5 sharethis.com
ws.sharethis.com — Cisco Umbrella Rank: 8124
platform-api.sharethis.com — Cisco Umbrella Rank: 5091
l.sharethis.com — Cisco Umbrella Rank: 4704
buttons-config.sharethis.com — Cisco Umbrella Rank: 6017
51 KB
4 brealtime.com
biddr.brealtime.com — Cisco Umbrella Rank: 2644
5 KB
4 advertising.com
pixel.advertising.com — Cisco Umbrella Rank: 371
1 KB
4 mathtag.com
sync.mathtag.com — Cisco Umbrella Rank: 445
2 KB
4 emxdgt.com
hb.emxdgt.com — Cisco Umbrella Rank: 1787
637 B
3 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 503
2 KB
3 spotxchange.com
sync.search.spotxchange.com — Cisco Umbrella Rank: 531
2 KB
3 dotomi.com
dclk-match.dotomi.com — Cisco Umbrella Rank: 2951
pubmatic-match.dotomi.com — Cisco Umbrella Rank: 3142
310 B
3 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 176
109 KB
3 google.de
adservice.google.de — Cisco Umbrella Rank: 7579
1 KB
3 googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 794
1 KB
3 sitescout.com
pixel.sitescout.com — Cisco Umbrella Rank: 3311
pixel-sync.sitescout.com — Cisco Umbrella Rank: 602
573 B
3 sharethrough.com
btlr.sharethrough.com — Cisco Umbrella Rank: 1077
343 B
3 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 355
2 KB
3 rlcdn.com
api.rlcdn.com Failed
id.rlcdn.com — Cisco Umbrella Rank: 601
idsync.rlcdn.com — Cisco Umbrella Rank: 327
44 B
3 google-analytics.com
google-analytics.com — Cisco Umbrella Rank: 33
www.google-analytics.com — Cisco Umbrella Rank: 37
20 KB
2 mxptint.net
pmp.mxptint.net — Cisco Umbrella Rank: 4748
965 B
2 adhigh.net
px.adhigh.net — Cisco Umbrella Rank: 10466
872 B
2 cognitivlabs.com
beacon.lynx.cognitivlabs.com — Cisco Umbrella Rank: 1390
571 B
2 tribalfusion.com
a.tribalfusion.com — Cisco Umbrella Rank: 824
s.tribalfusion.com — Cisco Umbrella Rank: 2497
1 KB
2 owneriq.net
px.owneriq.net — Cisco Umbrella Rank: 1082
476 B
2 w55c.net
pm.w55c.net — Cisco Umbrella Rank: 884
1 KB
2 everesttech.net
sync-tm.everesttech.net — Cisco Umbrella Rank: 576
742 B
2 3lift.com
eb2.3lift.com — Cisco Umbrella Rank: 400
944 B
2 scoota.co
r.scoota.co — Cisco Umbrella Rank: 35578
1 KB
2 quantserve.com
cms.quantserve.com — Cisco Umbrella Rank: 1127
pixel.quantserve.com — Cisco Umbrella Rank: 423
901 B
2 inmobi.com
mweb.ck.inmobi.com — Cisco Umbrella Rank: 3963
635 B
2 teads.tv
sync.teads.tv — Cisco Umbrella Rank: 1031
344 B
2 eyeota.net
ps.eyeota.net — Cisco Umbrella Rank: 960
2 KB
2 dyntrk.com
c.eu1.dyntrk.com — Cisco Umbrella Rank: 5580
1 KB
2 richaudience.com
sync.richaudience.com — Cisco Umbrella Rank: 1666
384 B
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 71
98 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 138
83 KB
1 playground.xyz
ads.playground.xyz — Cisco Umbrella Rank: 3831
463 B
1 ipredictive.com
sync.ipredictive.com — Cisco Umbrella Rank: 1068
522 B
1 turn.com
ad.turn.com — Cisco Umbrella Rank: 769
518 B
1 simpli.fi
um.simpli.fi — Cisco Umbrella Rank: 825
610 B
1 loopme.me
csync.loopme.me — Cisco Umbrella Rank: 985
216 B
1 bnmla.com
match.bnmla.com — Cisco Umbrella Rank: 1605
114 B
1 acuityplatform.com
ums.acuityplatform.com — Cisco Umbrella Rank: 1157
674 B
1 deepintent.com
match.deepintent.com — Cisco Umbrella Rank: 919
44 B
1 adgrx.com
cm.adgrx.com — Cisco Umbrella Rank: 1504
408 B
1 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 482
706 B
1 rfihub.com
a.rfihub.com — Cisco Umbrella Rank: 3110
1 KB
1 smaato.net
s.ad.smaato.net — Cisco Umbrella Rank: 746
442 B
1 adriver.ru
ssp.adriver.ru — Cisco Umbrella Rank: 11995
340 B
1 yieldmo.com
ads.yieldmo.com — Cisco Umbrella Rank: 614
35 B
1 adkernel.com
dsp.adkernel.com — Cisco Umbrella Rank: 4507
233 B
1 cookieless-data.com
js.cookieless-data.com — Cisco Umbrella Rank: 6757
535 B
1 id5-sync.com
id5-sync.com — Cisco Umbrella Rank: 699
625 B
1 agkn.com
aa.agkn.com — Cisco Umbrella Rank: 431
185 B
1 gravatar.com
secure.gravatar.com — Cisco Umbrella Rank: 1661
1 KB
1 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 682
6 KB
0 googleapis.com Failed
fonts.googleapis.com Failed
409 80
Domain Requested by
43 securityaffairs.co securityaffairs.co
35 cm.g.doubleclick.net 17 redirects onetag-sys.com
googleads.g.doubleclick.net
31 pagead2.googlesyndication.com cdn.pixfuture.com
pagead2.googlesyndication.com
googleads.g.doubleclick.net
tpc.googlesyndication.com
s0.2mdn.net
www.googletagservices.com
19 tpc.googlesyndication.com googleads.g.doubleclick.net
tpc.googlesyndication.com
pagead2.googlesyndication.com
s0.2mdn.net
17 ib.adnxs.com 4 redirects cdn.pixfuture.com
googleads.g.doubleclick.net
acdn.adnxs.com
15 contextual.media.net securityaffairs.co
contextual.media.net
cdn.pixfuture.com
14 s0.2mdn.net securityaffairs.co
s0.2mdn.net
13 simage2.pubmatic.com 2 redirects ads.pubmatic.com
12 onetag-sys.com 3 redirects ads.us.e-planning.net
onetag-sys.com
googleads.g.doubleclick.net
11 served-by.pixfuture.com securityaffairs.co
cdn.pixfuture.com
10 ap.lijit.com 2 redirects cdn.pixfuture.com
10 i0.wp.com securityaffairs.co
9 googleads.g.doubleclick.net pagead2.googlesyndication.com
googleads.g.doubleclick.net
7 x.bidswitch.net 7 redirects
6 prebidserver.pixfuture.com cdn.pixfuture.com
ads.us.e-planning.net
5 image2.pubmatic.com ads.pubmatic.com
5 ads.pubmatic.com cdn.pixfuture.com
ads.pubmatic.com
5 dsum-sec.casalemedia.com 3 redirects googleads.g.doubleclick.net
5 www.google.com googleads.g.doubleclick.net
tpc.googlesyndication.com
5 ups.analytics.yahoo.com 4 redirects googleads.g.doubleclick.net
5 pixel.rubiconproject.com 2 redirects onetag-sys.com
5 a.audrte.com 2 redirects ads.us.e-planning.net
a.audrte.com
5 secure.adnxs.com 3 redirects
5 lg3.media.net securityaffairs.co
4 token.rubiconproject.com 4 redirects
4 biddr.brealtime.com cdn.pixfuture.com
4 acdn.adnxs.com cdn.pixfuture.com
4 u.openx.net cdn.pixfuture.com
4 ad9.adfarm1.adition.com googleads.g.doubleclick.net
ad9.adfarm1.adition.com
4 imagesrv.adition.com googleads.g.doubleclick.net
4 s.amazon-adsystem.com 2 redirects onetag-sys.com
4 pixel.advertising.com 3 redirects onetag-sys.com
4 sync.mathtag.com 4 redirects
4 ssc.33across.com cdn.pixfuture.com
4 fastlane.rubiconproject.com cdn.pixfuture.com
4 hbopenbid.pubmatic.com cdn.pixfuture.com
4 apex.go.sonobi.com cdn.pixfuture.com
4 hb.emxdgt.com cdn.pixfuture.com
4 prg.smartadserver.com cdn.pixfuture.com
4 prebid.media.net cdn.pixfuture.com
4 pixfuture2-d.openx.net cdn.pixfuture.com
3 match.prod.bidr.io 2 redirects ads.pubmatic.com
3 aax-eu.amazon-adsystem.com 2 redirects
3 c1.adform.net 2 redirects ads.pubmatic.com
3 sync.search.spotxchange.com 2 redirects googleads.g.doubleclick.net
3 www.googletagservices.com googleads.g.doubleclick.net
3 adservice.google.com pagead2.googlesyndication.com
3 adservice.google.de pagead2.googlesyndication.com
3 partner.googleadservices.com pagead2.googlesyndication.com
3 dmp.adform.net 3 redirects
3 btlr.sharethrough.com cdn.pixfuture.com
3 match.adsrvr.org 2 redirects cdn.pixfuture.com
2 pmp.mxptint.net 1 redirects ads.pubmatic.com
2 px.adhigh.net 2 redirects
2 image4.pubmatic.com ads.pubmatic.com
2 beacon.lynx.cognitivlabs.com 1 redirects ads.pubmatic.com
2 px.owneriq.net 1 redirects ads.pubmatic.com
2 pm.w55c.net 2 redirects
2 sync-tm.everesttech.net 2 redirects
2 pr-bh.ybp.yahoo.com 1 redirects ads.pubmatic.com
2 eb2.3lift.com 2 redirects
2 r.scoota.co 2 redirects
2 pixel-sync.sitescout.com googleads.g.doubleclick.net
ads.pubmatic.com
2 mweb.ck.inmobi.com 2 redirects
2 eus.rubiconproject.com cdn.pixfuture.com
eus.rubiconproject.com
2 sync.teads.tv googleads.g.doubleclick.net
2 ps.eyeota.net
2 c.eu1.dyntrk.com 2 redirects
2 dclk-match.dotomi.com googleads.g.doubleclick.net
2 googleads4.g.doubleclick.net securityaffairs.co
2 id.rlcdn.com onetag-sys.com
2 sync.richaudience.com 1 redirects ads.us.e-planning.net
2 ads.us.e-planning.net 1 redirects cdn.pixfuture.com
2 c2shb.ssp.yahoo.com cdn.pixfuture.com
2 mug.criteo.com
2 gum.criteo.com 1 redirects
2 cdn.pixfuture.com served-by.pixfuture.com
cdn.pixfuture.com
2 www.google-analytics.com google-analytics.com
www.googletagmanager.com
2 www.googletagmanager.com securityaffairs.co
www.googletagmanager.com
2 l.sharethis.com ws.sharethis.com
securityaffairs.co
2 connect.facebook.net securityaffairs.co
connect.facebook.net
1 simage4.pubmatic.com ads.pubmatic.com
1 ads.playground.xyz 1 redirects
1 pixel.quantserve.com 1 redirects
1 pubmatic-match.dotomi.com ads.pubmatic.com
1 sync.ipredictive.com 1 redirects
1 ad.turn.com 1 redirects
1 um.simpli.fi ads.pubmatic.com
1 idsync.rlcdn.com ads.pubmatic.com
1 csync.loopme.me 1 redirects
1 match.bnmla.com ads.pubmatic.com
1 s.tribalfusion.com ads.pubmatic.com
1 a.tribalfusion.com 1 redirects
1 ums.acuityplatform.com 1 redirects
1 match.deepintent.com ads.pubmatic.com
1 dis.criteo.com ads.pubmatic.com
1 cm.adgrx.com ads.pubmatic.com
1 px.ads.linkedin.com
1 ads.yahoo.com
1 a.rfihub.com 1 redirects
1 sync.go.sonobi.com googleads.g.doubleclick.net
1 cms.quantserve.com googleads.g.doubleclick.net
1 image6.pubmatic.com ads.pubmatic.com
1 s.ad.smaato.net 1 redirects
1 ssp.adriver.ru 1 redirects
1 ssc-cms.33across.com cdn.pixfuture.com
1 us-u.openx.net googleads.g.doubleclick.net
1 ads.yieldmo.com googleads.g.doubleclick.net
1 dsp.adkernel.com googleads.g.doubleclick.net
1 rtb.openx.net googleads.g.doubleclick.net
1 js.cookieless-data.com s.e-planning.net
1 s.e-planning.net ads.us.e-planning.net
1 sync.e-planning.net onetag-sys.com
1 image8.pubmatic.com onetag-sys.com
1 ssbsync-global.smartadserver.com onetag-sys.com
1 pixel-eu.rubiconproject.com onetag-sys.com
1 i.e-planning.net ads.us.e-planning.net
1 u-ams02.e-planning.net ads.us.e-planning.net
1 pixel.sitescout.com ads.us.e-planning.net
1 id5-sync.com cdn.pixfuture.com
1 aa.agkn.com cdn.pixfuture.com
1 pixel.wp.com securityaffairs.co
1 secure.gravatar.com securityaffairs.co
1 google-analytics.com securityaffairs.co
1 buttons-config.sharethis.com platform-api.sharethis.com
1 stats.wp.com securityaffairs.co
1 platform-api.sharethis.com securityaffairs.co
1 ws.sharethis.com securityaffairs.co
1 maxcdn.bootstrapcdn.com securityaffairs.co
0 api.rlcdn.com Failed cdn.pixfuture.com
0 fonts.googleapis.com Failed securityaffairs.co
409 131
Subject Issuer Validity Valid
www.securityaffairs.co
GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1		 2022-03-24 -
2023-04-07		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-01-29 -
2023-01-29		 a year crt.sh
sharethis.com
Amazon		 2021-07-19 -
2022-08-17		 a year crt.sh
*.media.net
DigiCert SHA2 Secure Server CA		 2022-02-20 -
2023-02-22		 a year crt.sh
*.pixfuture.com
Sectigo RSA Domain Validation Secure Server CA		 2021-11-30 -
2022-12-03		 a year crt.sh
*.wp.com
Sectigo RSA Domain Validation Secure Server CA		 2020-04-02 -
2022-07-05		 2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2022-01-21 -
2022-04-21		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-03-28 -
2022-06-20		 3 months crt.sh
*.gravatar.com
Sectigo RSA Domain Validation Secure Server CA		 2020-08-14 -
2022-11-16		 2 years crt.sh
*.agkn.com
RapidSSL RSA CA 2018		 2020-07-25 -
2022-09-18		 2 years crt.sh
*.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-04-11 -
2022-07-07		 3 months crt.sh
*.id5-sync.com
R3		 2022-03-08 -
2022-06-06		 3 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2022-03-31 -
2023-05-02		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2021-07-08 -
2022-08-08		 a year crt.sh
*.smartadserver.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-01-25 -
2023-01-25		 a year crt.sh
*.sharethrough.com
Amazon		 2021-08-13 -
2022-09-11		 a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2022-03-11 -
2023-04-12		 a year crt.sh
*.emxdgt.com
Amazon		 2021-07-02 -
2022-07-31		 a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2022-02-11 -
2023-03-14		 a year crt.sh
*.go.sonobi.com
Go Daddy Secure Certificate Authority - G2		 2021-12-08 -
2023-01-09		 a year crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1		 2021-08-04 -
2022-09-04		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-03-08 -
2023-04-04		 a year crt.sh
ssc.33across.com
GTS CA 1D4		 2022-03-22 -
2022-06-20		 3 months crt.sh
web.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-03-08 -
2022-08-31		 6 months crt.sh
ads.us.e-planning.net
R3		 2022-02-24 -
2022-05-25		 3 months crt.sh
*.sitescout.com
GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1		 2021-12-15 -
2023-01-15		 a year crt.sh
*.audrte.com
Amazon		 2022-02-24 -
2023-03-24		 a year crt.sh
i.e-planning.net
Sectigo RSA Domain Validation Secure Server CA		 2022-02-23 -
2023-02-03		 a year crt.sh
*.onetag-sys.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-01-10 -
2023-01-03		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
*.e-planning.net
R3		 2022-03-09 -
2022-06-07		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-03-28 -
2022-06-20		 3 months crt.sh
*.cookieless-data.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2022-03-23 -
2023-03-22		 a year crt.sh
*.googleadservices.com
GTS CA 1C3		 2022-03-28 -
2022-06-20		 3 months crt.sh
*.google.de
GTS CA 1C3		 2022-03-28 -
2022-06-20		 3 months crt.sh
*.google.com
GTS CA 1C3		 2022-03-28 -
2022-06-20		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2022-03-28 -
2022-06-20		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-03-28 -
2022-06-20		 3 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2022-03-28 -
2022-06-20		 3 months crt.sh
*.adition.com
AlphaSSL CA - SHA256 - G2		 2021-04-15 -
2022-05-17		 a year crt.sh
*.adfarm1.adition.com
AlphaSSL CA - SHA256 - G2		 2021-05-21 -
2022-06-22		 a year crt.sh
*.dotomi.com
GlobalSign RSA OV SSL CA 2018		 2021-08-10 -
2022-09-11		 a year crt.sh
*.adkernel.com
AlphaSSL CA - SHA256 - G2		 2021-12-30 -
2023-01-31		 a year crt.sh
*.yieldmo.com
Amazon		 2021-05-25 -
2022-06-23		 a year crt.sh
*.eyeota.net
R3		 2022-03-08 -
2022-06-06		 3 months crt.sh
teads.tv
R3		 2022-03-23 -
2022-06-21		 3 months crt.sh
cdn.adnxs.com
GeoTrust TLS RSA CA G1		 2022-03-11 -
2023-04-11		 a year crt.sh
*.brealtime.com
Go Daddy Secure Certificate Authority - G2		 2022-01-21 -
2023-02-22		 a year crt.sh
*.33across.com
Sectigo RSA Domain Validation Secure Server CA		 2021-09-23 -
2022-09-30		 a year crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-22 -
2022-09-21		 a year crt.sh
track.adform.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-06 -
2022-10-07		 a year crt.sh
*.match.prod.bidr.io
Amazon		 2022-01-27 -
2023-02-25		 a year crt.sh
public1.adgear.com
Sectigo RSA Domain Validation Secure Server CA		 2022-03-01 -
2023-03-28		 a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2020-04-09 -
2022-06-08		 2 years crt.sh
*.owneriq.net
GeoTrust RSA CA 2018		 2021-12-05 -
2022-12-06		 a year crt.sh
*.bnmla.com
Go Daddy Secure Certificate Authority - G2		 2021-12-30 -
2023-01-31		 a year crt.sh
beacon.lynx.cognitivlabs.com
Amazon		 2022-04-13 -
2023-05-12		 a year crt.sh
*.simpli.fi
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-27 -
2022-11-27		 a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-01-18 -
2022-07-13		 6 months crt.sh

This page contains 74 frames:

Primary Page: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Frame ID: 7BA6CC58EBD62AE27D965B98095EB670
Requests: 155 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 6C9F40FBCAFFAA70927ED7B66B382D44
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 25252BD76B5449FA25C5F4F2F7D6B014
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 8680DFEFCC6C0491D941319CCB058FE9
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 10F1D74EDBE9F7EBCA5B6858CB7FC80B
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 3DE12560E93F07517B06299824FBE5A9
Requests: 1 HTTP requests in this frame

Frame: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
Frame ID: DB541ED4560FD8A30F10D5CC72E7C2A5
Requests: 9 HTTP requests in this frame

Frame: https://i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/navegg_2022_01_br.html
Frame ID: 1DE60F4310E37A13F2DAC3E66E04E048
Requests: 1 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Frame ID: 2E74D648DB0A4A4700F61DC97B711C0F
Requests: 17 HTTP requests in this frame

Frame: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html
Frame ID: F6C2E017D80159236E747CE064C6495E
Requests: 2 HTTP requests in this frame

Frame: https://prebidserver.pixfuture.com:8000/setuid?bidder=eplanning&gdpr=&gdpr_consent=&f=b&uid=ADlNKkfZw6sx6xbJ
Frame ID: 2CC1F3232851E0DA745AEB4780322B16
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 789CD38646ECB811F00E43772F23D6CE
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 9E187D545C9E43DD0B8F52AD45FC4E8A
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 35E0EB009000B898B9C60E6D87F79247
Requests: 8 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 1E81E7B4EF373705EA251A598666C1B0
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Frame ID: 80737C7D5A2FBCEE57555630D53D8E9D
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Frame ID: EA8A476E94EB1B8CE751D750A801CC03
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Frame ID: 7A4FAB333581832B3123F1EB9D609AD2
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COLeahCC2XQYwefQxwEwAQ&v=APEucNX-9nKWAY3CwC6bNPt3LQED-8PKbkX6fMrn-cphBdLpGFaggKF1OtOd8emmz8lcB-_1P265sW7SsUlG3-BQxvQMGZ14aU53U93ob4S6dR-1pUYx6WiUehJ-pyV8wnPrYFQmUJcTbg2StbLyKNXxtePm2uFHB-EqPdA7bDs2vUjqtg07QKnKxiPIBtFycmXjVGXPuS2MGq-GMULh2bQrUfe--dyZeg
Frame ID: C5953B66CD7D0439A3A989E8112C3DC1
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: F3F624E1D11B75348013AE93DB8A55E1
Requests: 8 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
Frame ID: EAC3ACC9E8253E20874CECB1D17883BA
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3NLhD2ksmmAxiSnp_IATAB&v=APEucNW8bzd6fAl1_Ptdpzz_Af_jXiu3vlOnOWQgycctToIzi8iDB9sRlG-S2f-kb2cT979_9_3xk4inrN3elW1sWHs2QwQAFrpZFuM4xri7jHfks-m6Y39ZXxg9dgozhEjM1zJhuCC3eNKoHba75WP3PHIgRBaB56rUFSaVrf760UBgc_pLoqEpay4gMfswFx2dmNQ9ux9eFI96s-XRRyb0Nrij8pVP8w
Frame ID: 13F949A8CE488ED38915A6CF1CA244A2
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 8EB13159C6CC549379CF7CAC30B56A12
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3NLhD2ksmmAxi7sp_IATAB&v=APEucNVzW65EzppCRdb10CHLLu-5vg6RtfaF-WACLdp7uclrHFHZyhMFgf2oatJhwBI0Gwo7_8stiJ5SYITOynq9EJTcQ7aYOpAXXhQ-ww2PgI_SXokpy1plDDYVxp-aQzvqDBQr4rZmRkGU1ckS6vWy5diD27ZjkQcwtYxz1Akp-wBxwNN8v6e3YpZA23jUbxCHyDGg_GMkph_-GucSnFSzeAjFiNZ1VQ
Frame ID: 3000BDF77C5059A59B8897B88854FFF6
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 721FF1E484FA3917D1DE8CD39E2BB992
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 8A2A9E7E2E43B5E1AA1713EEB6C20587
Requests: 9 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13480300
Frame ID: 89EA81C58D9D9BD7496CBD3F2E324F90
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 617CA019F001DF2ABE820F2CFFB12AAC
Requests: 10 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUIUMTP7&prvid=2034%2C2033%2C2031%2C2030%2C273%2C2029%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C238%2C97%2C55%2C99%2C3012%2C2043%2C3010%2C2040%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C3014%2C337%2C338%2C70%2C77%2C38%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1&itype=PREBID
Frame ID: C04D27C3D34F61A490B17D64B96A30E5
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: F941FBC34378391E2A0B0064EB41D19D
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 10CFBC977AD3535FBB2270D650815C00
Requests: 3 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Frame ID: DBC65F393EEA8C245EC9775976239829
Requests: 22 HTTP requests in this frame

Frame: https://biddr.brealtime.com/check.html
Frame ID: DDCC1207303916FA5A358C0DF5CD87CA
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 0695219882B3E0C1B427FB02483D3A39
Requests: 3 HTTP requests in this frame

Frame: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=azC7qard4r6OkMaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Frame ID: CAFBAEEEC99AE0A5C73D0B75D8348FD0
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUIUMTP7&prvid=2034%2C2033%2C2031%2C2030%2C273%2C2029%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C238%2C97%2C55%2C99%2C3012%2C2043%2C3010%2C2040%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C3014%2C337%2C338%2C70%2C77%2C38%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1&itype=PREBID
Frame ID: 7644ED2793E2C5D0697CC288A41D0E0A
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13480300
Frame ID: 613B17CBE30E15BDC4C0FBA5FAFB1DD2
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUIUMTP7&prvid=2034%2C2033%2C2031%2C2030%2C273%2C2029%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C238%2C97%2C55%2C99%2C3012%2C2043%2C3010%2C2040%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C3014%2C337%2C338%2C70%2C77%2C38%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1&itype=PREBID
Frame ID: C826F099BF557F57F9664D82AE53678E
Requests: 1 HTTP requests in this frame

Frame: https://biddr.brealtime.com/check.html
Frame ID: 5AE9BA6FC7AC57C1DF3708026A6F48BE
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13480300
Frame ID: 4A0A6B9041E7C5FE6AFAFD1B34E73C7C
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: CF31D887A9BB0AE9D8AB7F9CCCBFA0DF
Requests: 3 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 87E6AAE251E15524ABAA6715777BC99B
Requests: 3 HTTP requests in this frame

Frame: https://biddr.brealtime.com/check.html
Frame ID: B87B36F8315081FAC3F4B28B219693D4
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Frame ID: A08C27E2FAE46004C7549F9F60A49B8F
Requests: 2 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUIUMTP7&prvid=2034%2C2033%2C2031%2C2030%2C273%2C2029%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C238%2C97%2C55%2C99%2C3012%2C2043%2C3010%2C2040%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C3014%2C337%2C338%2C70%2C77%2C38%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1&itype=PREBID
Frame ID: DE5A00345839E6F1E690B01F6B149ECC
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: 4E0B5F06E3BE8406F605C3636CDD07FF
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: 3C6A2682C3AEF9FEF85E41FFE063DF38
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13480300
Frame ID: 5C5AA8CF79D7B4A394BD979066701C5F
Requests: 1 HTTP requests in this frame

Frame: https://biddr.brealtime.com/check.html
Frame ID: 8FEB2E145C067A368A17A48D5F5E2C5E
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Frame ID: D7764E0D89BCB69BEA5426B1E94A48A1
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Frame ID: 63C89FEEC9D52BC4BC8BC8E5BD9C25B2
Requests: 2 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: 0E36EC43DEC5CCA8A9FF3B5EB8E5201C
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: EA91D296C3CF05D7D14730624FCE14BC
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 1A7473C445E12564AD2B47F5E7837B82
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 80C3EDEBDAA23206291AC202BAD4B74A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 704E888A0E406DD87A8E7E3FCC9AD0BF
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
Frame ID: 73100887CC934A9B638FD7AAABCE8717
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: C3C7003049E784948806804D5E80E9B6
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D51D4B4C2B599CAF6EE9CF9AEE85F216
Requests: 2 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?party=14&cid=259147D8-7EFA-450F-8AD8-7BA5CF40924F
Frame ID: B33AD446031B74AB05CB00DBF5C35A2E
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YlhDtgAUjGeeagAy&gdpr=0&gdpr_consent=&_test=YlhDtgAUjGeeagAy
Frame ID: 3A38130F64E9BDB2E151E1063815E9E3
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:be246258-43b4-4200-9484-9771ee1131e4&gdpr=0&gdpr_consent=
Frame ID: EF24CA3170F69BBF426A5865218BF1F8
Requests: 1 HTTP requests in this frame

Frame: https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
Frame ID: 1F28F89CF96585178EC6D7ADF41993BF
Requests: 1 HTTP requests in this frame

Frame: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Frame ID: 4D326C6384FDF9D722F63231916F9868
Requests: 1 HTTP requests in this frame

Frame: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Frame ID: 2948402824B4E931338DB4B083BB0342
Requests: 1 HTTP requests in this frame

Frame: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Frame ID: 6FCD189FA3CC9E3D923D247A6FDE17DA
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=663174453031
Frame ID: B55BE3EE3CA79E953B50EC03442047C5
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:Sw6PvsyN1NF1NI5&gdpr=0&gdpr_consent=
Frame ID: 2585D5FC0C0F123A1DFE3E4C3B0C0BD2
Requests: 1 HTTP requests in this frame

Frame: https://px.owneriq.net/noop?ct=image%2Fgif
Frame ID: 5EB5EA3E892A7062A87F2ABD4EC94A4D
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: B0737063AB447E0D241F91C4406FA619
Requests: 1 HTTP requests in this frame

Frame: https://match.bnmla.com/usersync?sspid=10738&redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw%26piggybackCookie%3D%5BUUID%5D
Frame ID: 4F3B5CDF8D8336A2F10DFD457A5429A1
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=dcf50319-3ed8-492a-a1ae-d3d652c740c8
Frame ID: 221BB4A521EBEDCDB1DAC39CF6F0D363
Requests: 1 HTTP requests in this frame

Frame: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=259147D8-7EFA-450F-8AD8-7BA5CF40924F
Frame ID: 5788E62D0495AEB6DF12067C5C7889C3
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
Frame ID: 76015470CF31258AD0C64481E611538A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Russia's Sandworm APT targets energy facilities in Ukraine with wipersSecurity Affairs

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/pagead/show_ads\.js
Overall confidence: 100%
Detected patterns
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • adnxs\.com/[^"]*(?:prebid|/pb\.js)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • tracker\.js
Overall confidence: 100%
Detected patterns
  • twemoji(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

409
Requests

83 %
HTTPS

24 %
IPv6

80
Domains

131
Subdomains

101
IPs

11
Countries

5358 kB
Transfer

8103 kB
Size

106
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 98
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1&lsw=1 HTTP 302
  • https://mug.criteo.com/sid?cpp=7IOY-3xUVjJMYXJab1k3djBja1hYUGFvdjZzNlpxSno2VGxuSHkvZEc5bVhLamZ2Z0JNYW1HMFduZHZzR043L2t6bEZ6OHBZSUdMTU5UVGpnWDFpa2dGQndDRXpPMFgwbW9FTXVYMTNnL3l1QUZLRDY4eWUvRlhvOG1ZbnRjcTBzWFpxcjc2V2sycExlYTVOOHF2cWEyb1VUSmplZi9SYlhzYWNqWHhGRThIc2o0bzlmTklYZmtNRlBrNjBDdk5UOCtwS3BTc2FzWWJleFpWT29lR2NLSGNPNTJmWWJ4SjBtSzdTNG91aFdrbDFTMkprPXw&cppv=2
Request Chain 102
  • https://secure.adnxs.com/seg?add=27578926%2C27578926&t=1 HTTP 307
  • https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D27578926%252C27578926%26t%3D1
Request Chain 103
  • https://secure.adnxs.com/seg?add=27578935%2C27578935&t=1 HTTP 307
  • https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D27578935%252C27578935%26t%3D1
Request Chain 155
  • https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID HTTP 302
  • https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
Request Chain 158
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=25BiP9IMgN&r=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fuid%3D[PDID]%26dc%3Dfabfd6762b833237%26fi%3Dc6dc7d173d5e8543 HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fads.us.e-planning.net%2F
Request Chain 159
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D8103fa85295fbe60%26fi%3Dc6dc7d173d5e8543%26uid%3D%24UID HTTP 302
  • https://u-ams02.e-planning.net/um?dc=8103fa85295fbe60&fi=c6dc7d173d5e8543&uid=6686298214416655647
Request Chain 162
  • https://sync.mathtag.com/sync/img?mt_exid=75&redir=%2F%2Fonetag-sys.com%2Fsync%2Fi%2C1%2F%5BMM_UUID%5D HTTP 302
  • https://onetag-sys.com/sync/i,1/be246258-43b4-4200-9484-9771ee1131e4
Request Chain 164
  • https://dmp.adform.net/serving/cookie/match?party=1167&cid=J7ouLKv83d3FoUDHdP3Gq4HkJZe3e5UBsiHUUdUyfP8 HTTP 302
  • https://dmp.adform.net/serving/cookie/match?CC=1&party=1167&cid=J7ouLKv83d3FoUDHdP3Gq4HkJZe3e5UBsiHUUdUyfP8 HTTP 302
  • https://onetag-sys.com/sync/i,34/3775857252217606419
Request Chain 165
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID HTTP 302
  • https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=6686298214416655647
Request Chain 167
  • https://pixel.advertising.com/ups/58198/sync?&gdpr=1&gdpr_consent=&redir=true HTTP 302
  • https://pixel.advertising.com/ups/58198/sync?&gdpr=1&gdpr_consent=&redir=true&verify=true
Request Chain 168
  • https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgCjId2DcGjX3iJ2y7SWP_P-1iQo_mUdZ6Q HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgCjId2DcGjX3iJ2y7SWP_P-1iQo_mUdZ6Q&google_tc=
Request Chain 171
  • https://onetag-sys.com/match/?int_id=113&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=J7ouLKv83d3FoUDHdP3Gq4HkJZe3e5UBsiHUUdUyfP8
Request Chain 173
  • https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm=&google_tc= HTTP 302
  • https://onetag-sys.com/match/?int_id=106&google_gid=CAESEOW_xUSp8xXk0HPMywuqOoE&google_cver=1
Request Chain 174
  • https://ups.analytics.yahoo.com/ups/58488/occ HTTP 302
  • https://ups.analytics.yahoo.com/ups/58488/occ?verify=true HTTP 302
  • https://onetag-sys.com/match/?int_id=92&uid=y-uuR5LNVE2uFddClvWArRo53rMjj49Kl3UkMSREk-~A
Request Chain 175
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent= HTTP 302
  • https://onetag-sys.com/sync/i,29/?tdid=9ea79823-2611-4b51-88b2-d42fdb532721&ttl=1652543667
Request Chain 176
  • https://x.bidswitch.net/sync?ssp=onetag HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=onetag HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=onetag&bsw_param=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&google_hm=ZWI3YmFhZmEtZmI2Ny00ZDZkLWIyY2ItMTcwMGExOGZjYWRj HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESENb5H85bIhVct43Lv0sGLek&google_cver=1&ssp=onetag&bsw_param=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc HTTP 302
  • https://onetag-sys.com/match/?int_id=30&uid=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&gdpr=&gdpr_consent=&us_privacy=
Request Chain 211
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGvyBNpI5lnBceFazxOws8E&google_cver=1 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGvyBNpI5lnBceFazxOws8E&google_cver=1&C=1
Request Chain 212
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YlhDtQJADWnswXc5voXTowAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGvyBNpI5lnBceFazxOws8E&google_cver=1
Request Chain 213
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEFSwawj46kXoFNqMZ9GMw0Y&google_cver=1
Request Chain 214
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjY4NjI5ODIxNDQxNjY1NTY0Nw%3D%3D
Request Chain 234
  • https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESEF6vG4pWAHy5xTn2C6yIc0Y&google_cver=1&google_push=AYg5qPIpSS_BdEjJDi2fWf4PjT6mYGQgFTv3CC605bKf8fj15FSCPNX3fekiWTe5hOB9185rxC-DWuZ45Wl0YmplX7R0h2itxbiU HTTP 302
  • https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESEF6vG4pWAHy5xTn2C6yIc0Y&google_cver=1&google_push=AYg5qPIpSS_BdEjJDi2fWf4PjT6mYGQgFTv3CC605bKf8fj15FSCPNX3fekiWTe5hOB9185rxC-DWuZ45Wl0YmplX7R0h2itxbiU&prevuid=&knw= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AYg5qPIpSS_BdEjJDi2fWf4PjT6mYGQgFTv3CC605bKf8fj15FSCPNX3fekiWTe5hOB9185rxC-DWuZ45Wl0YmplX7R0h2itxbiU&google_hm=
Request Chain 237
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESED5VRJ1HEVPTGpKPl0EVOBE&google_cver=1&google_push=AYg5qPIB9u7jM9CHl5xwMVufx1BlkRV_I8OALUTiQn1Rol59SJX0N6QNwozK3pO8rIg8GwLiPQVFph-di_emlsNcGQjOZ1Wmaw19 HTTP 307
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESED5VRJ1HEVPTGpKPl0EVOBE&google_cver=1&google_push=AYg5qPIB9u7jM9CHl5xwMVufx1BlkRV_I8OALUTiQn1Rol59SJX0N6QNwozK3pO8rIg8GwLiPQVFph-di_emlsNcGQjOZ1Wmaw19&sovrn_retry=true HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIB9u7jM9CHl5xwMVufx1BlkRV_I8OALUTiQn1Rol59SJX0N6QNwozK3pO8rIg8GwLiPQVFph-di_emlsNcGQjOZ1Wmaw19&google_hm=23f4cd250a0c1414891cbf59
Request Chain 241
  • https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=cmek0bTl2v6RxyJ7Gb4ky-kOA&gdpr=0&gdpr_consent= HTTP 302
  • https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=cmek0bTl2v6RxyJ7Gb4ky-kOA&gdpr=0&gdpr_consent=&google_gid=CAESENyZkKUiku_t5L1UkLR1r04&google_cver=1 HTTP 302
  • https://a.audrte.com/p
Request Chain 242
  • https://dmp.adform.net/serving/cookie/match/?party=1003&gdpr=0&gdpr_consent= HTTP 302
  • https://a.audrte.com/a?adform_uid=3775857252217606419 HTTP 302
  • https://ps.eyeota.net/match?bid=kh51m51&uid=cmek0bTl2v6RxyJ7Gb4ky-kOA&gdpr=0&gdpr_consent=
Request Chain 251
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMQL3bbNFBkePQwnDza8sic&google_cver=1
Request Chain 253
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
  • https://sync.teads.tv/um?eid=3&uid=CAESENePZ4a9Q47cg5RoSMRn3EA&google_cver=1
Request Chain 265
  • https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEBbwlyNywQsZhVWkB2o8Yic&google_cver=1
Request Chain 266
  • https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_id=2b110cab-bc0b-11ec-9038-1bf9ad920206 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MmIxMTBjNjktYmMwYi0xMWVjLTkwMzgtMWJmOWFkOTIwMjA2
Request Chain 267
  • https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_dbm&_origin=1 HTTP 302
  • https://pixel.advertising.com/ups/55946/sync?uid=CAESEKfG_fRfBfnitJp1Ep6pXAY&_origin=1&google_cver=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/55946/sync?uid=CAESEKfG_fRfBfnitJp1Ep6pXAY&_origin=1&google_cver=1&apid=UP2a3a52c3-bc0b-11ec-a35c-02f04bb15154
Request Chain 268
  • https://pixel.advertising.com/ups/55946/sync?_origin=1&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/55946/sync?_origin=1&redir=true&apid=UP2a3a52c3-bc0b-11ec-a35c-02f04bb15154 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_hm=VVAyYTNhNTJjMy1iYzBiLTExZWMtYTM1Yy0wMmYwNGJiMTUxNTQ%3D
Request Chain 312
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEPscK1fV4mAwCT0aRjvqwgA&google_cver=1&google_push=AYg5qPJ9JkElNve4oIs5NwS9KPbbcVjxYHutgpqKdrGM9wPwKZIMh6KmEDbPwkkT27IZk6lP4-zvwGcYTSO1VREmF-9hpz1tWFs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=viRiWEO0QgCUhJdx7hEx5A&google_push=AYg5qPJ9JkElNve4oIs5NwS9KPbbcVjxYHutgpqKdrGM9wPwKZIMh6KmEDbPwkkT27IZk6lP4-zvwGcYTSO1VREmF-9hpz1tWFs
Request Chain 313
  • https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D81312610%26google_hm%3D%24DSP_CKID&google_gid=CAESEHnycEJbSj_5f1S2Rf7DZyU&google_cver=1&google_push=AYg5qPKzFRrZvDmfC_o3ss93bUrBO0rFTlg5UfZOwgDQjsFq0arybGD-pcRcxhg2Ia_7vkFwy0Ig-kxDdc_vLuL8qoM5tJX7YtRf HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=81312610&google_hm=ZGNmNTAzMTktM2VkOC00OTJhLWExYWUtZDNkNjUyYzc0MGM4
Request Chain 314
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEP_QNo_KHTe9s2ZQDtMsMeo&google_cver=1&google_push=AYg5qPIVtLanFX6CIIh3LlGfYzWbjoSQn72CDPhgxQuMKuPtQXEd2vGKywoG9wT5IzjOk9ZEDMuf02Qjk7CA7mOOVeMlMwdkdKs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzc3NTg1NzI1MjIxNzYwNjQxOQ&google_push=AYg5qPIVtLanFX6CIIh3LlGfYzWbjoSQn72CDPhgxQuMKuPtQXEd2vGKywoG9wT5IzjOk9ZEDMuf02Qjk7CA7mOOVeMlMwdkdKs
Request Chain 315
  • https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESEK_f2Fe-HVQrRYotbK67Rq0&google_cver=1&google_push=AYg5qPKg8toOeVW4lijBvcplYoY-oLn_IctHmzodxU8zhachy0GNoO5A4Um3I4wz7kX8UzEprGfDss9WpUf3nup-34oKq8gI0rpH HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPKg8toOeVW4lijBvcplYoY-oLn_IctHmzodxU8zhachy0GNoO5A4Um3I4wz7kX8UzEprGfDss9WpUf3nup-34oKq8gI0rpH&google_hm=QXJJR1J0Qk5SeDRscnQxQTl2bUMweUE=
Request Chain 316
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_cver=1&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ
Request Chain 317
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEIBWj7hyCKNyigCJw5FiKqo&google_cver=1&google_push=AYg5qPI-UF7LKL4CuCZ2OYX9Ij3FXYrASuea9m3sgBW2NoLSQH2P6_QBlG1-gQ3Yfc1WLBtpz9FZ9cyc0pjVfUfZJWI1i2WCCnAq HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPI-UF7LKL4CuCZ2OYX9Ij3FXYrASuea9m3sgBW2NoLSQH2P6_QBlG1-gQ3Yfc1WLBtpz9FZ9cyc0pjVfUfZJWI1i2WCCnAq
Request Chain 318
  • https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEOW_xUSp8xXk0HPMywuqOoE&google_cver=1&google_push=AYg5qPIsnJoPRYFHRbdMtGE06eXRGAvV1j_b_chpTG4uQgqqLtQq4XIWJZoXjPfDUh1-FLBkCkolFqrDhys_lfODZ-8mY6L003p5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgCjIfaus-8SgHVWHewiG0oH0NkUDS9Xs5A&google_push=AYg5qPIsnJoPRYFHRbdMtGE06eXRGAvV1j_b_chpTG4uQgqqLtQq4XIWJZoXjPfDUh1-FLBkCkolFqrDhys_lfODZ-8mY6L003p5 HTTP 302
  • https://onetag-sys.com/sync/i,19/?google_error=5
Request Chain 337
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESECZJU2e4UDFOB8D9-LeWzl0&google_cver=1&google_push=AYg5qPIM0-bRMcda1QBVLe3YYT7a6G_hEI2ypBH8aRCwWLTbgGjGynh7xtzkDvh3O2lZxueK30jwz6Uxpc-7BfHsmj7y1ONdLy0 HTTP 302
  • https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=google HTTP 302
  • https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=d2e8182a-a1bd-4636-bb80-fc387b014fb3&ssp=google HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIM0-bRMcda1QBVLe3YYT7a6G_hEI2ypBH8aRCwWLTbgGjGynh7xtzkDvh3O2lZxueK30jwz6Uxpc-7BfHsmj7y1ONdLy0&google_hm=63uq-vtnTW2yyxcAoY_K3A==
Request Chain 339
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEEINmWeStxMubJeEyfJZA9M&google_cver=1&google_push=AYg5qPL8tDofqeLjacAkqPxF1JkUjW9vci_vlsPIyRyYJBr39-c48rQHB_DI0xuY9tSZ2L9-1TkdQdpG40wxFFm6OF-B9hE-Y1ma HTTP 302
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPL8tDofqeLjacAkqPxF1JkUjW9vci_vlsPIyRyYJBr39-c48rQHB_DI0xuY9tSZ2L9-1TkdQdpG40wxFFm6OF-B9hE-Y1ma&google_gid=CAESEEINmWeStxMubJeEyfJZA9M HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODk2OTA0MzczMjI3NDc1MjEzMTkz&google_push=AYg5qPL8tDofqeLjacAkqPxF1JkUjW9vci_vlsPIyRyYJBr39-c48rQHB_DI0xuY9tSZ2L9-1TkdQdpG40wxFFm6OF-B9hE-Y1ma
Request Chain 340
  • https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEGyY_2sjIyj7uSGVsnU7-WQ&google_cver=1&google_push=AYg5qPJ9v59oc91L9MWtuPNVfkgqYkP9METRn8hVtee7Ufags-GavP-6iQsT3eEPfJhz0cwIqPZQNlMtSIAkTByGQHF7sV4AVEBelQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPJ9v59oc91L9MWtuPNVfkgqYkP9METRn8hVtee7Ufags-GavP-6iQsT3eEPfJhz0cwIqPZQNlMtSIAkTByGQHF7sV4AVEBelQ&google_hm=Nzg0NDEyODAzNzExNjU1ODI0MA==
Request Chain 347
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/qi-HlQuTj0bcnFY4l0J6ww?csrc= HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3045454532576791995
Request Chain 349
  • https://token.rubiconproject.com/token?pid=26594 HTTP 302
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L1Z6MEPG-1-2I93&sigv=1&esig=2~fd366345cec8b61222f198c87d9d095eedb3c898
Request Chain 350
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id= HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=gDk-h5QsQOG_jAR0JK2YLw&rk=usync-other HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=gDk-h5QsQOG_jAR0JK2YLw
Request Chain 351
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKZq-yYU_Bb0YyJImJT8H2c&google_cver=1
Request Chain 352
  • https://token.rubiconproject.com/token?pid=36584 HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L1Z6MEPG-1-2I93
Request Chain 353
  • https://token.rubiconproject.com/token?pid=25470 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFaNk1FUEctMS0ySTkz
Request Chain 354
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id= HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=hjsWJdjzQuO8tJjW9fG9lQ&rk=usync-na HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=hjsWJdjzQuO8tJjW9fG9lQ
Request Chain 368
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&_test=YlhDtgAUjGeeagAy HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YlhDtgAUjGeeagAy&gdpr=0&gdpr_consent=&_test=YlhDtgAUjGeeagAy
Request Chain 369
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:be246258-43b4-4200-9484-9771ee1131e4&gdpr=0&gdpr_consent=
Request Chain 370
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFISGIwN0VzSWNBQURtcU9oT3drUQ&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
Request Chain 374
  • https://ums.acuityplatform.com/tum?umid=6 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=663174453031
Request Chain 375
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:Sw6PvsyN1NF1NI5&gdpr=0&gdpr_consent=
Request Chain 376
  • https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
  • https://px.owneriq.net/noop?ct=image%2Fgif
Request Chain 377
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Request Chain 379
  • https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=dcf50319-3ed8-492a-a1ae-d3d652c740c8
Request Chain 380
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=6560be7e-c5a9-43a2-ac58-f12ad823d6a0&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP 302
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=259147D8-7EFA-450F-8AD8-7BA5CF40924F
Request Chain 381
  • https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={device_id}&gdpr=0&gdpr_consent= HTTP 307
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
Request Chain 382
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=JZFH2H76RQ-K2Hulz0CSTw%3D%3D HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Request Chain 384
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=be246258-43b4-4200-9484-9771ee1131e4
Request Chain 385
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MjU5MTQ3RDgtN0VGQS00NTBGLThBRDgtN0JBNUNGNDA5MjRG&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 386
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJ8aU8eFVA1SltomfSndR_k&google_cver=1
Request Chain 388
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7357394540411526230&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 389
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=9ea79823-2611-4b51-88b2-d42fdb532721
Request Chain 391
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=259147D8-7EFA-450F-8AD8-7BA5CF40924F&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-k7jZGuxE2uUsuqYKh72VM0GbkIq_Uds-~A&gdpr=0&gdpr_consent=
Request Chain 392
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6686298214416655647&gdpr=0&gdpr_consent=
Request Chain 393
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=2bc6e580-bc0b-11ec-b297-832d259745f8&gdpr=0&gdpr_consent=
Request Chain 396
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=fV-4eX9e73RmCe91clmgc3pf6XRmC-twc1vNbgvZ
Request Chain 397
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=3775857252217606419
Request Chain 398
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://px.adhigh.net/p/cm/bsw?u=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&bidswitch_ssp_id=pubmatic HTTP 302
  • https://px.adhigh.net/p/cm/bsw?u=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&bidswitch_ssp_id=pubmatic&bounced=1 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=9&user_id=M2gRQqD2odl.AikABlGAKMiBIw&expires=30&ssp=pubmatic HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 399
  • https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R1B342_EE52EA7D_3519F7F4&r=https://pmp.mxptint.net/sn.ashx?ak=1 HTTP 302
  • https://pmp.mxptint.net/sn.ashx?ak=1
Request Chain 400
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=6686298214416655647

409 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request russia-sandworm-targets-energy-facilities-ukraine.html
securityaffairs.co/wordpress/130123/apt/ 		98 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
5c269240acbba94ae9934f8f03c702d2b74ae4f9c15c61ecf325b506f6dae73b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:25 GMT
link
<https://securityaffairs.co/wordpress/wp-json/>; rel="https://api.w.org/", <https://securityaffairs.co/wordpress/wp-json/wp/v2/posts/130123>; rel="alternate"; type="application/json", <https://securityaffairs.co/wordpress/?p=130123>; rel=shortlink
server
Apache
x-pingback
https://securityaffairs.co/wordpress/xmlrpc.php
style.css
securityaffairs.co/wordpress/wp-includes/css/dist/block-library/ 		95 KB
95 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-includes/css/dist/block-library/style.css?ver=225d2128214efd4cb439b1095d30ca5b
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
d923ee78c830ba61f65748ff977f348a9b8160f36f05c922b6431428ed693d22

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:25 GMT
last-modified
Tue, 05 Apr 2022 21:49:11 GMT
server
Apache
accept-ranges
bytes
etag
"17bff-5dbef371d9676"
content-length
97279
content-type
text/css
mediaelementplayer-legacy.min.css
securityaffairs.co/wordpress/wp-includes/js/mediaelement/ 		11 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:25 GMT
last-modified
Wed, 09 Dec 2020 23:31:00 GMT
server
Apache
accept-ranges
bytes
etag
"2bf8-5b61073acf500"
content-length
11256
content-type
text/css
wp-mediaelement.css
securityaffairs.co/wordpress/wp-includes/js/mediaelement/ 		5 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/mediaelement/wp-mediaelement.css?ver=225d2128214efd4cb439b1095d30ca5b
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
6d9f061cba81145d9bab0964192d66cb2e13a71591482cdfaf5b718341171da1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:25 GMT
last-modified
Wed, 13 Nov 2019 23:52:08 GMT
server
Apache
accept-ranges
bytes
etag
"1360-597430d761a00"
content-length
4960
content-type
text/css
cookie-law-info-public.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/ 		3 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=2.1.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:25 GMT
last-modified
Fri, 18 Feb 2022 00:43:34 GMT
server
Apache
accept-ranges
bytes
etag
"c22-5d8402c38291d"
content-length
3106
content-type
text/css
cookie-law-info-gdpr.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/ 		27 KB
27 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.1.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:25 GMT
last-modified
Fri, 18 Feb 2022 00:43:34 GMT
server
Apache
accept-ranges
bytes
etag
"6a71-5d8402c38291d"
content-length
27249
content-type
text/css
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/ 		23 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css?ver=8.2.4
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
632, 617, 617
age
3625482
cdn-cachedat
2021-06-08 21:08:57
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:54 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
733e37acd0daf33e87865ddb13826614
cf-ray
6fbd9eb88dfc59f5-MXP
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
custom.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/ 		19 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/custom.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:25 GMT
last-modified
Wed, 16 Dec 2015 13:54:59 GMT
server
Apache
accept-ranges
bytes
etag
"4d92-52704407f72c0"
content-length
19858
content-type
text/css
tipsy.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 		539 B
683 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/tipsy.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:25 GMT
last-modified
Wed, 16 Dec 2015 06:58:04 GMT
server
Apache
accept-ranges
bytes
etag
"21b-526fe6d7cd700"
content-length
539
content-type
text/css
flexslider.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/ 		6 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/flexslider.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:25 GMT
last-modified
Wed, 16 Dec 2015 13:55:09 GMT
server
Apache
accept-ranges
bytes
etag
"1851-5270441180940"
content-length
6225
content-type
text/css
animation.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/animation.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
accept-ranges
bytes
etag
"6b4-526fe6d5e5280"
content-length
1716
content-type
text/css
font-awesome.min.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 		17 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
accept-ranges
bytes
etag
"4574-526fe6d5e5280"
content-length
17780
content-type
text/css
swipebox.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		4 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/swipebox.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:18 GMT
server
Apache
accept-ranges
bytes
etag
"118d-526fe6e527680"
content-length
4493
content-type
text/css
jquery.circliful.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 		334 B
478 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jquery.circliful.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
accept-ranges
bytes
etag
"14e-526fe6d5e5280"
content-length
334
content-type
text/css
screen.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 		110 KB
110 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/screen.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:04 GMT
server
Apache
accept-ranges
bytes
etag
"1b844-526fe6d7cd700"
content-length
112708
content-type
text/css
custom-css.php
securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/ 		12 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/custom-css.php?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
content-type
text/css; charset: UTF-8;charset=UTF-8
server
Apache
grid.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 		49 KB
50 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/grid.css?ver=225d2128214efd4cb439b1095d30ca5b
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:03 GMT
server
Apache
accept-ranges
bytes
etag
"c5f2-526fe6d6d94c0"
content-length
50674
content-type
text/css
sharing.css
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/ 		19 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/sharing.css?ver=10.8
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
67289e231e0f7e5160b64d6761481954fbd89cc2f3cd3bf469fca94d7b4d6c87

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 06 Apr 2022 21:42:04 GMT
server
Apache
accept-ranges
bytes
etag
"4d01-5dc033b777710"
content-length
19713
content-type
text/css
social-logos.css
securityaffairs.co/wordpress/wp-content/plugins/jetpack/_inc/social-logos/ 		12 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/_inc/social-logos/social-logos.css?ver=10.8
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
4cdecc62f5b2c8e9f7cf7b14b9fd42e0c4787d912c1b71426cdfbe0144cede46

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 06 Apr 2022 21:42:02 GMT
server
Apache
accept-ranges
bytes
etag
"312f-5dc033b613025"
content-length
12591
content-type
text/css
jquery.js
securityaffairs.co/wordpress/wp-includes/js/jquery/ 		282 KB
282 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery.js?ver=3.6.0
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
8c3010509fc7480b59413a90d69e9fafcb3d5aa202faf7862466f6bb8be1a335

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Fri, 23 Jul 2021 22:11:53 GMT
server
Apache
accept-ranges
bytes
etag
"46758-5c7d1b0de3c40"
content-length
288600
content-type
application/javascript
jquery-migrate.js
securityaffairs.co/wordpress/wp-includes/js/jquery/ 		25 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
9c062d10663416484b5a59bb47a0308526bec56cc69e9f3499fa087d8eae5c7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 09 Dec 2020 23:31:00 GMT
server
Apache
accept-ranges
bytes
etag
"62d4-5b61073acf500"
content-length
25300
content-type
application/javascript
cookie-law-info-public.js
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/ 		34 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.1.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
8c106f968e6dae4cc1049fd8205860cbd57eba3b59803c5688a1f417b57d9b65

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Fri, 18 Feb 2022 00:43:34 GMT
server
Apache
accept-ranges
bytes
etag
"88fd-5d8402c38485d"
content-length
35069
content-type
application/javascript
medianetAdInjector.js
securityaffairs.co/wordpress/wp-content/plugins/media-net-ads-manager/js/ 		562 B
716 B 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/media-net-ads-manager/js/medianetAdInjector.js?ver=2.10.13
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
37d925559381e9d5388c4a096fe1383570546b7b11548d7d6a7e560adcc24e5d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Sat, 08 May 2021 23:27:41 GMT
server
Apache
accept-ranges
bytes
etag
"232-5c1d9e402b540"
content-length
562
content-type
application/javascript
st_insights.js
ws.sharethis.com/button/ 		26 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare&ver=8.2.4
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:7600:3:c04e:c780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
149bccf7e467541fc83e870e967ac322b26065e5d6797169c8a677a67db07e60
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 01:49:06 GMT
content-encoding
gzip
vary
Accept-Encoding
age
50727
x-cache
Hit from cloudfront
content-length
7654
server
nginx/1.20.1
etag
W/"61e1c3a9-6746"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
via
1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
cache-control
max-age=259200
x-amz-cf-pop
FRA50-C1
x-robots-tag
noindex, nofollow
x-amz-cf-id
Y2M4ITI2eT52isdR6NmgRe0mFKmdThX3MAIt_yNLhKrKFSli-jTv_w==
expires
Sun, 17 Apr 2022 01:48:58 GMT
sharethis.js
platform-api.sharethis.com/js/ 		184 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.157.4.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-157-4-79.dus51.r.cloudfront.net
Software
/
Resource Hash
414363cb8150c2f60382da1d5a33f260caad65a54d6933e6b28534763d388db8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:52:30 GMT
content-encoding
gzip
vary
Accept-Encoding
age
116
etag
W/"2e0e3-tEY0wJEY/wwExgi0NrFi684gQTw"
x-frame-options
SAMEORIGIN
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
via
1.1 9f88eecf68d9192420b110f5f3f14fd6.cloudfront.net (CloudFront)
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-amz-cf-pop
DUS51-P2
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-id
Hrkn9GMC3Huw_wdJT1KQaj9kq2akSe6z8jhPXyp-0XIqW8yzPBYu7Q==
dmedianet.js
contextual.media.net/ 		165 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
fece1fa6125a9e01999ea0ae3f3d8ebbd8bf940eafe39052a92fb4d53fd0ca50
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-mnt-h
8-8
content-encoding
gzip
server
Apache
etag
"b3c9909c3b8433f796c50fc6257f17d3"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
max-age=300
date
Thu, 14 Apr 2022 15:54:26 GMT
strict-transport-security
max-age=604800
x-mnt-w
8-31
expires
Thu, 14 Apr 2022 15:59:26 GMT
logo_SecurityAffairs.png
securityaffairs.co/wordpress/wp-content/uploads/2015/12/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2015/12/logo_SecurityAffairs.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 17:30:42 GMT
server
Apache
accept-ranges
bytes
etag
"b0e9-5270743f5f480"
content-length
45289
content-type
image/png
headerbid.js
served-by.pixfuture.com/www/delivery/ 		973 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://served-by.pixfuture.com/www/delivery/headerbid.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
d490f2efc64637640a21c5282a89dd22344e58974641bc7bbbfa4c7e4dc8648e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Tue, 02 Mar 2021 20:36:48 GMT
server
nginx/1.10.3 (Ubuntu)
etag
"603ea1e0-3cd"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=172800, public, no-transform
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
973
expires
Sat, 16 Apr 2022 15:54:26 GMT
energy-dacilities-Sandworm.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/04/ 		294 KB
295 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/04/energy-dacilities-Sandworm.png?resize=1024%2C578&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
08a124e362c568f9543bfa353f6f74806fe2efc89c37102cbe93bc343fcc011f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Thu, 14 Apr 2022 15:54:26 GMT
x-content-type-options
nosniff
last-modified
Tue, 12 Apr 2022 14:11:33 GMT
server
nginx
etag
"6284fa77c4ea2e85"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2022/04/energy-dacilities-Sandworm.png>; rel="canonical"
content-length
301450
expires
Fri, 12 Apr 2024 02:11:33 GMT
facebook.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 		830 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
4c6b4ef22f4c5dd8fd6e17ab6706d8c55d236824c20b3d8dcd310f7de744def6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Thu, 14 Apr 2022 15:54:26 GMT
x-content-type-options
nosniff
last-modified
Wed, 10 Jun 2020 20:34:29 GMT
server
nginx
etag
"509a053c355d6394"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png>; rel="canonical"
content-length
830
expires
Sat, 11 Jun 2022 08:34:29 GMT
twitter.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
650868ebc4c00b2ea4ea72747f655f8a0552ba53c9b5b55defd9457be75f1aa9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Thu, 14 Apr 2022 15:54:26 GMT
x-content-type-options
nosniff
last-modified
Thu, 05 Nov 2020 08:12:40 GMT
server
nginx
etag
"fbafb4fa36d9fc66"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png>; rel="canonical"
content-length
1082
expires
Sat, 05 Nov 2022 20:12:40 GMT
linkedin.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
b97d80b9eedfeb29936f0d7f89afbdd425ef8d930d09fa1f98030ceb8b26cabd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Thu, 14 Apr 2022 15:54:26 GMT
x-content-type-options
nosniff
last-modified
Thu, 05 Nov 2020 08:12:40 GMT
server
nginx
etag
"8daaaf021369fdba"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png>; rel="canonical"
content-length
1184
expires
Sat, 05 Nov 2022 20:12:40 GMT
CISA.jpeg
securityaffairs.co/wordpress/wp-content/uploads/2020/07/ 		42 KB
42 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2020/07/CISA.jpeg
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
1536d07b6af9e6b855c692e59c9464e7f17dc211a4b17380f5a8b50ab13fe8df

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Sat, 25 Jul 2020 11:32:42 GMT
server
Apache
accept-ranges
bytes
etag
"a626-5ab4272934a80"
content-length
42534
content-type
image/jpeg
nginx.webp
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/04/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/04/nginx.webp?resize=300%2C300&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
ba35a541545a031276fd3a030e2e5485a88d0c6cbccb223b7116c920838c518e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Thu, 14 Apr 2022 15:54:26 GMT
x-content-type-options
nosniff
last-modified
Tue, 12 Apr 2022 11:55:38 GMT
server
nginx
etag
"cccfe83b20beeff2"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2022/04/nginx.webp>; rel="canonical"
content-length
3028
expires
Thu, 11 Apr 2024 23:55:38 GMT
ssba.css
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ 		142 KB
142 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ssba.css?ver=1646352596
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
6071f4e4c890545ad0f59302890def2aebb273acd131ed7ec434b26dfebad1e2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Fri, 04 Mar 2022 00:09:56 GMT
server
Apache
accept-ranges
bytes
etag
"237f3-5d95955ab0984"
content-length
145395
content-type
text/css
photon.js
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/photon.js?ver=20191001
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
e2dc35b0dbaa16b45d96eb3691927df48e091f4983ed2cc079568b789f9559da

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 06 Apr 2022 21:42:04 GMT
server
Apache
accept-ranges
bytes
etag
"6e0-5dc033b755435"
content-length
1760
content-type
application/javascript
jquery.adrotate.clicktracker.js
securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/ 		365 B
519 B 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
65cfa6801a0886fab249b224e8a6982b4740fe7879fce99ff13ddaac9aaca01a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Tue, 12 Apr 2022 22:02:38 GMT
server
Apache
accept-ranges
bytes
etag
"16d-5dc7c381308fc"
content-length
365
content-type
application/javascript
ssba.js
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ssba.js?ver=1646352596
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
9b978821f78e7bd3a48e5ae8fd7121a291eec506579406745800ca0590f0907c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Fri, 04 Mar 2022 00:09:56 GMT
server
Apache
accept-ranges
bytes
etag
"7c3-5d95955abe444"
content-length
1987
content-type
application/javascript
hint.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		987 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/hint.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
accept-ranges
bytes
etag
"3db-526fe6e433440"
content-length
987
content-type
application/javascript
jquery.tipsy.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		4 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.tipsy.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
accept-ranges
bytes
etag
"1113-526fe6e433440"
content-length
4371
content-type
application/javascript
jquery.easing.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		8 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.easing.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
accept-ranges
bytes
etag
"1fa1-526fe6e433440"
content-length
8097
content-type
application/javascript
browser.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/browser.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:16 GMT
server
Apache
accept-ranges
bytes
etag
"a36-526fe6e33f200"
content-length
2614
content-type
application/javascript
jquery.flexslider-min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/ 		21 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/jquery.flexslider-min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 13:55:10 GMT
server
Apache
accept-ranges
bytes
etag
"53ae-5270441274b80"
content-length
21422
content-type
application/javascript
waypoints.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		8 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/waypoints.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:18 GMT
server
Apache
accept-ranges
bytes
etag
"1f6c-526fe6e527680"
content-length
8044
content-type
application/javascript
mediaelement-and-player.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/ 		69 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/mediaelement-and-player.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 13:55:14 GMT
server
Apache
accept-ranges
bytes
etag
"11571-5270441645480"
content-length
71025
content-type
application/javascript
jquery.swipebox.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		11 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.swipebox.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
accept-ranges
bytes
etag
"2a67-526fe6e433440"
content-length
10855
content-type
application/javascript
jquery.circliful.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.circliful.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
accept-ranges
bytes
etag
"c18-526fe6e433440"
content-length
3096
content-type
application/javascript
jquery.smarticker.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		13 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.smarticker.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
accept-ranges
bytes
etag
"3225-526fe6e433440"
content-length
12837
content-type
application/javascript
custom.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 		12 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/custom.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:16 GMT
server
Apache
accept-ranges
bytes
etag
"31d4-526fe6e33f200"
content-length
12756
content-type
application/javascript
sharing.js
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/ 		22 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/sharing.js?ver=10.8
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
12c89195053b32c8e6577a5049ef4b5f6aa0a3f38cc0b87a745dd5fb6d9959cc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 06 Apr 2022 21:42:04 GMT
server
Apache
accept-ranges
bytes
etag
"5610-5dc033b777710"
content-length
22032
content-type
application/javascript
e-202215.js
stats.wp.com/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-202215.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-nc
HIT hhn
date
Thu, 14 Apr 2022 15:54:26 GMT
content-encoding
br
server
nginx
etag
W/"6197c5cf-3508"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Mon, 03 Apr 2023 07:40:23 GMT
sdk.js
connect.facebook.net/en_US/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
ffa50053e0d528369ac0d3e6242bfd0fef0ef9176d3c81de7b8adfc7dfe84339
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
2+eDMjE6232X7lSzdOlyGg==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
1685
x-fb-rlafr
0
x-fb-debug
p2Ekq8RjTYO95wvDZN5DB0bzf5en2oGEKDYE9ZnoNVe1oRfpHCeL5tFpC1OY5o/yRstnaOx+dHkRfLADQgRm2w==
x-fb-trip-id
917726464
x-fb-content-md5
947b52c65aca869918d6cced96944964
x-frame-options
DENY
date
Thu, 14 Apr 2022 15:54:26 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"08fc7a9b88f538316d88a60cc4e9c0f0"
timing-allow-origin
*
priority
u=3,i
expires
Thu, 14 Apr 2022 16:14:19 GMT
twemoji.js
securityaffairs.co/wordpress/wp-includes/js/ 		31 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/twemoji.js?ver=225d2128214efd4cb439b1095d30ca5b
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
f9fae20d30474c95bf8745df26cfa5c62803462a9ee57dd710c8266d7ece3f3e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Fri, 23 Jul 2021 22:11:53 GMT
server
Apache
accept-ranges
bytes
etag
"7cdc-5c7d1b0de3c40"
content-length
31964
content-type
application/javascript
wp-emoji.js
securityaffairs.co/wordpress/wp-includes/js/ 		9 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/wp-emoji.js?ver=225d2128214efd4cb439b1095d30ca5b
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
e503c59c36fc19803b2e9572b10e7c06236bda692aebd97f29e2a5a96f9aa5b6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Tue, 31 Mar 2020 22:49:14 GMT
server
Apache
accept-ranges
bytes
etag
"231d-5a22e60748e80"
content-length
8989
content-type
application/javascript
css
fonts.googleapis.com/ 		0
0
css
fonts.googleapis.com/ 		0
0
css
fonts.googleapis.com/ 		0
0
css
fonts.googleapis.com/ 		0
0
pview
l.sharethis.com/ 		0
405 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&sessionID=1649951666711.86001&hostname=securityaffairs.co&location=%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&product=simpleshare&fcmp=false&fcmpv2=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&title=Russia%27s%20Sandworm%20APT%20targets%20energy%20facilities%20in%20Ukraine%20with%20wipersSecurity%20Affairs&sop=false&description=Russia-linked%20Sandworm%20APT%20group%20targeted%20energy%20facilities%20in%20Ukraine%20with%20INDUSTROYER2%20and%20CADDYWIPER%20wipers.%20Russia-linked%20Sandworm%20threat%20actors%20targeted%20energy%20facilities%20in%20Ukraine%20with%20a%20new%20strain%20of%20the%20Industroyer%C2%A0ICS%20malware%20(INDUSTROYER2)%20and%20a%20new%20version%20of%20the%20CaddyWiper%20wiper.%20According%20to%20the%20CERT-UA%2C%20nation-state%20actors%20targeted%20high-voltage%C2%A0electrical%20substations%20with%20INDUSTROYER2%2C%20the%20variant%20analyzed%20by%20%5B%E2%80%A6%5D
Requested by
Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare&ver=8.2.4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.233.6 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-233-6.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date
Thu, 14 Apr 2022 15:54:26 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Access-Control-Max-Age
1728000
Connection
keep-alive
Access-Control-Allow-Headers
*
5b71b64b04b9a500117b1015.js
buttons-config.sharethis.com/js/ 		30 B
426 B 		Script
General
Check archive.org
Download Go to
Full URL
https://buttons-config.sharethis.com/js/5b71b64b04b9a500117b1015.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:7000:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
via
1.1 e6d97713eb9b65f883e0f86b833878dc.cloudfront.net (CloudFront)
last-modified
Mon, 13 Aug 2018 16:48:12 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"e6e1643313740711175f51662a65b42f"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
RefreshHit from cloudfront
content-type
text/javascript
cache-control
max-age=60,public
accept-ranges
bytes
content-length
30
x-amz-cf-id
rwfS5Fodb-RMTfaULZq8UgMalJEQ8hO3V2BLEsPSM1h21ThmkVL2cg==
analytics.js
google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://google-analytics.com/analytics.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
3067
date
Thu, 14 Apr 2022 15:03:19 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Thu, 14 Apr 2022 17:03:19 GMT
gtm.js
www.googletagmanager.com/ 		83 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PLPJ653
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e2c277798a0b9ab3fe76e2a98b4dbe3eae79ecc525e597f45b76d78e3fcf8364
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33081
x-xss-protection
0
last-modified
Thu, 14 Apr 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 14 Apr 2022 15:54:26 GMT
fontawesome-webfont.woff
securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/ 		43 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/fontawesome-webfont.woff?v=4.0.3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Request headers

Referer
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Origin
https://securityaffairs.co
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 16 Dec 2015 06:58:09 GMT
server
Apache
accept-ranges
bytes
etag
"ad90-526fe6dc92240"
content-length
44432
content-type
application/font-woff
truncated
/ 		7 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c

Request headers

Referer
Origin
https://securityaffairs.co
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type
application/font-woff;charset=utf-8
energy-dacilities-Sandworm-2.jpg
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/04/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2022/04/energy-dacilities-Sandworm-2.jpg?resize=768%2C618&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
af491e62eefccf9598da4fb1cc564e722f640d156bbb8f994518e0edb15e4305
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Thu, 14 Apr 2022 15:54:26 GMT
x-content-type-options
nosniff
last-modified
Tue, 12 Apr 2022 14:07:16 GMT
server
nginx
etag
"b8f4fc24510fc817"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2022/04/energy-dacilities-Sandworm-2.jpg>; rel="canonical"
content-length
18026
expires
Fri, 12 Apr 2024 02:07:16 GMT
f00db26378ef7df7c440a8ee60ead62b
secure.gravatar.com/avatar/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
5cbf31f01d7d1ce4853bcd6cc64dbfd103d412ec14d8bcc4ebca3b35dc3f3b74

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Thu, 14 Apr 2022 15:54:26 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=300
content-disposition
inline; filename="f00db26378ef7df7c440a8ee60ead62b.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g>; rel="canonical"
content-length
1186
expires
Thu, 14 Apr 2022 15:59:26 GMT
Digging-The-Deep-Web.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png?resize=236%2C300&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
ba716187f8cc8c54806f5b9de46d1d94bec574ddf31c82f68532cd181e242b7f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-nc
HIT hhn 3
date
Thu, 14 Apr 2022 15:54:26 GMT
x-content-type-options
nosniff
last-modified
Thu, 05 Nov 2020 08:12:40 GMT
server
nginx
etag
"156244085faab7d3"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png>; rel="canonical"
content-length
6414
expires
Sat, 05 Nov 2022 20:12:40 GMT
logo-center-for-cybersecurity.jpg
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/10/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/10/logo-center-for-cybersecurity.jpg?resize=290%2C300&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
73cadf4725483d9a9290b8ea3ad87fe2afc746de5f70e89f088a3df9996bd8dd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Thu, 14 Apr 2022 15:54:26 GMT
x-content-type-options
nosniff
last-modified
Thu, 05 Nov 2020 08:12:40 GMT
server
nginx
etag
"312ff21e46f29f3d"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2020/10/logo-center-for-cybersecurity.jpg>; rel="canonical"
content-length
7482
expires
Sat, 05 Nov 2022 20:12:40 GMT
newsletter.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2015/03/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2015/03/newsletter.png?resize=300%2C207&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
40bc46248d8f8d5fbea7678bd0c0031327e206daaf99f3bf6723b9a70f665f7f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Thu, 14 Apr 2022 15:54:26 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Dec 2020 07:29:12 GMT
server
nginx
etag
"a6fb49f7a00a0498"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2015/03/newsletter.png>; rel="canonical"
content-length
6336
expires
Thu, 15 Dec 2022 19:29:12 GMT
securityaffairs-best-european-blog2.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/06/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/06/securityaffairs-best-european-blog2.png?resize=300%2C217&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
e8caad51a19c5667e4fc7ae6a3b9bf8a23559bb64b09b0c6e90cad6d24083ea6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:26 GMT
x-content-type-options
nosniff
x-bytes-saved
103276
content-length
10314
x-nc
HIT hhn 2
last-modified
Tue, 02 Jun 2020 21:29:55 GMT
server
nginx
etag
"c8c3d7b06b174426"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2020/06/securityaffairs-best-european-blog2.png>; rel="canonical"
expires
Fri, 03 Jun 2022 09:29:55 GMT
pview
l.sharethis.com/ 		0
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&sessionID=1649951666711.86001&hostname=securityaffairs.co&location=%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&product=simpleshare&fcmp=false&fcmpv2=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&title=Russia%27s%20Sandworm%20APT%20targets%20energy%20facilities%20in%20Ukraine%20with%20wipersSecurity%20Affairs&sop=false&description=Russia-linked%20Sandworm%20APT%20group%20targeted%20energy%20facilities%20in%20Ukraine%20with%20INDUSTROYER2%20and%20CADDYWIPER%20wipers.%20Russia-linked%20Sandworm%20threat%20actors%20targeted%20energy%20facilities%20in%20Ukraine%20with%20a%20new%20strain%20of%20the%20Industroyer%C2%A0ICS%20malware%20(INDUSTROYER2)%20and%20a%20new%20version%20of%20the%20CaddyWiper%20wiper.%20According%20to%20the%20CERT-UA%2C%20nation-state%20actors%20targeted%20high-voltage%C2%A0electrical%20substations%20with%20INDUSTROYER2%2C%20the%20variant%20analyzed%20by%20%5B%E2%80%A6%5D&description=Russia-linked%20Sandworm%20APT%20group%20targeted%20energy%20facilities%20in%20Ukraine%20with%20INDUSTROYER2%20and%20CADDYWIPER%20wipers.%20Russia-linked%20Sandworm%20threat%20actors%20targeted%20energy%20facilities%20in%20Ukraine%20with%20a%20new%20strain%20of%20the%20Industroyer%C2%A0ICS%20malware%20(INDUSTROYER2)%20and%20a%20new%20version%20of%20the%20CaddyWiper%20wiper.%20According%20to%20the%20CERT-UA%2C%20nation-state%20actors%20targeted%20high-voltage%C2%A0electrical%20substations%20with%20INDUSTROYER2%2C%20the%20variant%20analyzed%20by%20%5B%E2%80%A6%5D&img_pview=true
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.233.6 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-233-6.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date
Thu, 14 Apr 2022 15:54:26 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Access-Control-Max-Age
1728000
Connection
keep-alive
Access-Control-Allow-Headers
*
g.gif
pixel.wp.com/ 		50 B
93 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A10.8&blog=29506073&post=130123&tz=0&srv=securityaffairs.co&host=securityaffairs.co&ref=&fcp=0&rand=0.3150577582230685
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 14 Apr 2022 15:54:26 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
sdk.js
connect.facebook.net/en_US/ 		283 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=b6e7b2b2ae79abf58b1ac694f62e00e7
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
1fe67d3edf54aac56a67e6e53a9a97c50688f58d94e51e7c1356fedf6deb0271
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://securityaffairs.co/
Origin
https://securityaffairs.co
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
0FgdQGCZAkrRJqiQ5AxPhA==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
expires
Fri, 14 Apr 2023 14:48:11 GMT
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
82864
x-fb-rlafr
0
x-fb-debug
qh/LMf84Ve3kThyLrkTWBPU8QdX+qiqxYffuDKZBAZf1+WWPpvcY86Ff3WTCYFQaF4fqTGxYjq9NatCF1EnNOA==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-content-md5
2f3a682cb69712c5014af377d9d5a0e6
cross-origin-opener-policy
same-origin-allow-popups
date
Thu, 14 Apr 2022 15:54:26 GMT
x-frame-options
DENY
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
etag
"c81dabde07d5bf922ef78245ab706251"
timing-allow-origin
*
priority
u=3,i
access-control-expose-headers
X-FB-Content-MD5
smtr
contextual.media.net/ 		1 KB
694 B 		Script
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=816788371&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&nse=5&vi=1649951666513641120&lw=1&ugd=4&kttle=Russia%27s%20Sandworm%20APT%20targets%20energy%20facilities%20in%20Ukraine%20with%20wipers&pgid=p01654052275t202204141554&nb=1&allsc=HE
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1ff6df602fb57704169c452a951bea8f366872b7127854a0d1f3e51e29a2849b
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=0, no-cache, no-store
x-sc-h
21-tmbn
strict-transport-security
max-age=604800
content-length
510
expires
Thu, 14 Apr 2022 15:54:27 GMT
checksync.php
contextual.media.net/ Frame 6C9F 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0ccdb777e91dfbbed4862eb5fa395448663a9fa9062da7475c23c4e51598c98e
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=71098
content-encoding
gzip
content-length
5717
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:27 GMT
expires
Fri, 15 Apr 2022 11:39:25 GMT
server
Apache
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
smtr
contextual.media.net/ 		1 KB
694 B 		Script
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=816788371&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&nse=5&vi=1649951666363652039&lw=1&ugd=4&kttle=Russia%27s%20Sandworm%20APT%20targets%20energy%20facilities%20in%20Ukraine%20with%20wipers&pgid=p01654052275t202204141554&nb=1&allsc=HE
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4f8474dcd74dfc147e3d7c72340b737b76928ebecfddd9a5e72db6493c64886b
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=0, no-cache, no-store
x-sc-h
21-mngg
strict-transport-security
max-age=604800
content-length
510
expires
Thu, 14 Apr 2022 15:54:27 GMT
checksync.php
contextual.media.net/ Frame 2525 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0ccdb777e91dfbbed4862eb5fa395448663a9fa9062da7475c23c4e51598c98e
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=71098
content-encoding
gzip
content-length
5717
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:27 GMT
expires
Fri, 15 Apr 2022 11:39:25 GMT
server
Apache
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
smtr
contextual.media.net/ 		1 KB
694 B 		Script
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&nse=5&vi=1649951666939492758&lw=1&ugd=4&kttle=Russia%27s%20Sandworm%20APT%20targets%20energy%20facilities%20in%20Ukraine%20with%20wipers&pgid=p01654052275t202204141554&nb=1&allsc=HE
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
77589bc3d910efdcb0e7f5e80bba9b8fafcd5db031cec21ab038a754b7442a5a
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=0, no-cache, no-store
x-sc-h
22-4bfm
strict-transport-security
max-age=604800
content-length
509
expires
Thu, 14 Apr 2022 15:54:27 GMT
checksync.php
contextual.media.net/ Frame 8680 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0ccdb777e91dfbbed4862eb5fa395448663a9fa9062da7475c23c4e51598c98e
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=71098
content-encoding
gzip
content-length
5717
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:27 GMT
expires
Fri, 15 Apr 2022 11:39:25 GMT
server
Apache
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
smtr
contextual.media.net/ 		1 KB
694 B 		Script
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=647633027&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&nse=5&vi=1649951666334794983&lw=1&ugd=4&kttle=Russia%27s%20Sandworm%20APT%20targets%20energy%20facilities%20in%20Ukraine%20with%20wipers&pgid=p01654052275t202204141554&nb=1&allsc=HE
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
63524c3fbabcc150bbc40876e3a213f1bfa97c0d3d5361401b2c38a07e2610ab
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=0, no-cache, no-store
x-sc-h
21-6kr9
strict-transport-security
max-age=604800
content-length
508
expires
Thu, 14 Apr 2022 15:54:27 GMT
checksync.php
contextual.media.net/ Frame 10F1 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0ccdb777e91dfbbed4862eb5fa395448663a9fa9062da7475c23c4e51598c98e
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=71098
content-encoding
gzip
content-length
5717
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:27 GMT
expires
Fri, 15 Apr 2022 11:39:25 GMT
server
Apache
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
smtr
contextual.media.net/ 		1 KB
694 B 		Script
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=647633027&size=300x250&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&nse=5&vi=1649951666454984357&lw=1&ugd=4&kttle=Russia%27s%20Sandworm%20APT%20targets%20energy%20facilities%20in%20Ukraine%20with%20wipers&pgid=p01654052275t202204141554&nb=1&allsc=HE
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4dbd6aaafb46a4353521b4f135d4b37aa2abf94294dea6e80db807f5282ba933
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=0, no-cache, no-store
x-sc-h
22-5tzl
strict-transport-security
max-age=604800
content-length
509
expires
Thu, 14 Apr 2022 15:54:27 GMT
checksync.php
contextual.media.net/ Frame 3DE1 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0ccdb777e91dfbbed4862eb5fa395448663a9fa9062da7475c23c4e51598c98e
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=71097
content-encoding
gzip
content-length
5717
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:27 GMT
expires
Fri, 15 Apr 2022 11:39:24 GMT
server
Apache
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
bping.php
lg3.media.net/ 		35 B
189 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lg3.media.net/bping.php?vgd_len=547&&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=816788371&vi=1649951666363652039&ugd=4&lf=6&cc=DE&sc=HE&lper=100&wsip=2886993991&r=1649951666939&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=None&vgd_rakh=1649951666152005559&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p01654052275t202204141554&vgd_pgids=2&vgd_uspa=0&hvsid=00001649951666913024540910082541&gdpr=1&vgd_end=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Thu, 14 Apr 2022 15:54:27 GMT
bping.php
lg3.media.net/ 		35 B
189 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lg3.media.net/bping.php?vgd_len=538&&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&vi=1649951666939492758&ugd=4&lf=6&cc=DE&sc=HE&wsip=2886993991&r=1649951666951&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=None&vgd_rakh=1649951666152005559&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p01654052275t202204141554&vgd_pgids=2&vgd_uspa=0&hvsid=00001649951666948024540910089886&gdpr=1&vgd_end=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Thu, 14 Apr 2022 15:54:27 GMT
bping.php
lg3.media.net/ 		35 B
189 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lg3.media.net/bping.php?vgd_len=547&&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=647633027&vi=1649951666334794983&ugd=4&lf=6&cc=DE&sc=HE&lper=100&wsip=2886993991&r=1649951666964&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=None&vgd_rakh=1649951666152005559&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p01654052275t202204141554&vgd_pgids=2&vgd_uspa=0&hvsid=00001649951666962024540910088256&gdpr=1&vgd_end=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Thu, 14 Apr 2022 15:54:27 GMT
bping.php
lg3.media.net/ 		35 B
189 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lg3.media.net/bping.php?vgd_len=547&&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=647633027&vi=1649951666454984357&ugd=4&lf=6&cc=DE&sc=HE&lper=100&wsip=2886993991&r=1649951666972&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=None&vgd_rakh=1649951666152005559&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fdmedianet.js&vgd_pgid=p01654052275t202204141554&vgd_pgids=2&vgd_uspa=0&hvsid=00001649951666962024540910088256&gdpr=1&vgd_end=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=21600
server
Apache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Thu, 14 Apr 2022 15:54:27 GMT
collect
www.google-analytics.com/j/ 		2 B
407 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1114035044&t=pageview&_s=1&dl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&ul=en-us&de=UTF-8&dt=Russia%27s%20Sandworm%20APT%20targets%20energy%20facilities%20in%20Ukraine%20with%20wipersSecurity%20Affairs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1441422396&gjid=259341106&cid=2002356130.1649951667&tid=UA-59069958-1&_gid=118594899.1649951667&_r=1&_slc=1&z=880609205
Requested by
Host: google-analytics.com
URL: https://google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		177 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-P62M3QN974&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PLPJ653
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
36c83fc22305c74f7d1fd0e91fd46557a9c8d8d45eade5a3233cea99b2efd794
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
66596
x-xss-protection
0
expires
Thu, 14 Apr 2022 15:54:27 GMT
hb_v2.js
cdn.pixfuture.com/ 		33 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pixfuture.com/hb_v2.js
Requested by
Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/delivery/headerbid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4671 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
45df10c585e01c07a3602ed16c1c6842d2572d6b15bceff9cb1f58256d330e31

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:27 GMT
cf-cache-status
HIT
last-modified
Tue, 28 Sep 2021 15:09:43 GMT
server
cloudflare
age
91280
etag
W/"61533037-84f5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z4lMcSPz2RWESSJDobbMcuUQyE8HZeAUcU6RTSg0%2BN2B6x39Bx6TrsjUboeVGyaA%2Fp6uccPKgwSiWwNHbq%2FU1sHVuRjVSDHmyHjXykyhAGC6oFk7VOHwKSkUcL2ZjLpCjHUTCn3WIACaP83GaFMG"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
expires
Thu, 14 Apr 2022 14:56:37 GMT
cache-control
public, max-age=2678400, no-transform
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6fbd9ebfef4e839a-MXP
cf-bgj
minify
collect
www.google-analytics.com/g/ 		0
17 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-P62M3QN974&gtm=2oe460&_p=1114035044&sr=1600x1200&_z=ccd.EAB&ul=en-us&cid=2002356130.1649951667&_s=1&dl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&dt=Russia%27s%20Sandworm%20APT%20targets%20energy%20facilities%20in%20Ukraine%20with%20wipersSecurity%20Affairs&sid=1649951667&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-P62M3QN974&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pbix.js
cdn.pixfuture.com/ 		423 KB
424 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pixfuture.com/pbix.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4671 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
536386f4e5a08dcde004ad0d24c4ea816a2054ba53f5da25ebb12fa4493f693f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:27 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
120773
cf-polished
origSize=433266
cf-bgj
minify
last-modified
Mon, 23 Aug 2021 13:19:22 GMT
server
cloudflare
etag
W/"6123a05a-69c72"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zg%2BIJkICaqW6GEs%2FGou3oUvBRngPGOJ4oi9Tqhv4a8wJivG8cbc5Y0h50WTid7gSj8iXukSF7MSfON2%2Fjs2erXoYGafJgKplzwZh%2BRVvcB%2BuTtGRFyHqG0WvCEkcwPyREmiW8sCm%2BtP6cgCFHPdH"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=2678400, no-transform
cf-ray
6fbd9ec04826839a-MXP
expires
Thu, 14 Apr 2022 14:56:43 GMT
r.js
aa.agkn.com/adscores/ 		0
185 B 		Script
General
Check archive.org
Download Go to
Full URL
https://aa.agkn.com/adscores/r.js?sid=9112309848
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.185.251.21 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-185-251-21.eu-central-1.compute.amazonaws.com
Software
AAWebServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
server
AAWebServer
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
cache-control
no-cache, no-store, must-revalidate
content-type
application/javascript
content-length
0
expires
0
hb_v2.php
served-by.pixfuture.com/www/delivery/ 		11 KB
12 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://served-by.pixfuture.com/www/delivery/hb_v2.php?dat=24274x728x90x4142x_ADSLOT1&keywords=russias,sandworm,apt,targets,energy,facilities,ukraine,wiperssecurity,affairs&refUrl=&refresh=false&innerWidth=1600
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
2af309c16d5fe7a1b6a45b9909f817072cfadc3fa4180fcc19b6ceb4818f1449

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
server
nginx/1.10.3 (Ubuntu)
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=172800, public, no-transform
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Sat, 16 Apr 2022 15:54:27 GMT
hb_v2.php
served-by.pixfuture.com/www/delivery/ 		9 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://served-by.pixfuture.com/www/delivery/hb_v2.php?dat=24270x300x250x4142x_ADSLOT1&keywords=russias,sandworm,apt,targets,energy,facilities,ukraine,wiperssecurity,affairs&refUrl=&refresh=false&innerWidth=1600
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
36ff448eedc05b30fe65395fb2f33affd77ce7e90a157d1ddb1c63dcb55d5513

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
server
nginx/1.10.3 (Ubuntu)
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=172800, public, no-transform
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Sat, 16 Apr 2022 15:54:27 GMT
hb_v2.php
served-by.pixfuture.com/www/delivery/ 		9 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://served-by.pixfuture.com/www/delivery/hb_v2.php?dat=24272x320x50x4142x_ADSLOT1&keywords=russias,sandworm,apt,targets,energy,facilities,ukraine,wiperssecurity,affairs&refUrl=&refresh=false&innerWidth=1600
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
397d019db11aa94e5bfaebddad866fbe73ffd5b64fbffa00f1382ccf3bff2b00

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
server
nginx/1.10.3 (Ubuntu)
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=172800, public, no-transform
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Sat, 16 Apr 2022 15:54:27 GMT
hb_v2.php
served-by.pixfuture.com/www/delivery/ 		9 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://served-by.pixfuture.com/www/delivery/hb_v2.php?dat=24272x320x50x4142x_ADSLOT1&keywords=russias,sandworm,apt,targets,energy,facilities,ukraine,wiperssecurity,affairs&refUrl=&refresh=false&innerWidth=1600
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
397d019db11aa94e5bfaebddad866fbe73ffd5b64fbffa00f1382ccf3bff2b00

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
server
nginx/1.10.3 (Ubuntu)
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=172800, public, no-transform
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Sat, 16 Apr 2022 15:54:27 GMT
log
lg3.media.net/ 		35 B
206 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lg3.media.net/log?&logid=kfk&evtid=adPrvLog&otherprov=0&cid=8CU5BD6EW&crid=647633027&cc=DE&ugd=4&timeTaken=1&vi=1649951666334794983&r=1649951667388
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Jetty(9.4.35.v20201120) /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
server
Jetty(9.4.35.v20201120)
strict-transport-security
max-age=21600
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Thu, 14 Apr 2022 15:54:27 GMT
json
gum.criteo.com/sid/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1&lsw=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://securityaffairs.co
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Thu, 14 Apr 2022 15:54:27 GMT
expires
0
pragma
no-cache
server-processing-duration-in-ticks
1575
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
sid
mug.criteo.com/
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1&lsw=1
  • https://mug.criteo.com/sid?cpp=7IOY-3xUVjJMYXJab1k3djBja1hYUGFvdjZzNlpxSno2VGxuSHkvZEc5bVhLamZ2Z0JNYW1HMFduZHZzR043L2t6bEZ6OHBZSUdMTU5UVGpnWDFpa2dGQndDRXpPMFgwbW9FTXVYMTNnL3l1QUZLRDY4eWUvRlhvOG1Zbn...
345 B
614 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=7IOY-3xUVjJMYXJab1k3djBja1hYUGFvdjZzNlpxSno2VGxuSHkvZEc5bVhLamZ2Z0JNYW1HMFduZHZzR043L2t6bEZ6OHBZSUdMTU5UVGpnWDFpa2dGQndDRXpPMFgwbW9FTXVYMTNnL3l1QUZLRDY4eWUvRlhvOG1ZbnRjcTBzWFpxcjc2V2sycExlYTVOOHF2cWEyb1VUSmplZi9SYlhzYWNqWHhGRThIc2o0bzlmTklYZmtNRlBrNjBDdk5UOCtwS3BTc2FzWWJleFpWT29lR2NLSGNPNTJmWWJ4SjBtSzdTNG91aFdrbDFTMkprPXw&cppv=2
Protocol
H2
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
3283a249a29a5d8b2e301a734bfd55910d1a492e0815d339fe934f101ec52f1f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:26 GMT
content-encoding
gzip
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
3226
strict-transport-security
max-age=31536000; preload;
expires
0

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:26 GMT
location
https://mug.criteo.com/sid?cpp=7IOY-3xUVjJMYXJab1k3djBja1hYUGFvdjZzNlpxSno2VGxuSHkvZEc5bVhLamZ2Z0JNYW1HMFduZHZzR043L2t6bEZ6OHBZSUdMTU5UVGpnWDFpa2dGQndDRXpPMFgwbW9FTXVYMTNnL3l1QUZLRDY4eWUvRlhvOG1ZbnRjcTBzWFpxcjc2V2sycExlYTVOOHF2cWEyb1VUSmplZi9SYlhzYWNqWHhGRThIc2o0bzlmTklYZmtNRlBrNjBDdk5UOCtwS3BTc2FzWWJleFpWT29lR2NLSGNPNTJmWWJ4SjBtSzdTNG91aFdrbDFTMkprPXw&cppv=2
strict-transport-security
max-age=31536000; preload;
access-control-allow-methods
GET
content-type
text/html; charset=utf-8
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1764
content-length
482
expires
0
529.json
id5-sync.com/g/v2/ 		213 B
625 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/529.json
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.89.21.8 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
p29.id5-sync.com
Software
/
Resource Hash
5cb7a25d4f17a40cc56d49379ce472846859338e4c0480fdaca0eb7b44bc467a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://securityaffairs.co
Date
Thu, 14 Apr 2022 15:54:26 GMT
Access-Control-Allow-Credentials
true
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/json;charset=UTF-8
envelope
api.rlcdn.com/api/identity/ 		0
0
rid
match.adsrvr.org/track/ 		109 B
545 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=yoni5uv&fmt=json
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
7f4da1edb1dbc4b3a90cda29f3bf1b475871803ea42ff30defd830338c52aa43

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 14 Apr 2022 15:54:27 GMT
x-aspnet-version
4.0.30319
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://securityaffairs.co
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Sat, 14 May 2022 15:54:27 GMT
bounce
secure.adnxs.com/
Redirect Chain
  • https://secure.adnxs.com/seg?add=27578926%2C27578926&t=1
  • https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D27578926%252C27578926%26t%3D1
0
1017 B 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D27578926%252C27578926%26t%3D1
Protocol
HTTP/1.1
Server
185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
cca03dc9-24d7-40a1-b684-c3effb6acfb1
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
a52dfa8f-b37f-43ae-af76-f3bcec319cb4
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D27578926%252C27578926%26t%3D1
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
bounce
secure.adnxs.com/
Redirect Chain
  • https://secure.adnxs.com/seg?add=27578935%2C27578935&t=1
  • https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D27578935%252C27578935%26t%3D1
0
1017 B 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D27578935%252C27578935%26t%3D1
Protocol
HTTP/1.1
Server
185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
4ff68f05-c198-4ee9-8124-39ac77140afb
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
f70f1771-1ef9-4886-a919-250eb1a74cdb
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D27578935%252C27578935%26t%3D1
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cookie_sync
prebidserver.pixfuture.com/ 		288 B
660 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebidserver.pixfuture.com/cookie_sync
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
157.245.94.128 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
f7a761c71e69933698cdf0bbe387fbeebeb3de97c36e692f1f924cdeadce993b

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
Server
nginx/1.14.0 (Ubuntu)
Vary
Origin
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
288
Expires
0
auction
prebidserver.pixfuture.com/openrtb2/ 		155 B
512 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebidserver.pixfuture.com/openrtb2/auction
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
157.245.94.128 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
cf3f12ff2e19c82fa8f25b48bf1821e3d95a64d06bfca24de438a380c6e18267

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:28 GMT
Server
nginx/1.14.0 (Ubuntu)
Vary
Origin
Content-Type
application/json
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
155
Expires
0
arj
pixfuture2-d.openx.net/w/1.0/ 		73 B
145 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pixfuture2-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=2cb80553-a9a5-475a-97d9-414064b1285d&nocache=1649951667633&pubcid=8d8ac836-90d3-46f8-afd8-e35a54142af4&schain=1.0%2C1!pixfuture.com%2C4142%2C1%2C%2C%2C&aus=320x50&divids=24272x320x50x4142x_ADSLOT1&aucs=&auid=540580841&tps=bXlrZXl3b3JkPXJ1c3NpYXMsc2FuZHdvcm0sYXB0LHRhcmdldHMsZW5lcmd5LGZhY2lsaXRpZXMsdWtyYWluZSx3aXBlcnNzZWN1cml0eSxhZmZhaXJzJm15b3RoZXJrZXl3b3JkPXJ1c3NpYXMsc2FuZHdvcm0sYXB0LHRhcmdldHMsZW5lcmd5LGZhY2lsaXRpZXMsdWtyYWluZSx3aXBlcnNzZWN1cml0eSxhZmZhaXJz
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4a8f54e70b58950234751220bbd5bcebe92906a04c85d18b084b4b182456bf00

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://securityaffairs.co
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
79
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
prebid
prebid.media.net/rtb/ 		1 KB
943 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.media.net/rtb/prebid?cid=8CUIUMTP7
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
139.148.107.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
db7d7df3f4aab463a34b8063205faa1646a5cc09e57e8709323c37ac37ea4967

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
server
nginx
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via
1.1 google
v1
prg.smartadserver.com/prebid/ 		171 B
560 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.138.122 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
br
vary
Accept-Encoding, Origin
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache,no-store
transfer-encoding
chunked
access-control-allow-credentials
true
content-type
application/json; charset=UTF-8
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
114 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.64.152.215 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-64-152-215.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Thu, 14 Apr 2022 15:54:27 GMT
access-control-allow-credentials
true
vary
Origin
bid
ap.lijit.com/rtb/ 		94 B
746 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.9.0-pre
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.19 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash
bd4684f4e57f7f33197f840d8d54aa438a3241bb8ffd9828f28475b078841929

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Date
Thu, 14 Apr 2022 15:54:27 GMT
Content-Encoding
gzip
Vary
Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap4ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
96
/
hb.emxdgt.com/ 		0
159 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.emxdgt.com/?t=3000&ts=1649951667638&src=pbjs
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.193.172.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-193-172-152.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Thu, 14 Apr 2022 15:54:27 GMT
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
security, Content-Type
prebid
ib.adnxs.com/ut/v3/ 		145 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
0d86e6c3718a83b34cf7b26bc26653358450bee35da98fac98b5cf6dcdd78c8c
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
802ccb85-4f70-4027-bd61-2191374c8f50
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
145
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
trinity.json
apex.go.sonobi.com/ 		95 B
735 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22188c2100ca3aeaa%22%3A%22277a716b3c3b01668abf%7C320x50%7Cf%3D0.3%22%7D&ref=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&s=1d193474-8899-4858-9b43-9ebd2d9df95a&pv=ba436638-1fb7-4a0e-b8d7-6aac9a2cec85&vp=desktop&lib_name=prebid&lib_v=5.9.0-pre&us=0&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D&kw=russias%2Csandworm%2Capt%2Ctargets%2Cenergy%2Cfacilities%2Cukraine%2Cwiperssecurity%2Caffairs&coppa=0
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
1392873e5f0bbf480e9e929626eb3d3d3c8450e370ae54e1b8f0db1893cc28c2
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
Content-Encoding
gzip
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-10
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, private
Access-Control-Allow-Credentials
true
Tcn
Choice
Content-Type
application/json
Content-Length
120
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
translator
hbopenbid.pubmatic.com/ 		0
117 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Thu, 14 Apr 2022 15:54:28 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ 		284 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23564&site_id=378734&zone_id=2094440&size_id=43&p_pos=atf&rp_schain=1.0,1!pixfuture.com,4142,1,,,&rf=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&tk_flint=pbjs_lite_v5.9.0-pre&x_source.tid=2cb80553-a9a5-475a-97d9-414064b1285d&p_screen_res=1600x1200&rp_floor=0.1&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7619713780146395
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
7f741a651c4429b8b02b76b9c6c010709defbd46e104f4cd3305467c19c983df

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
Server
nginx/1.21.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
284
Expires
Wed, 17 Sep 1975 21:32:10 GMT
hb
ssc.33across.com/api/v1/ 		66 B
158 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ssc.33across.com/api/v1/hb?guid=azC7qard4r6OkMaKlId8sQ
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
76.20.149.34.bc.googleusercontent.com
Software
/ 33Across
Resource Hash
2c02fed7f7613ae10d95e1daa88c0498e28c5840ec490764911cfa1fe85334a4

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://securityaffairs.co
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via
1.1 google
auction
prebidserver.pixfuture.com/openrtb2/ 		155 B
512 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebidserver.pixfuture.com/openrtb2/auction
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
157.245.94.128 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
e20fc21ea2633a73a6bb7a873c51669ef26ae419f3974d03136cd7bc9d6e98fc

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:28 GMT
Server
nginx/1.14.0 (Ubuntu)
Vary
Origin
Content-Type
application/json
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
155
Expires
0
bid
ap.lijit.com/rtb/ 		94 B
748 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.9.0-pre
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.19 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash
5a2532cf7580c46271ea911060cc5ec53af119983f85a001714c30b73c65b2f5

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Date
Thu, 14 Apr 2022 15:54:27 GMT
Content-Encoding
gzip
Vary
Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap4ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
98
prebid
ib.adnxs.com/ut/v3/ 		139 B
833 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
96b7364de35ece70ac384193e14cc8571c102ad455883b21694f50380c95d665
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
ff508301-fdbf-443d-81d6-1e0a9bcdbed5
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
139
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969105017575db4f32dc2eda5c0067&pos=pixfuture_network_news_728x90&cmd=bid&secure=1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
d7a8b92165eb5f38c892d4127da2801eedb94bf2a15de6c634a05a18efb53121

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 14 Apr 2022 15:54:27 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://securityaffairs.co
access-control-allow-credentials
true
content-length
62
translator
hbopenbid.pubmatic.com/ 		0
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Thu, 14 Apr 2022 15:54:26 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
arj
pixfuture2-d.openx.net/w/1.0/ 		73 B
380 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pixfuture2-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=84b23cec-894a-47d1-af78-a485d8a01ea0&nocache=1649951667653&pubcid=8d8ac836-90d3-46f8-afd8-e35a54142af4&schain=1.0%2C1!pixfuture.com%2C4142%2C1%2C%2C%2C&aus=728x90&divids=24274x728x90x4142x_ADSLOT1&aucs=&auid=540580842&tps=bXlrZXl3b3JkPXJ1c3NpYXMsc2FuZHdvcm0sYXB0LHRhcmdldHMsZW5lcmd5LGZhY2lsaXRpZXMsdWtyYWluZSx3aXBlcnNzZWN1cml0eSxhZmZhaXJzJm15b3RoZXJrZXl3b3JkPXJ1c3NpYXMsc2FuZHdvcm0sYXB0LHRhcmdldHMsZW5lcmd5LGZhY2lsaXRpZXMsdWtyYWluZSx3aXBlcnNzZWN1cml0eSxhZmZhaXJz
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
8ef52dfb79375f399be0a560df8362bacc0ccc50ad43cf66905986dcf9eb0350

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://securityaffairs.co
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
79
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
/
hb.emxdgt.com/ 		0
160 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.emxdgt.com/?t=3000&ts=1649951667653&src=pbjs
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.193.172.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-193-172-152.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Thu, 14 Apr 2022 15:54:27 GMT
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
security, Content-Type
prebid
prebid.media.net/rtb/ 		1 KB
771 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.media.net/rtb/prebid?cid=8CUIUMTP7
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
139.148.107.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
5bd8bae9eaa7115d445db2d861daeda84910d8792ce1e9a307a1ff754da1d213

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
server
nginx
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via
1.1 google
hb
ssc.33across.com/api/v1/ 		66 B
331 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ssc.33across.com/api/v1/hb?guid=azC7qard4r6OkMaKlId8sQ
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
76.20.149.34.bc.googleusercontent.com
Software
/ 33Across
Resource Hash
e3393e762db414c6b4a2b7702a3dc87d8fbb6a05b8e3e4f02fa98311e4f19614

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://securityaffairs.co
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via
1.1 google
trinity.json
apex.go.sonobi.com/ 		95 B
737 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2245b0ff76b05b667%22%3A%22951d83dd852c9348161e%7C728x90%7Cf%3D0.3%22%7D&ref=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&s=8dd8ef8d-c7f3-447a-9a06-e14d149f6c87&pv=ba436638-1fb7-4a0e-b8d7-6aac9a2cec85&vp=desktop&lib_name=prebid&lib_v=5.9.0-pre&us=0&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D&kw=russias%2Csandworm%2Capt%2Ctargets%2Cenergy%2Cfacilities%2Cukraine%2Cwiperssecurity%2Caffairs&coppa=0
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
13c94d61380048799c56066bf7c0db45b9fb7665dcb67c2c5a3f3a1c1160fa57
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
Content-Encoding
gzip
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, private
Access-Control-Allow-Credentials
true
Tcn
Choice
Content-Type
application/json
Content-Length
120
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
v1
prg.smartadserver.com/prebid/ 		171 B
560 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.138.122 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:26 GMT
content-encoding
br
vary
Accept-Encoding, Origin
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache,no-store
transfer-encoding
chunked
access-control-allow-credentials
true
content-type
application/json; charset=UTF-8
fastlane.json
fastlane.rubiconproject.com/a/api/ 		283 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23564&site_id=378734&zone_id=2094440&size_id=2&p_pos=atf&rp_schain=1.0,1!pixfuture.com,4142,1,,,&rf=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&tk_flint=pbjs_lite_v5.9.0-pre&x_source.tid=84b23cec-894a-47d1-af78-a485d8a01ea0&p_screen_res=1600x1200&rp_floor=0.1&rp_secure=1&rp_maxbids=1&slots=1&rand=0.1006643173195958
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
a7796af7079cbf624a5380d0d7babb44e7713d4adaec293270ba308e94ca68d1

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
Server
nginx/1.21.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
283
Expires
Wed, 17 Sep 1975 21:32:10 GMT
auction
prebidserver.pixfuture.com/openrtb2/ 		155 B
512 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebidserver.pixfuture.com/openrtb2/auction
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
157.245.94.128 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
80c6647bdd25a52e26f4c29113032af7b6143fb091e4c0bf4afab09cd61d0d82

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:28 GMT
Server
nginx/1.14.0 (Ubuntu)
Vary
Origin
Content-Type
application/json
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
155
Expires
0
v1
prg.smartadserver.com/prebid/ 		171 B
560 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.138.122 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:26 GMT
content-encoding
br
vary
Accept-Encoding, Origin
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache,no-store
transfer-encoding
chunked
access-control-allow-credentials
true
content-type
application/json; charset=UTF-8
hb
ssc.33across.com/api/v1/ 		66 B
158 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ssc.33across.com/api/v1/hb?guid=azC7qard4r6OkMaKlId8sQ
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
76.20.149.34.bc.googleusercontent.com
Software
/ 33Across
Resource Hash
c5e4bbd50bae53bb58fdfd9661427b0c6f2f9ba891c5cc5bf22880a9987c839b

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://securityaffairs.co
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via
1.1 google
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
293 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969105017575db4f32dc2eda5c0067&pos=pixfuture_network_news_300x250&cmd=bid&eidid5-sync.com=0&secure=1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
58b9d3687d60583ede953f60e80f6734b5243c809a9039988e41da842d2cfebf

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 14 Apr 2022 15:54:27 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://securityaffairs.co
access-control-allow-credentials
true
content-length
62
prebid
prebid.media.net/rtb/ 		1 KB
727 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.media.net/rtb/prebid?cid=8CUIUMTP7
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
139.148.107.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
b2fa5de804c23d34f72fcc61013b199f9e61d16c99342789c936456766c77b4a

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
server
nginx
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via
1.1 google
arj
pixfuture2-d.openx.net/w/1.0/ 		73 B
100 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pixfuture2-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=e6bee7b1-bd21-44d9-839a-02c882e49043&nocache=1649951667708&id5id=0&pubcid=8d8ac836-90d3-46f8-afd8-e35a54142af4&schain=1.0%2C1!pixfuture.com%2C4142%2C1%2C%2C%2C&aus=300x250&divids=24270x300x250x4142x_ADSLOT1&aucs=&auid=540580840&tps=bXlrZXl3b3JkPXJ1c3NpYXMsc2FuZHdvcm0sYXB0LHRhcmdldHMsZW5lcmd5LGZhY2lsaXRpZXMsdWtyYWluZSx3aXBlcnNzZWN1cml0eSxhZmZhaXJzJm15b3RoZXJrZXl3b3JkPXJ1c3NpYXMsc2FuZHdvcm0sYXB0LHRhcmdldHMsZW5lcmd5LGZhY2lsaXRpZXMsdWtyYWluZSx3aXBlcnNzZWN1cml0eSxhZmZhaXJz
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
ec8fff94e3e9c767b0749a2ae5b3390a276203d02a45ebe81453c0fbe336d8fc

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://securityaffairs.co
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
78
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ 		139 B
988 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
052ed19ea2a4ea919586adb721a89f672886f7f8a5d2a268fcda17fa9e81705f
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
3f51ab7a-3357-4d2a-94bd-37e6fd67e041
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
139
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		284 B
743 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23564&site_id=378734&zone_id=2094440&size_id=15&p_pos=atf&rp_schain=1.0,1!pixfuture.com,4142,1,,,&eid_id5-sync.com=0%5E1%5E&rf=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&tk_flint=pbjs_lite_v5.9.0-pre&x_source.tid=e6bee7b1-bd21-44d9-839a-02c882e49043&p_screen_res=1600x1200&rp_floor=0.1&rp_secure=1&rp_maxbids=1&slots=1&rand=0.0011950440741819168
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
9176c0c996b6d4f69eacaf39c3a74d59a42be5cfeb5377c74997bc1b3f13fbdb

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
Server
nginx/1.21.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
284
Expires
Wed, 17 Sep 1975 21:32:10 GMT
bid
ap.lijit.com/rtb/ 		94 B
747 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.9.0-pre
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.19 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash
49eb18826615b35b58120b655adeb1a11e702b4ad5531d99074cbcebebeafe75

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Date
Thu, 14 Apr 2022 15:54:27 GMT
Content-Encoding
gzip
Vary
Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap4ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
97
translator
hbopenbid.pubmatic.com/ 		0
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Thu, 14 Apr 2022 15:54:27 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
115 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.64.152.215 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-64-152-215.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Thu, 14 Apr 2022 15:54:27 GMT
access-control-allow-credentials
true
vary
Origin
/
hb.emxdgt.com/ 		0
159 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.emxdgt.com/?t=3000&ts=1649951667711&src=pbjs
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.193.172.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-193-172-152.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Thu, 14 Apr 2022 15:54:27 GMT
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
security, Content-Type
trinity.json
apex.go.sonobi.com/ 		95 B
733 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2276b9e4fdf48ddbe%22%3A%22833199e4bd4003904bc3%7C300x250%7Cf%3D0.3%22%7D&ref=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&s=0398d9b1-3f39-47db-8668-b49f55f4b543&pv=ba436638-1fb7-4a0e-b8d7-6aac9a2cec85&vp=desktop&lib_name=prebid&lib_v=5.9.0-pre&us=0&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D&userid=%7B%22id5id%22%3A%220%22%7D&eids=%5B%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%220%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%5D&kw=russias%2Csandworm%2Capt%2Ctargets%2Cenergy%2Cfacilities%2Cukraine%2Cwiperssecurity%2Caffairs&coppa=0
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
cee79b6a6d88fb567e0c04f3d34ae8d1a56e67e364461a7bf902c901d53dcf2f
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
Content-Encoding
gzip
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-8
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, private
Access-Control-Allow-Credentials
true
Tcn
Choice
Content-Type
application/json
Content-Length
120
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
auction
prebidserver.pixfuture.com/openrtb2/ 		155 B
512 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebidserver.pixfuture.com/openrtb2/auction
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
157.245.94.128 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
1630b7614bd2f42d68c49585bd0787536b4be1eef143d3d3d6db04eb83e0b6ea

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:28 GMT
Server
nginx/1.14.0 (Ubuntu)
Vary
Origin
Content-Type
application/json
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
155
Expires
0
v1
btlr.sharethrough.com/WYu2BXv1/ 		0
114 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.64.152.215 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-64-152-215.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Thu, 14 Apr 2022 15:54:27 GMT
access-control-allow-credentials
true
vary
Origin
v1
prg.smartadserver.com/prebid/ 		171 B
560 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.138.122 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
br
vary
Accept-Encoding, Origin
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache,no-store
transfer-encoding
chunked
access-control-allow-credentials
true
content-type
application/json; charset=UTF-8
prebid
ib.adnxs.com/ut/v3/ 		145 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
01e705ffb5cded4d2e41a4e38dae9ad75ac52dd34bbf2ef7560a3d1cb948092a
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
26f15c95-af63-4f13-9f61-8f6ecbc1e4a8
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
145
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
trinity.json
apex.go.sonobi.com/ 		95 B
733 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22874ff2244c43328%22%3A%22277a716b3c3b01668abf%7C320x50%7Cf%3D0.3%22%7D&ref=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&s=f86d5454-0ef8-42db-827c-0e173696cbfa&pv=ba436638-1fb7-4a0e-b8d7-6aac9a2cec85&vp=desktop&lib_name=prebid&lib_v=5.9.0-pre&us=0&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D&userid=%7B%22id5id%22%3A%220%22%2C%22tdid%22%3A%229ea79823-2611-4b51-88b2-d42fdb532721%22%7D&eids=%5B%7B%22source%22%3A%22id5-sync.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%220%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22linkType%22%3A0%7D%7D%5D%7D%2C%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%229ea79823-2611-4b51-88b2-d42fdb532721%22%2C%22atype%22%3A1%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%5D%7D%5D&kw=russias%2Csandworm%2Capt%2Ctargets%2Cenergy%2Cfacilities%2Cukraine%2Cwiperssecurity%2Caffairs&coppa=0
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
1969dc8273e3eeb550e28414807a56cb1856b8e41644715f5adf134bc7d90970
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
Content-Encoding
gzip
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-8
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, private
Access-Control-Allow-Credentials
true
Tcn
Choice
Content-Type
application/json
Content-Length
120
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
arj
pixfuture2-d.openx.net/w/1.0/ 		72 B
100 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pixfuture2-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=dfed4ce7-be81-4ada-9f12-18727918e086&nocache=1649951667721&id5id=0&ttduuid=9ea79823-2611-4b51-88b2-d42fdb532721&pubcid=8d8ac836-90d3-46f8-afd8-e35a54142af4&schain=1.0%2C1!pixfuture.com%2C4142%2C1%2C%2C%2C&aus=320x50&divids=24272x320x50x4142x_ADSLOT1&aucs=&auid=540580841&tps=bXlrZXl3b3JkPXJ1c3NpYXMsc2FuZHdvcm0sYXB0LHRhcmdldHMsZW5lcmd5LGZhY2lsaXRpZXMsdWtyYWluZSx3aXBlcnNzZWN1cml0eSxhZmZhaXJzJm15b3RoZXJrZXl3b3JkPXJ1c3NpYXMsc2FuZHdvcm0sYXB0LHRhcmdldHMsZW5lcmd5LGZhY2lsaXRpZXMsdWtyYWluZSx3aXBlcnNzZWN1cml0eSxhZmZhaXJz
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
2629fd6a092ad59275d6cdd8d8bbc92f4561b10b3e5d963acd38033c6471f21e

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://securityaffairs.co
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
78
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		284 B
743 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=23564&site_id=378734&zone_id=2094440&size_id=43&p_pos=atf&rp_schain=1.0,1!pixfuture.com,4142,1,,,&eid_id5-sync.com=0%5E1%5E&tpid_tdid=9ea79823-2611-4b51-88b2-d42fdb532721&eid_adserver.org=9ea79823-2611-4b51-88b2-d42fdb532721&rf=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&tk_flint=pbjs_lite_v5.9.0-pre&x_source.tid=dfed4ce7-be81-4ada-9f12-18727918e086&p_screen_res=1600x1200&rp_floor=0.1&rp_secure=1&rp_maxbids=1&slots=1&rand=0.17303639727454367
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
000b818d361b9c3cc2856f63e7a941395bcc91967e4ea348b6e3afc597093a7c

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:27 GMT
Server
nginx/1.21.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
284
Expires
Wed, 17 Sep 1975 21:32:10 GMT
translator
hbopenbid.pubmatic.com/ 		0
61 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Thu, 14 Apr 2022 15:54:27 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
prebid
prebid.media.net/rtb/ 		1 KB
727 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.media.net/rtb/prebid?cid=8CUIUMTP7
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
139.148.107.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
75e7ac5490ee6534f21a7f41ce13e2d59737b72255bc148d0db5bc485504e503

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
server
nginx
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via
1.1 google
/
hb.emxdgt.com/ 		0
159 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hb.emxdgt.com/?t=3000&ts=1649951667723&src=pbjs
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.193.172.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-193-172-152.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Thu, 14 Apr 2022 15:54:27 GMT
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
security, Content-Type
bid
ap.lijit.com/rtb/ 		95 B
748 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.9.0-pre
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.19 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash
1d62126b111934a7a1ba25b60cf3d4950653a2f773b4ed924dbbc2d854f31d86

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

Date
Thu, 14 Apr 2022 15:54:27 GMT
Content-Encoding
gzip
Vary
Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap4ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
98
hb
ssc.33across.com/api/v1/ 		67 B
159 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ssc.33across.com/api/v1/hb?guid=azC7qard4r6OkMaKlId8sQ
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
76.20.149.34.bc.googleusercontent.com
Software
/ 33Across
Resource Hash
a9e4bf6817b125819fe973415e3e82c95bbb0cded29af3433581ae9e3f421f29

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 14 Apr 2022 15:54:27 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://securityaffairs.co
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via
1.1 google
sid
mug.criteo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=7IOY-3xUVjJMYXJab1k3djBja1hYUGFvdjZzNlpxSno2VGxuSHkvZEc5bVhLamZ2Z0JNYW1HMFduZHZzR043L2t6bEZ6OHBZSUdMTU5UVGpnWDFpa2dGQndDRXpPMFgwbW9FTXVYMTNnL3l1QUZLRDY4eWUvRlhvOG1ZbnRjcTBzWFpxcjc2V2sycExlYTVOOHF2cWEyb1VUSmplZi9SYlhzYWNqWHhGRThIc2o0bzlmTklYZmtNRlBrNjBDdk5UOCtwS3BTc2FzWWJleFpWT29lR2NLSGNPNTJmWWJ4SjBtSzdTNG91aFdrbDFTMkprPXw&cppv=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
null
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Thu, 14 Apr 2022 15:54:27 GMT
expires
0
pragma
no-cache
server-processing-duration-in-ticks
1121
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
/
ads.us.e-planning.net/uspd/1/ Frame DB54
Redirect Chain
  • https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
  • https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
1 KB
922 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.249.52.249 Amsterdam, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS
ads.us.e-planning.net
Software
openresty /
Resource Hash
1800ae12155a44661387f750e4409fccd3a40caafe56bd7f689f0cfe40eb2931

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, no-cache
content-encoding
gzip
content-type
text/html
date
Thu, 14 Apr 2022 15:54:27 GMT
expires
Thu, 14 Apr 2022 15:54:27 GMT
p3p
policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server
openresty
x-sid
AMS-746

Redirect headers

content-type
text/html; charset=iso-8859-1
date
Thu, 14 Apr 2022 15:54:27 GMT
location
/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
p3p
policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server
openresty
x-sid
AMS-746
pixelSync
pixel.sitescout.com/dmp/ Frame DB54 		0
191 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.sitescout.com/dmp/pixelSync?network=EPLANNING&rurl=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fuid%3D%7BUSER_ID%7D%26dc%3D0abbcb4eba840e59%26fi%3Dc6dc7d173d5e8543
Requested by
Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
66.155.71.150 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.us.e-planning.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:27 GMT
cache-control
max-age=0,no-cache,no-store
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires
Tue, 11 Oct 1977 12:34:56 GMT
ptag
a.audrte.com/ Frame DB54 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.audrte.com/ptag?p=M1353665098
Requested by
Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.202.74.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-202-74-122.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
3e6114615513668e1a96e52e75b8821b328140de2dc1577023979edd16f35140

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.us.e-planning.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date
Thu, 14 Apr 2022 15:54:28 GMT
Content-Encoding
gzip
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
text/plain;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-transform, public, max-age=3600
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
1682
/
sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/ Frame DB54
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=25BiP9IMgN&r=https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fuid%3D[PDID]%26dc%3Dfabfd6762b833237%26fi%3Dc6dc7d173d5e8543
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fads.us.e-planning.net%2F
95 B
222 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fads.us.e-planning.net%2F
Requested by
Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
Protocol
H2
Server
138.201.8.249 Landshut, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.249.8.201.138.clients.your-server.de
Software
nginx/1.14.2 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.us.e-planning.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
server
nginx/1.14.2
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/png

Redirect headers

location
https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fads.us.e-planning.net%2F
date
Thu, 14 Apr 2022 15:54:28 GMT
server
nginx/1.14.2
content-type
text/html; charset=UTF-8
um
u-ams02.e-planning.net/ Frame DB54
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fu-ams02.e-planning.net%2Fum%3Fdc%3D8103fa85295fbe60%26fi%3Dc6dc7d173d5e8543%26uid%3D%24UID
  • https://u-ams02.e-planning.net/um?dc=8103fa85295fbe60&fi=c6dc7d173d5e8543&uid=6686298214416655647
42 B
104 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://u-ams02.e-planning.net/um?dc=8103fa85295fbe60&fi=c6dc7d173d5e8543&uid=6686298214416655647
Requested by
Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
Protocol
H2
Server
5.178.65.246 Amsterdam, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS
ads.us.e-planning.net
Software
openresty /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.us.e-planning.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
server
openresty
content-type
image/gif

Redirect headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:28 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
c45a9b48-c914-4f06-b35b-0fd7d118bc67
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://u-ams02.e-planning.net/um?dc=8103fa85295fbe60&fi=c6dc7d173d5e8543&uid=6686298214416655647
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
navegg_2022_01_br.html
i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/ Frame 1DE6 		1 KB
988 B 		Document
General
Check archive.org
Download Go to
Full URL
https://i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/navegg_2022_01_br.html
Requested by
Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 Leesburg, United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
fda04c7b27b3db6bda165e1d1324e7c475edc1f3cc06e927a78f739d74992fcb

Request headers

Referer
https://ads.us.e-planning.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
cache-control
max-age=157680000
cf4age
49
cf4ttl
157680000.000
content-encoding
gzip
content-length
624
content-type
text/html
date
Thu, 14 Apr 2022 15:54:28 GMT
etag
W/"61ddbb71-5f5"
expires
Sun, 10 Jan 2027 17:30:12 GMT
last-modified
Tue, 11 Jan 2022 17:16:33 GMT
server
CFS 0215
x-cf-rand
58.812
x-cf-tsc
1641922262
x-cf1
29080:dB.waw1:co:1585621119:cacheN.waw1-01:D
x-cf2
H
x-cf3
H
x-cff
B
/
onetag-sys.com/usync/ Frame 2E74 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Requested by
Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip251.ip-51-89-9.eu
Software
/
Resource Hash
4b84ed0d47a23278a7c7b8e55b281ced2f27d8b1448d13649e5681b4d6672bf8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://ads.us.e-planning.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-transform, no-cache
content-encoding
gzip
content-length
1483
content-type
text/html
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security
max-age=15552000
be246258-43b4-4200-9484-9771ee1131e4
onetag-sys.com/sync/i,1/ Frame 2E74
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=75&redir=%2F%2Fonetag-sys.com%2Fsync%2Fi%2C1%2F%5BMM_UUID%5D
  • https://onetag-sys.com/sync/i,1/be246258-43b4-4200-9484-9771ee1131e4
0
290 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/sync/i,1/be246258-43b4-4200-9484-9771ee1131e4
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
H2
Server
51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip251.ip-51-89-9.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-cache, no-transform
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date
Thu, 14 Apr 2022 15:54:28 GMT
Server
MT3 4335 2c68c00 master ord-pixel-x3 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://onetag-sys.com/sync/i,1/be246258-43b4-4200-9484-9771ee1131e4
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Thu, 14 Apr 2022 15:54:27 GMT
sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 2E74 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
8f052d4f888ae4e0626c5f819879cacd
Content-Type
image/gif
3775857252217606419
onetag-sys.com/sync/i,34/ Frame 2E74
Redirect Chain
  • https://dmp.adform.net/serving/cookie/match?party=1167&cid=J7ouLKv83d3FoUDHdP3Gq4HkJZe3e5UBsiHUUdUyfP8
  • https://dmp.adform.net/serving/cookie/match?CC=1&party=1167&cid=J7ouLKv83d3FoUDHdP3Gq4HkJZe3e5UBsiHUUdUyfP8
  • https://onetag-sys.com/sync/i,34/3775857252217606419
0
290 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/sync/i,34/3775857252217606419
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
H2
Server
51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip251.ip-51-89-9.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-cache, no-transform
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:28 GMT
server
nginx
location
https://onetag-sys.com/sync/i,34/3775857252217606419
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
/
onetag-sys.com/match/ Frame 2E74
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
  • https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=6686298214416655647
0
291 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=6686298214416655647
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
H2
Server
51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip251.ip-51-89-9.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:28 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
d4b5168b-c044-4411-9ff9-787d6cbe6a2a
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=6686298214416655647
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame 2E74 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=J7ouLKv83d3FoUDHdP3Gq4HkJZe3e5UBsiHUUdUyfP8
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
704c1e4d3fcc922a3031d436b584678b
Content-Type
image/gif
sync
pixel.advertising.com/ups/58198/ Frame 2E74
Redirect Chain
  • https://pixel.advertising.com/ups/58198/sync?&gdpr=1&gdpr_consent=&redir=true
  • https://pixel.advertising.com/ups/58198/sync?&gdpr=1&gdpr_consent=&redir=true&verify=true
0
124 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.advertising.com/ups/58198/sync?&gdpr=1&gdpr_consent=&redir=true&verify=true
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
H2
Server
52.59.41.116 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-59-41-116.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://pixel.advertising.com/ups/58198/sync?&gdpr=1&gdpr_consent=&redir=true&verify=true
date
Thu, 14 Apr 2022 15:54:28 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
pixel
cm.g.doubleclick.net/ Frame 2E74
Redirect Chain
  • https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgCjId2DcGjX3iJ2y7SWP_P-1iQo_mUdZ6Q
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgCjId2DcGjX3iJ2y7SWP_P-1iQo_mUdZ6Q&google_tc=
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgCjId2DcGjX3iJ2y7SWP_P-1iQo_mUdZ6Q&google_tc=
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:28 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:28 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgCjId2DcGjX3iJ2y7SWP_P-1iQo_mUdZ6Q&google_tc=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
318
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
ssbsync-global.smartadserver.com/api/ Frame 2E74 		0
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.137.107 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:27 GMT
content-length
0
711916.gif
id.rlcdn.com/ Frame 2E74 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/711916.gif?ct=4&cv=
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers
ecm3
s.amazon-adsystem.com/ Frame 2E74
Redirect Chain
  • https://onetag-sys.com/match/?int_id=113&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
  • https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=J7ouLKv83d3FoUDHdP3Gq4HkJZe3e5UBsiHUUdUyfP8
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=J7ouLKv83d3FoUDHdP3Gq4HkJZe3e5UBsiHUUdUyfP8
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
HTTP/1.1
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:28 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
JSS3CXECTZVJH79YYC7P
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=J7ouLKv83d3FoUDHdP3Gq4HkJZe3e5UBsiHUUdUyfP8
strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
ImgSync
image8.pubmatic.com/AdServer/ Frame 2E74 		0
42 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.113.35 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
content-length
0
/
onetag-sys.com/match/ Frame 2E74
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
  • https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm=&google_tc=
  • https://onetag-sys.com/match/?int_id=106&google_gid=CAESEOW_xUSp8xXk0HPMywuqOoE&google_cver=1
0
291 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEOW_xUSp8xXk0HPMywuqOoE&google_cver=1
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
H2
Server
51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip251.ip-51-89-9.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:28 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEOW_xUSp8xXk0HPMywuqOoE&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
298
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
onetag-sys.com/match/ Frame 2E74
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58488/occ
  • https://ups.analytics.yahoo.com/ups/58488/occ?verify=true
  • https://onetag-sys.com/match/?int_id=92&uid=y-uuR5LNVE2uFddClvWArRo53rMjj49Kl3UkMSREk-~A
0
291 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=92&uid=y-uuR5LNVE2uFddClvWArRo53rMjj49Kl3UkMSREk-~A
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
H2
Server
51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip251.ip-51-89-9.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location
https://onetag-sys.com/match/?int_id=92&uid=y-uuR5LNVE2uFddClvWArRo53rMjj49Kl3UkMSREk-~A
date
Thu, 14 Apr 2022 15:54:28 GMT
server
ATS/9.1.0.46
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
/
onetag-sys.com/sync/i,29/ Frame 2E74
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
  • https://onetag-sys.com/sync/i,29/?tdid=9ea79823-2611-4b51-88b2-d42fdb532721&ttl=1652543667
43 B
370 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/sync/i,29/?tdid=9ea79823-2611-4b51-88b2-d42fdb532721&ttl=1652543667
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
H2
Server
51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip251.ip-51-89-9.eu
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
content-encoding
gzip
cache-control
no-cache, no-transform
content-length
64
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:28 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://onetag-sys.com/sync/i,29/?tdid=9ea79823-2611-4b51-88b2-d42fdb532721&ttl=1652543667
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
211
/
onetag-sys.com/match/ Frame 2E74
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=onetag
  • https://x.bidswitch.net/ul_cb/sync?ssp=onetag
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=onetag&bsw_param=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&google_hm=ZWI3YmFhZmEtZmI2Ny00ZDZkLWIyY2ItMTcwMGExOGZjYWRj
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESENb5H85bIhVct43Lv0sGLek&google_cver=1&ssp=onetag&bsw_param=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc
  • https://onetag-sys.com/match/?int_id=30&uid=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&gdpr=&gdpr_consent=&us_privacy=
0
291 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=30&uid=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&gdpr=&gdpr_consent=&us_privacy=
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
H2
Server
51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip251.ip-51-89-9.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Location
//onetag-sys.com/match/?int_id=30&uid=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&gdpr=&gdpr_consent=&us_privacy=
Date
Thu, 14 Apr 2022 15:54:28 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
um
sync.e-planning.net/ Frame 2E74 		42 B
104 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.e-planning.net/um?uid=J7ouLKv83d3FoUDHdP3Gq4HkJZe3e5UBsiHUUdUyfP8&dc=69e9794bfc7bf740&iss=1
Requested by
Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=5927d926323dc2c
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.178.65.245 Amsterdam, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS
ads.us.e-planning.net
Software
openresty /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://onetag-sys.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
server
openresty
content-type
image/gif
sirdata_03022021.html
s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/ Frame F6C2 		636 B
578 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html
Requested by
Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
5.178.65.253 Amsterdam, Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS
i.e-planning.net
Software
openresty /
Resource Hash
14d79e2cf47df339b79d25ffc6d0136e5d2e70a96b75e6782198ea6bbda3ca0a

Request headers

Referer
https://ads.us.e-planning.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
cache-control
max-age=157680000
content-encoding
gzip
content-type
text/html
date
Thu, 14 Apr 2022 15:54:28 GMT
etag
W/"601b131c-27c"
expires
Tue, 13 Apr 2027 15:54:28 GMT
last-modified
Wed, 03 Feb 2021 21:18:20 GMT
server
openresty
setuid
prebidserver.pixfuture.com/ Frame 2CC1 		0
524 B 		Document
General
Check archive.org
Download Go to
Full URL
https://prebidserver.pixfuture.com:8000/setuid?bidder=eplanning&gdpr=&gdpr_consent=&f=b&uid=ADlNKkfZw6sx6xbJ
Requested by
Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Deplanning%26gdpr%3D%26gdpr_consent%3D%26f%3Db%26uid%3D%24UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
157.245.94.128 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.us.e-planning.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Content-Type
text/html
Date
Thu, 14 Apr 2022 15:54:28 GMT
Expires
0
Pragma
no-cache
Server
nginx/1.14.0 (Ubuntu)
Vary
Origin
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 789C 		0
0
tracking.php
served-by.pixfuture.com/www/headerbid/library/tracking/ 		0
309 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:28 GMT
server
nginx/1.10.3 (Ubuntu)
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
max-age=172800
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Sat, 16 Apr 2022 15:54:28 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 9E18 		115 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d3b9d1ee20eee3a02abd17bac2a5a17d19eb62eab59b0b2a913ef5f837a59695
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40093
x-xss-protection
0
server
cafe
etag
7162398953392935060
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 14 Apr 2022 15:54:28 GMT
tracking.php
served-by.pixfuture.com/www/headerbid/library/tracking/ 		0
309 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:28 GMT
server
nginx/1.10.3 (Ubuntu)
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
max-age=172800
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Sat, 16 Apr 2022 15:54:28 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 35E0 		115 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
28e1bef77434cf8cc2611fed00a56b9fdb40a9f7dd755bffcf2821087a07d2a8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40030
x-xss-protection
0
server
cafe
etag
12446400239032827975
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 14 Apr 2022 15:54:28 GMT
tracking.php
served-by.pixfuture.com/www/headerbid/library/tracking/ 		0
309 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:28 GMT
server
nginx/1.10.3 (Ubuntu)
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
max-age=172800
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Sat, 16 Apr 2022 15:54:28 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 1E81 		101 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
30adb3d3af5cd34e8166edac56f32bfde00e84866dcbde7925cb4b74016133cb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36665
x-xss-protection
0
server
cafe
etag
2331272034050066725
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 14 Apr 2022 15:54:28 GMT
tracking.php
served-by.pixfuture.com/www/headerbid/library/tracking/ 		0
309 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:28 GMT
server
nginx/1.10.3 (Ubuntu)
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
max-age=172800
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Sat, 16 Apr 2022 15:54:28 GMT
GS.d
js.cookieless-data.com/ Frame F6C2 		0
535 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.cookieless-data.com/GS.d?pa=24492&cmp=0&si=1&u=https%3A%2F%2Fs.e-planning.net%2Fesb%2F4%2F0%2F1992d%2Fbb6e7a161f794f56%2Fsirdata_03022021.html&r=https%3A%2F%2Fads.us.e-planning.net%2F&s=&rand=1649951668471
Requested by
Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.15.145.115 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS
51-15-145-115.rev.poneytelecom.eu
Software
nginx/1.20.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains; preload
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s.e-planning.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:28 GMT
Server
nginx/1.20.2
Strict-Transport-Security
max-age=15724800; includeSubDomains; preload
P3p
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Content-Length
0
X-Xss-Protection
0
Expires
Tue, 01 Jan 2000 00:00:00 GMT
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204060102/ Frame 9E18 		302 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204060102/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&bust=31067052
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
21472dfcec727bbbfd98d940e15f7bf64a2949df9d72a07f15c1d546c6bdc393
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
110295
x-xss-protection
0
server
cafe
etag
13072004596736077490
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Thu, 14 Apr 2022 15:54:28 GMT
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/ Frame 1E81 		302 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3e07a7067d4af1a7ef437fe4ccc72951b2432f3f70a3a55254efad6d72e6eb53
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
110225
x-xss-protection
0
server
cafe
etag
8070459256703200538
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Thu, 14 Apr 2022 15:54:28 GMT
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/ Frame 35E0 		302 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&bust=31067051
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7dd12b0dc062fcbef534496a47c9eed4a9eaa2922acc8002d289205098813017
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
110225
x-xss-protection
0
server
cafe
etag
13754548657515720409
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Thu, 14 Apr 2022 15:54:28 GMT
cookie.js
partner.googleadservices.com/gampad/ Frame 9E18 		222 B
649 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=securityaffairs.co&callback=_gfp_s_&client=ca-pub-1575911585432548
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204060102/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&bust=31067052
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
17337686711c839b6ff2984299c6fdc98b211f0845101cb3cc0b54689ec71ebe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
205
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ Frame 9E18 		107 B
792 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204060102/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&bust=31067052
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 9E18 		107 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204060102/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&bust=31067052
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 8073 		21 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204060102/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&bust=31067052
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2ee73e6555f3a25e214bc76107965b462821485f2ba63b7ea6f021cd2be651d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding
br
content-length
10531
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:54:29 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
cookie.js
partner.googleadservices.com/gampad/ Frame 1E81 		222 B
270 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=securityaffairs.co&callback=_gfp_s_&client=ca-pub-1575911585432548
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
8d47728d4b3e5b65318a927a02edd90a71efd8f78a99ae9553486bd61c24fc28
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
205
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ Frame 1E81 		107 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 1E81 		107 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame EA8A 		21 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5674f3e8cfe98894f414f0da141f69670f50ac73036f89f3807ec166c9ef017e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding
br
content-length
10487
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:54:29 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
cookie.js
partner.googleadservices.com/gampad/ Frame 35E0 		222 B
231 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=securityaffairs.co&callback=_gfp_s_&client=ca-pub-1575911585432548
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&bust=31067051
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
162db2d235d3121a7659ead757e15d179ee217408765fedf28b77949a2c47b34
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
209
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ Frame 35E0 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&bust=31067051
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 35E0 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&bust=31067051
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 14 Apr 2022 15:54:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 7A4F 		17 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&bust=31067051
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4c7756e32c4ea48269399d49d610cb4cd1a935d66a3057d8ba517449ee3e09ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding
br
content-length
9322
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:54:29 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A4F 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AS_cBTnjfzaOVUYHLDTdzFVhd_p_cYJNQV_d_7YWfwR-dJqVVz4pm6Uj19q0jxde6wlhFVJ4qqUddVw2DEoGvTK1HmgYj08H8MUlSDzS8pQY8QfTc
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220412/r20110914/client/ Frame 7A4F 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220412/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:52:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
101
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1359
x-xss-protection
0
server
cafe
etag
1484984001845508991
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 28 Apr 2022 15:52:48 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 7A4F 		119 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5c76c5cdd769bc7a048c8f65c56a7000adb29c8472d36eb4514af572a5ec5f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36908
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1649677559247379"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 14 Apr 2022 15:54:29 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220412/r20110914/client/ Frame 7A4F 		15 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220412/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:47:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
432
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6409
x-xss-protection
0
server
cafe
etag
15284592792851369840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 28 Apr 2022 15:47:17 GMT
l
www.google.com/ads/measurement/ Frame 7A4F 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSOV_HPWZFRob3IpSeMiTQRHDvPln9KQEG9CvnD7BCDc8QcmrATCvI99W2ippAt_JN_-8UdilXoI6VkdLOpkwzN0OcmzA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers
pixel
googleads.g.doubleclick.net/xbbe/ Frame C595 		624 B
297 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=COLeahCC2XQYwefQxwEwAQ&v=APEucNX-9nKWAY3CwC6bNPt3LQED-8PKbkX6fMrn-cphBdLpGFaggKF1OtOd8emmz8lcB-_1P265sW7SsUlG3-BQxvQMGZ14aU53U93ob4S6dR-1pUYx6WiUehJ-pyV8wnPrYFQmUJcTbg2StbLyKNXxtePm2uFHB-EqPdA7bDs2vUjqtg07QKnKxiPIBtFycmXjVGXPuS2MGq-GMULh2bQrUfe--dyZeg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
gzip
content-length
276
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:54:29 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ad
googleads.g.doubleclick.net/dbm/ Frame 7A4F 		81 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CY130-Un4CxVJtPNtVZVZUM_om0lKYNnF5nviLAkaL0KvTy8xoa8kmVnnX8Z3YnB13dyxoEouUJGYddQMKJQmSHFAmUmLBloPgc-D-XrPL_bfwrhDEiMikehF88lvM7lT4KnkmgPmYAS_aLQzxASSQhEjBYA&dbm_d=AKAmf-BaqjmgF2KENvBk1PM8g-Re9ScSbaZJ0gNuRkcI9z18qrwdH1U2FDnC73jRPp1PIpyMHVtc2h_EQjc1GrXJaxER75KmPkGKYP6Ga-V2MzbFdgjSG6FFJmo-mg9SEZLJ6FPgzzhRjvTbYpWLN2hXASe_gwrkF_UbYB3RCqRSQifdWi9_4JVvCJHQRywhJW_r8MhgXmpNlYHfY-Dr9rl8bm2Y0bRb2H5VJnFZwZ6TaOP_7jRGaszd7g3YQgXSwbY-s-8m49eLn3HrPQALYS4KmuQj4lkHjTrQc3f3MiVCGAWzuYlKFGwrYxhZrQwQ02B5Y2CsIGqFi3XdKImkq9XYwsKV5X95LYityBIDAUX76aubr--r7itMSEzc3xjx_O8kfEGA7roCDaNXffcez-gs-l3pB8_dx8i-TSWK9mLUiZ_FDXaqjwLRq7gGMwnsIpf-rz5_RK-i2uy1XmkSf79k4n5DBYVxGojRAIBfAgFDscDC2DEosPNnps0cQ1UlYUGP0yN_zzGMR5cVPcuvLQiKf2ZbDTKt9ye2LTptDOlGiqi0A6Wk17DH7gnj7ywU3Z4Wnp7NFH66nwcoiQFRQi7rSjtK_hBIR3b4ZaF2xb7niMSZLpktjeJ1cp3Fog8wN4X6Wrc-tpI_vhyMqRivbag2p083wgJ9pd1shI2oBDnXx4WoY-VWzK4rdfCGIv3XRPfO8QotXzbn-47zw18EIIRP04Gqc6ZSd1lULS89Lso1fO1IIZyDufdDEmxPSVJoONenR72LwyeTiP-ZGULUegbyST3e_OW2DgXfR5HdMD2JIpU9jU738LIw48opF8U3sOiLgAmEsNreeIXgiTeSvEllhphwk4_kGLHs7mSXVvoncOl-Lh-UPhAl3nezwq3gi3HlGEZ6Yaf4_ZGewn09XQ7ge6C3L1hCCawzJlSpSCkVu2p5iQmQ3PcrXPvbnlSAVT6T8069wQqVYZbB5ym8VJEf0br7L4cWxtnrVSd_TFbMAjtJg29FLfYWxecAvGPI7ZZEThUBOuZzbVzkNnosW-haPrh4XZlEV75KsEfH_kVEWWLEnBkT_VEfCrJg0s25aISOBEi84Z0G1z2-MeDWjMW5DMiH1m4-PVvxCysdJ4xbLdg8CD4mBaay8sS8NEo0wfg3WV7JbtmotkuVFQBMnYAOrZ6na_1OI0_CPHKpECsZshtb_g56GEVI5W8LWAnZrxfRdP5a7CvREPBcTY-rr1oKAAzgZxuHLLdrPDeTdNTc9ekh_LNeIAH0rpiPWCu0sHJD2rx-GEO8Ra_nrODXnt0hENi0nJRdrhRRteObVcII3o74oEmcTqYuAjTXq3JUT9sek-19EI3AYBz80tj1tJ8z2se65gavSaGDJ5ArzjtcmWEvdtB7GNwupyhlVO6-1_mAUlC3YYq3g6jSMC24b5ta5GOt_t5q9Exv3_imMi4__VebSHpAJtUuz8_Uiov5i2ofumZN0RFLyDmPAaf8-y1HlyD5h94iknCf5yMS2qlsN7wxFN8bIpLowvGmEedUil8BimCLVYX__rk1YEfmhoMaLFkHSr55pEOUIxbaY7AaR3rAxBGV9SywWW07LyyJ5coPRuMy8fE4eo0kt2uEfpbGi4RailKzsqh_PvBiJ5wH8bs9mySa-UXK5UjXwsn7p1OYnThRw839qVIGyKI7fzliFKegncrhRqdbHveZUCSBczRymPuVe43O0zcTkFhniI0wV23-HE23kX9K3LFksEbhEQgvvYG7yC-HRCsBpkwyBPYlwfUyEw8IEnujxj1TNKn5fRfmpwj-zDXtLRz1vK9Q1rzVw_I_TuvICZeAmCMm8rXED1fZ6dSIzpCwvmbV5cTzFg3DlizmtkZgqOEqRl1oaZ5souC54tToOafWmr24YL97JTxTtGGA4KtOnPpAaMqTk2aQfOaYtd9MG4-_kPGfx6LugMWjcfKIG0TrhxR762hw7CcTXGA6NKtnIMgRDOf0XHXJsxdUYsyLK7uGLv4lfCGXWj9A_pO9zz2YyD8Pff16eYe0tZqTHbe2Nc2L3XAgCrP-yII_N1NbSfPiuXcD7_96bWVhh7lPLHjTYfD-vhuaLV-edYlLfm7u8Y4-657uS6iA0qwb55nQBG3mGIYyDio422YIQyYCMKkFQj7NCwZaCCdnGsUAeEi1As3aobnepQQqWixvFEVaioT88mZoIaGZn5Cur9Z12V3dFlCdp5FEsRpQ-p4He_sljdmf9C8zESSYFDst06MXS_CDLADPfNWEi1HXcVGI35GOdkMGo7BZdYDN7ZaKIR7o0r9DSQOWbT7PFlk3tmN4WI7PxZpTZ4jVGTANhdGnf7Fmufhed9exQDXBcooDgj1DxnrhMINwYleyqJGfsWAtQnOjXvxirbrj_QZTPDH9F-oC0gxWqm_pF4xcbbQ4iUV9JoPR2DFLYZqsE5jNVj8rWeVd97T9qqZ4rSvSScFLT9dntzNa14ncttlVqiq6UK1F7A_y4pVGxSzMbloD67DjZbi8BbT1fhZKSbl_DE6H74U1jCXxKanXz0YsKGJJBZ5PgRe5FNEXiAbIKrdGDULM25V-VRuOllAZVi2XB4C8EwoAXCwZv-ycC6XU1PTnHGTU9xyYAzN7yfOmoCUgSljKdxl4Y4xUYCwy20cxqY1o2I0M2lv9o2vJ2ZaBKZpjXnV8foErT25Ylij41wJOw7nbLVYXpL1Mm3Q-JF9kHKAQ-WRHCsqhxeA_6IpGAdolhTc8BFmHWh-jV3MzbusXv1HAmtKfFKi5ARah8QaZFgK3RIFZbnWT4zap1PatIa0UBbFJCD6lDRb_JrtrCXzPCO8c0y9NMBSdlao7lHHsLBSlRxNu3wFrCFzlwvAkxIuMeZixWmYdPdedbHNibLKVPC3Urhf2cWU0wut79hVX9iN8Z3BCqDFarNWJ4EdOINeZRvK2QJSkKG5BPRP_e3R7aJ-hMByvzsTdyzEJabUIfW-VcxNjeJ8CykMj4IFFDErhGfotq9xPXaWetQSFZArPyFSb0EsQlfqpdFSgsRnQQ4I08JCAwxA2TdI2OKlxJk3ENKd__9BlI6fjcJamQedllL82q-iui2e9QEt_X7aT3Gzu37CxYW-5bxFPRyz7g4QrcyO94ZsMGnXj-Wjk8dYDy8UQfPN_JB3HYA8N95FujfKTUKZoawMNREekUKkhVGL-9DjlS7AWKXI_uV9i2aHvkuxvs6HMLN46TkArHAVvccP82yTvpnzy1HF5ie59NJo&cid=CAASEuRoLv-GyL05TVBaCUCDxb5UAg&rfl=2%2Chttps%253A%252F%252Fsecurityaffairs.co%242%2Chttps%253A%252F%252Fsecurityaffairs.co%252F%240
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
94b59f7bd824b8b309f91a83e5d05df9844329ae6e9ede37c3a2a833c4520835
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33765
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame C595
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGvyBNpI5lnBceFazxOws8E&google_cver=1
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGvyBNpI5lnBceFazxOws8E&google_cver=1&C=1
43 B
1014 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGvyBNpI5lnBceFazxOws8E&google_cver=1&C=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COLeahCC2XQYwefQxwEwAQ&v=APEucNX-9nKWAY3CwC6bNPt3LQED-8PKbkX6fMrn-cphBdLpGFaggKF1OtOd8emmz8lcB-_1P265sW7SsUlG3-BQxvQMGZ14aU53U93ob4S6dR-1pUYx6WiUehJ-pyV8wnPrYFQmUJcTbg2StbLyKNXxtePm2uFHB-EqPdA7bDs2vUjqtg07QKnKxiPIBtFycmXjVGXPuS2MGq-GMULh2bQrUfe--dyZeg
Protocol
HTTP/1.1
Server
184.87.213.8 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-87-213-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 14 Apr 2022 15:54:29 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGvyBNpI5lnBceFazxOws8E&google_cver=1&C=1
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
308
Expires
Thu, 14 Apr 2022 15:54:29 GMT
rum
dsum-sec.casalemedia.com/ Frame C595
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YlhDtQJADWnswXc5voXTowAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGvyBNpI5lnBceFazxOws8E&google_cver=1
43 B
894 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGvyBNpI5lnBceFazxOws8E&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COLeahCC2XQYwefQxwEwAQ&v=APEucNX-9nKWAY3CwC6bNPt3LQED-8PKbkX6fMrn-cphBdLpGFaggKF1OtOd8emmz8lcB-_1P265sW7SsUlG3-BQxvQMGZ14aU53U93ob4S6dR-1pUYx6WiUehJ-pyV8wnPrYFQmUJcTbg2StbLyKNXxtePm2uFHB-EqPdA7bDs2vUjqtg07QKnKxiPIBtFycmXjVGXPuS2MGq-GMULh2bQrUfe--dyZeg
Protocol
HTTP/1.1
Server
184.87.213.8 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-87-213-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 14 Apr 2022 15:54:29 GMT

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGvyBNpI5lnBceFazxOws8E&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
ib.adnxs.com/ Frame C595
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEFSwawj46kXoFNqMZ9GMw0Y&google_cver=1
43 B
1016 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/setuid?entity=101&code=CAESEFSwawj46kXoFNqMZ9GMw0Y&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COLeahCC2XQYwefQxwEwAQ&v=APEucNX-9nKWAY3CwC6bNPt3LQED-8PKbkX6fMrn-cphBdLpGFaggKF1OtOd8emmz8lcB-_1P265sW7SsUlG3-BQxvQMGZ14aU53U93ob4S6dR-1pUYx6WiUehJ-pyV8wnPrYFQmUJcTbg2StbLyKNXxtePm2uFHB-EqPdA7bDs2vUjqtg07QKnKxiPIBtFycmXjVGXPuS2MGq-GMULh2bQrUfe--dyZeg
Protocol
HTTP/1.1
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:29 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
0ae2eaaa-be36-43d0-b199-57f33d673994
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ib.adnxs.com/setuid?entity=101&code=CAESEFSwawj46kXoFNqMZ9GMw0Y&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
290
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame C595
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjY4NjI5ODIxNDQxNjY1NTY0Nw%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjY4NjI5ODIxNDQxNjY1NTY0Nw%3D%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COLeahCC2XQYwefQxwEwAQ&v=APEucNX-9nKWAY3CwC6bNPt3LQED-8PKbkX6fMrn-cphBdLpGFaggKF1OtOd8emmz8lcB-_1P265sW7SsUlG3-BQxvQMGZ14aU53U93ob4S6dR-1pUYx6WiUehJ-pyV8wnPrYFQmUJcTbg2StbLyKNXxtePm2uFHB-EqPdA7bDs2vUjqtg07QKnKxiPIBtFycmXjVGXPuS2MGq-GMULh2bQrUfe--dyZeg
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:29 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
c98d6c94-8445-493a-ab56-4cc3b8861f10
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjY4NjI5ODIxNDQxNjY1NTY0Nw%3D%3D
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ptrack
a.audrte.com/ Frame DB54 		368 B
880 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://a.audrte.com/ptrack?arlocation=146.70.117.69&p=M1353665098&artime=2022-04-14T15:54:29.196Z&arlocation=YWRzLnVzLmUtcGxhbm5pbmcubmV0L3VzcGQvMT9jdD0xJmR1PWh0dHBzJTNBJTJGJTJGcHJlYmlkc2VydmVyLnBpeGZ1dHVyZS5jb20lM0E4MDAwJTJGc2V0dWlkJTNGYmlkZGVyJTNEZXBsYW5uaW5nJTI2Z2RwciUzRCUyNmdkcHJfY29uc2VudCUzRCUyNmYlM0RiJTI2dWlkJTNEJTI0VUlE&gdpr=0&gdpr_consent=null&gdpr_version=1&arreferer=c2VjdXJpdHlhZmZhaXJzLmNvLw==
Requested by
Host: a.audrte.com
URL: https://a.audrte.com/ptag?p=M1353665098
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.202.74.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-202-74-122.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
b430117fc32b796c3a4b44a210347355bcfc05c84386d6816ca983f7fbb33c7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.us.e-planning.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date
Thu, 14 Apr 2022 15:54:29 GMT
Content-Encoding
gzip
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
text/plain;charset=UTF-8
Access-Control-Allow-Origin
https://ads.us.e-planning.net
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
263
html_inpage_rendering_lib_200_275.js
s0.2mdn.net/879366/ Frame 7A4F 		169 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Origin
https://googleads.g.doubleclick.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 11:47:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
14848
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
60173
x-xss-protection
0
last-modified
Mon, 27 Sep 2021 18:44:51 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 15 Apr 2022 11:47:01 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20220412/r20110914/elements/html/ Frame 7A4F 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20220412/r20110914/elements/html/omrhp.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CY130-Un4CxVJtPNtVZVZUM_om0lKYNnF5nviLAkaL0KvTy8xoa8kmVnnX8Z3YnB13dyxoEouUJGYddQMKJQmSHFAmUmLBloPgc-D-XrPL_bfwrhDEiMikehF88lvM7lT4KnkmgPmYAS_aLQzxASSQhEjBYA&dbm_d=AKAmf-BaqjmgF2KENvBk1PM8g-Re9ScSbaZJ0gNuRkcI9z18qrwdH1U2FDnC73jRPp1PIpyMHVtc2h_EQjc1GrXJaxER75KmPkGKYP6Ga-V2MzbFdgjSG6FFJmo-mg9SEZLJ6FPgzzhRjvTbYpWLN2hXASe_gwrkF_UbYB3RCqRSQifdWi9_4JVvCJHQRywhJW_r8MhgXmpNlYHfY-Dr9rl8bm2Y0bRb2H5VJnFZwZ6TaOP_7jRGaszd7g3YQgXSwbY-s-8m49eLn3HrPQALYS4KmuQj4lkHjTrQc3f3MiVCGAWzuYlKFGwrYxhZrQwQ02B5Y2CsIGqFi3XdKImkq9XYwsKV5X95LYityBIDAUX76aubr--r7itMSEzc3xjx_O8kfEGA7roCDaNXffcez-gs-l3pB8_dx8i-TSWK9mLUiZ_FDXaqjwLRq7gGMwnsIpf-rz5_RK-i2uy1XmkSf79k4n5DBYVxGojRAIBfAgFDscDC2DEosPNnps0cQ1UlYUGP0yN_zzGMR5cVPcuvLQiKf2ZbDTKt9ye2LTptDOlGiqi0A6Wk17DH7gnj7ywU3Z4Wnp7NFH66nwcoiQFRQi7rSjtK_hBIR3b4ZaF2xb7niMSZLpktjeJ1cp3Fog8wN4X6Wrc-tpI_vhyMqRivbag2p083wgJ9pd1shI2oBDnXx4WoY-VWzK4rdfCGIv3XRPfO8QotXzbn-47zw18EIIRP04Gqc6ZSd1lULS89Lso1fO1IIZyDufdDEmxPSVJoONenR72LwyeTiP-ZGULUegbyST3e_OW2DgXfR5HdMD2JIpU9jU738LIw48opF8U3sOiLgAmEsNreeIXgiTeSvEllhphwk4_kGLHs7mSXVvoncOl-Lh-UPhAl3nezwq3gi3HlGEZ6Yaf4_ZGewn09XQ7ge6C3L1hCCawzJlSpSCkVu2p5iQmQ3PcrXPvbnlSAVT6T8069wQqVYZbB5ym8VJEf0br7L4cWxtnrVSd_TFbMAjtJg29FLfYWxecAvGPI7ZZEThUBOuZzbVzkNnosW-haPrh4XZlEV75KsEfH_kVEWWLEnBkT_VEfCrJg0s25aISOBEi84Z0G1z2-MeDWjMW5DMiH1m4-PVvxCysdJ4xbLdg8CD4mBaay8sS8NEo0wfg3WV7JbtmotkuVFQBMnYAOrZ6na_1OI0_CPHKpECsZshtb_g56GEVI5W8LWAnZrxfRdP5a7CvREPBcTY-rr1oKAAzgZxuHLLdrPDeTdNTc9ekh_LNeIAH0rpiPWCu0sHJD2rx-GEO8Ra_nrODXnt0hENi0nJRdrhRRteObVcII3o74oEmcTqYuAjTXq3JUT9sek-19EI3AYBz80tj1tJ8z2se65gavSaGDJ5ArzjtcmWEvdtB7GNwupyhlVO6-1_mAUlC3YYq3g6jSMC24b5ta5GOt_t5q9Exv3_imMi4__VebSHpAJtUuz8_Uiov5i2ofumZN0RFLyDmPAaf8-y1HlyD5h94iknCf5yMS2qlsN7wxFN8bIpLowvGmEedUil8BimCLVYX__rk1YEfmhoMaLFkHSr55pEOUIxbaY7AaR3rAxBGV9SywWW07LyyJ5coPRuMy8fE4eo0kt2uEfpbGi4RailKzsqh_PvBiJ5wH8bs9mySa-UXK5UjXwsn7p1OYnThRw839qVIGyKI7fzliFKegncrhRqdbHveZUCSBczRymPuVe43O0zcTkFhniI0wV23-HE23kX9K3LFksEbhEQgvvYG7yC-HRCsBpkwyBPYlwfUyEw8IEnujxj1TNKn5fRfmpwj-zDXtLRz1vK9Q1rzVw_I_TuvICZeAmCMm8rXED1fZ6dSIzpCwvmbV5cTzFg3DlizmtkZgqOEqRl1oaZ5souC54tToOafWmr24YL97JTxTtGGA4KtOnPpAaMqTk2aQfOaYtd9MG4-_kPGfx6LugMWjcfKIG0TrhxR762hw7CcTXGA6NKtnIMgRDOf0XHXJsxdUYsyLK7uGLv4lfCGXWj9A_pO9zz2YyD8Pff16eYe0tZqTHbe2Nc2L3XAgCrP-yII_N1NbSfPiuXcD7_96bWVhh7lPLHjTYfD-vhuaLV-edYlLfm7u8Y4-657uS6iA0qwb55nQBG3mGIYyDio422YIQyYCMKkFQj7NCwZaCCdnGsUAeEi1As3aobnepQQqWixvFEVaioT88mZoIaGZn5Cur9Z12V3dFlCdp5FEsRpQ-p4He_sljdmf9C8zESSYFDst06MXS_CDLADPfNWEi1HXcVGI35GOdkMGo7BZdYDN7ZaKIR7o0r9DSQOWbT7PFlk3tmN4WI7PxZpTZ4jVGTANhdGnf7Fmufhed9exQDXBcooDgj1DxnrhMINwYleyqJGfsWAtQnOjXvxirbrj_QZTPDH9F-oC0gxWqm_pF4xcbbQ4iUV9JoPR2DFLYZqsE5jNVj8rWeVd97T9qqZ4rSvSScFLT9dntzNa14ncttlVqiq6UK1F7A_y4pVGxSzMbloD67DjZbi8BbT1fhZKSbl_DE6H74U1jCXxKanXz0YsKGJJBZ5PgRe5FNEXiAbIKrdGDULM25V-VRuOllAZVi2XB4C8EwoAXCwZv-ycC6XU1PTnHGTU9xyYAzN7yfOmoCUgSljKdxl4Y4xUYCwy20cxqY1o2I0M2lv9o2vJ2ZaBKZpjXnV8foErT25Ylij41wJOw7nbLVYXpL1Mm3Q-JF9kHKAQ-WRHCsqhxeA_6IpGAdolhTc8BFmHWh-jV3MzbusXv1HAmtKfFKi5ARah8QaZFgK3RIFZbnWT4zap1PatIa0UBbFJCD6lDRb_JrtrCXzPCO8c0y9NMBSdlao7lHHsLBSlRxNu3wFrCFzlwvAkxIuMeZixWmYdPdedbHNibLKVPC3Urhf2cWU0wut79hVX9iN8Z3BCqDFarNWJ4EdOINeZRvK2QJSkKG5BPRP_e3R7aJ-hMByvzsTdyzEJabUIfW-VcxNjeJ8CykMj4IFFDErhGfotq9xPXaWetQSFZArPyFSb0EsQlfqpdFSgsRnQQ4I08JCAwxA2TdI2OKlxJk3ENKd__9BlI6fjcJamQedllL82q-iui2e9QEt_X7aT3Gzu37CxYW-5bxFPRyz7g4QrcyO94ZsMGnXj-Wjk8dYDy8UQfPN_JB3HYA8N95FujfKTUKZoawMNREekUKkhVGL-9DjlS7AWKXI_uV9i2aHvkuxvs6HMLN46TkArHAVvccP82yTvpnzy1HF5ie59NJo&cid=CAASEuRoLv-GyL05TVBaCUCDxb5UAg&rfl=2%2Chttps%253A%252F%252Fsecurityaffairs.co%242%2Chttps%253A%252F%252Fsecurityaffairs.co%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:47:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
442
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3159
x-xss-protection
0
server
cafe
etag
1394524276809619753
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 28 Apr 2022 15:47:07 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20220412/r20110914/ Frame 7A4F 		25 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20220412/r20110914/abg_lite.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CY130-Un4CxVJtPNtVZVZUM_om0lKYNnF5nviLAkaL0KvTy8xoa8kmVnnX8Z3YnB13dyxoEouUJGYddQMKJQmSHFAmUmLBloPgc-D-XrPL_bfwrhDEiMikehF88lvM7lT4KnkmgPmYAS_aLQzxASSQhEjBYA&dbm_d=AKAmf-BaqjmgF2KENvBk1PM8g-Re9ScSbaZJ0gNuRkcI9z18qrwdH1U2FDnC73jRPp1PIpyMHVtc2h_EQjc1GrXJaxER75KmPkGKYP6Ga-V2MzbFdgjSG6FFJmo-mg9SEZLJ6FPgzzhRjvTbYpWLN2hXASe_gwrkF_UbYB3RCqRSQifdWi9_4JVvCJHQRywhJW_r8MhgXmpNlYHfY-Dr9rl8bm2Y0bRb2H5VJnFZwZ6TaOP_7jRGaszd7g3YQgXSwbY-s-8m49eLn3HrPQALYS4KmuQj4lkHjTrQc3f3MiVCGAWzuYlKFGwrYxhZrQwQ02B5Y2CsIGqFi3XdKImkq9XYwsKV5X95LYityBIDAUX76aubr--r7itMSEzc3xjx_O8kfEGA7roCDaNXffcez-gs-l3pB8_dx8i-TSWK9mLUiZ_FDXaqjwLRq7gGMwnsIpf-rz5_RK-i2uy1XmkSf79k4n5DBYVxGojRAIBfAgFDscDC2DEosPNnps0cQ1UlYUGP0yN_zzGMR5cVPcuvLQiKf2ZbDTKt9ye2LTptDOlGiqi0A6Wk17DH7gnj7ywU3Z4Wnp7NFH66nwcoiQFRQi7rSjtK_hBIR3b4ZaF2xb7niMSZLpktjeJ1cp3Fog8wN4X6Wrc-tpI_vhyMqRivbag2p083wgJ9pd1shI2oBDnXx4WoY-VWzK4rdfCGIv3XRPfO8QotXzbn-47zw18EIIRP04Gqc6ZSd1lULS89Lso1fO1IIZyDufdDEmxPSVJoONenR72LwyeTiP-ZGULUegbyST3e_OW2DgXfR5HdMD2JIpU9jU738LIw48opF8U3sOiLgAmEsNreeIXgiTeSvEllhphwk4_kGLHs7mSXVvoncOl-Lh-UPhAl3nezwq3gi3HlGEZ6Yaf4_ZGewn09XQ7ge6C3L1hCCawzJlSpSCkVu2p5iQmQ3PcrXPvbnlSAVT6T8069wQqVYZbB5ym8VJEf0br7L4cWxtnrVSd_TFbMAjtJg29FLfYWxecAvGPI7ZZEThUBOuZzbVzkNnosW-haPrh4XZlEV75KsEfH_kVEWWLEnBkT_VEfCrJg0s25aISOBEi84Z0G1z2-MeDWjMW5DMiH1m4-PVvxCysdJ4xbLdg8CD4mBaay8sS8NEo0wfg3WV7JbtmotkuVFQBMnYAOrZ6na_1OI0_CPHKpECsZshtb_g56GEVI5W8LWAnZrxfRdP5a7CvREPBcTY-rr1oKAAzgZxuHLLdrPDeTdNTc9ekh_LNeIAH0rpiPWCu0sHJD2rx-GEO8Ra_nrODXnt0hENi0nJRdrhRRteObVcII3o74oEmcTqYuAjTXq3JUT9sek-19EI3AYBz80tj1tJ8z2se65gavSaGDJ5ArzjtcmWEvdtB7GNwupyhlVO6-1_mAUlC3YYq3g6jSMC24b5ta5GOt_t5q9Exv3_imMi4__VebSHpAJtUuz8_Uiov5i2ofumZN0RFLyDmPAaf8-y1HlyD5h94iknCf5yMS2qlsN7wxFN8bIpLowvGmEedUil8BimCLVYX__rk1YEfmhoMaLFkHSr55pEOUIxbaY7AaR3rAxBGV9SywWW07LyyJ5coPRuMy8fE4eo0kt2uEfpbGi4RailKzsqh_PvBiJ5wH8bs9mySa-UXK5UjXwsn7p1OYnThRw839qVIGyKI7fzliFKegncrhRqdbHveZUCSBczRymPuVe43O0zcTkFhniI0wV23-HE23kX9K3LFksEbhEQgvvYG7yC-HRCsBpkwyBPYlwfUyEw8IEnujxj1TNKn5fRfmpwj-zDXtLRz1vK9Q1rzVw_I_TuvICZeAmCMm8rXED1fZ6dSIzpCwvmbV5cTzFg3DlizmtkZgqOEqRl1oaZ5souC54tToOafWmr24YL97JTxTtGGA4KtOnPpAaMqTk2aQfOaYtd9MG4-_kPGfx6LugMWjcfKIG0TrhxR762hw7CcTXGA6NKtnIMgRDOf0XHXJsxdUYsyLK7uGLv4lfCGXWj9A_pO9zz2YyD8Pff16eYe0tZqTHbe2Nc2L3XAgCrP-yII_N1NbSfPiuXcD7_96bWVhh7lPLHjTYfD-vhuaLV-edYlLfm7u8Y4-657uS6iA0qwb55nQBG3mGIYyDio422YIQyYCMKkFQj7NCwZaCCdnGsUAeEi1As3aobnepQQqWixvFEVaioT88mZoIaGZn5Cur9Z12V3dFlCdp5FEsRpQ-p4He_sljdmf9C8zESSYFDst06MXS_CDLADPfNWEi1HXcVGI35GOdkMGo7BZdYDN7ZaKIR7o0r9DSQOWbT7PFlk3tmN4WI7PxZpTZ4jVGTANhdGnf7Fmufhed9exQDXBcooDgj1DxnrhMINwYleyqJGfsWAtQnOjXvxirbrj_QZTPDH9F-oC0gxWqm_pF4xcbbQ4iUV9JoPR2DFLYZqsE5jNVj8rWeVd97T9qqZ4rSvSScFLT9dntzNa14ncttlVqiq6UK1F7A_y4pVGxSzMbloD67DjZbi8BbT1fhZKSbl_DE6H74U1jCXxKanXz0YsKGJJBZ5PgRe5FNEXiAbIKrdGDULM25V-VRuOllAZVi2XB4C8EwoAXCwZv-ycC6XU1PTnHGTU9xyYAzN7yfOmoCUgSljKdxl4Y4xUYCwy20cxqY1o2I0M2lv9o2vJ2ZaBKZpjXnV8foErT25Ylij41wJOw7nbLVYXpL1Mm3Q-JF9kHKAQ-WRHCsqhxeA_6IpGAdolhTc8BFmHWh-jV3MzbusXv1HAmtKfFKi5ARah8QaZFgK3RIFZbnWT4zap1PatIa0UBbFJCD6lDRb_JrtrCXzPCO8c0y9NMBSdlao7lHHsLBSlRxNu3wFrCFzlwvAkxIuMeZixWmYdPdedbHNibLKVPC3Urhf2cWU0wut79hVX9iN8Z3BCqDFarNWJ4EdOINeZRvK2QJSkKG5BPRP_e3R7aJ-hMByvzsTdyzEJabUIfW-VcxNjeJ8CykMj4IFFDErhGfotq9xPXaWetQSFZArPyFSb0EsQlfqpdFSgsRnQQ4I08JCAwxA2TdI2OKlxJk3ENKd__9BlI6fjcJamQedllL82q-iui2e9QEt_X7aT3Gzu37CxYW-5bxFPRyz7g4QrcyO94ZsMGnXj-Wjk8dYDy8UQfPN_JB3HYA8N95FujfKTUKZoawMNREekUKkhVGL-9DjlS7AWKXI_uV9i2aHvkuxvs6HMLN46TkArHAVvccP82yTvpnzy1HF5ie59NJo&cid=CAASEuRoLv-GyL05TVBaCUCDxb5UAg&rfl=2%2Chttps%253A%252F%252Fsecurityaffairs.co%242%2Chttps%253A%252F%252Fsecurityaffairs.co%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e66bfceb15a6ee125dff79826be02a07b766843e6c660edf55ec0c22d1a407c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:50:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
214
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9777
x-xss-protection
0
server
cafe
etag
12512753850102923420
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 28 Apr 2022 15:50:55 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 7A4F 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 13 Apr 2022 07:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
115768
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 13 Apr 2023 07:45:01 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame F3F6 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
8897
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
724
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 13:26:12 GMT
etag
48472445140208031
expires
Fri, 15 Apr 2022 13:26:12 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 7A4F 		220 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
25dbbfdbfd055e7d51020184ca78a9b0077bf6735ab3c8a765d38fc31e288cfb

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type
image/png
gen_204
pagead2.googlesyndication.com/pagead/ Frame 8073 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BX993Q83qhf0EmnEhr7XJ81q5J3oBCDrIZtZPyPJApLegg-J0M4LIVDmtjOFsrtxitmVp4ybbxs994LREt5mMUtr0CGukwas-6fGKInsgLv-EawQ4
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adition.js
imagesrv.adition.com/js/ Frame 8073 		32 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://imagesrv.adition.com/js/adition.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
imagesrv.adition.com
Software
/
Resource Hash
70e0a3b2c82384039a2e4b31c305c9ef1f72a59b585acad421c54a6101a25237

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
br
last-modified
Thu, 21 Oct 2021 06:32:42 GMT
etag
"4043560335-br"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
8355
js
ad9.adfarm1.adition.com/ Frame 8073 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad9.adfarm1.adition.com/js?wp_id=4734816&gdpr=&gdpr_consent=&kid=5204563&clickurl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCGpoCtENYYvKuLOKKrr4Pq_a2qAmO05bQafD89s_QD8CNtwEQASCjh5YeYJXikIKgB6ABxsGCxCjIAQmpAiZpx6wPULI-qAMBqgTsAU_QAIrgSkG-i4GpuxBCJGPXSoTpEahQJe1895PeAb4eL3T4I154uiNL3p_yZ4k-21-INhU1sv56exXgPLuTPR-j4DVa7CObqyo0rbtHxcPYeOH7zTqpX6-CsmMErmWohXFQPfUqZYqU-SO6OLoGutt8lCu9rFXKW3mys1RXM6gnojt2WRC2-Yy2TRjcvUrSSlrNmYPp6jD7bihNxKiI4STUxx8cdNmIneui-4UJgg4f0vmJEl5WYVyIC1XwhC0XUean9kl7lS9CKNAmz0tkk7VGQ9DFjiVaQbIQBRrRBZYmPplCSsw8yqxiWJNAwATbifrN9wPgBAOQBgGgBk2AB8b50qMDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgdgAoDmAsByAsBgAwBsBO48-oOyBOV8ebfA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRoLZ7iKi4cD-qcZbXnuU_CLw%26sig%3DAOD64_0goE2PfxwGddWBEmDO-OeGR8FaKA%26client%3Dca-pub-1575911585432548%26dbm_c%3DAKAmf-AfzOj-b9jyMkB_XRJzyEEzvwkHlJGIjkzt4XEhyTlIiud1FtkSERLaRUxsnyPXYQt3PpipSKKThIqaSrKmiuRqMWXuNkJi48K4glAHSrmRqm4n9lnSxJtgbp14u4nUhRQMJWqzwglYdgcM7hzEAQVRAxOBbg%26cry%3D1%26dbm_d%3DAKAmf-D6bV50501vbx1dctzMZfNUvk-v01d63SG5kDyGrsMCkd1PzHGaPn75xNjV4Cu3XhwUH-lMTLwPBSNKXjV7eBsBA7W9TLUTxDY8SujS_eaHkEGsJVv_9o0TQd6XrjienRXhyPVLM4MlMzzkSuAOiiXUKkA9YFV6earyVhjmsNsgBUqr_Ndm06zwcNY0YMbnrsXwy0AbcAKV3HuoCz-OZ45zqWM-6iE08hn9Nu2r0-bEABItKhRi1-x-cshVebilx8mrf_M5s234rFCUitI3hAPow2MxmSFISSz_lhHWf8VJhE8eYqbHhzEN2VwjdbqU8e0VZxQeZ2q0Du6KGMno_K4hnxdNl3H3vYGes4csWKSoEhlUwGWJjp6uKPmYxNHbAa8nJq0Zn_rM6B1Wp9XsXiZ10IC-ZQza4EN92yIjqwfaWsV2xpyEa0MO3DYDg8evxlOEJdxjdD3pG3OqNLenz7WSVF-d7SptZRnals4Y_1RjAsGlcoDtlbFTpmY7ACR1YKkiXc87sjCmbHwTkO08fDGbPefJ5gEz5XIqfYJWgq3xiGzOJJwblCDT1Sx6IoIxLorB6ICc%26adurl%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.114.159.98 Rheinfelden, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
ad9.adfarm1.adition.com
Software
ADITIONSERVER v1.0 /
Resource Hash
a4e60e9fb30c58f35c5c0e0b28f06dce9d8236c36f16459d132c5c38e7c93ec3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 17:54:29 +0200
content-encoding
gzip
content-type
application/x-javascript
server
ADITIONSERVER v1.0
cache-control
max-age=600
p3p
policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
expires
Sat, 01 Jan 2000 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220412/r20110914/client/ Frame 8073 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220412/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:52:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
101
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1359
x-xss-protection
0
server
cafe
etag
1484984001845508991
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 28 Apr 2022 15:52:48 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 8073 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5c76c5cdd769bc7a048c8f65c56a7000adb29c8472d36eb4514af572a5ec5f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36908
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1649677559247379"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 14 Apr 2022 15:54:29 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220412/r20110914/client/ Frame 8073 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220412/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:47:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
432
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6409
x-xss-protection
0
server
cafe
etag
15284592792851369840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 28 Apr 2022 15:47:17 GMT
l
www.google.com/ads/measurement/ Frame 8073 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQjB4i4RxXODAZC_dHFjzI7bjN6KyV66oaypwlnU8Dy4gSGT7s9j4m3NvFurwQULfbF23iUj07eRmPOfcd6Q-3vIw3jfg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers
index.html
s0.2mdn.net/sadbundle/10934090805236727808/ Frame EAC3 		4 KB
684 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3b4af015f4ab769d60447d9facdb83641074caeef9dff290c637515c55d4641b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
656
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:54:29 GMT
expires
Fri, 14 Apr 2023 15:54:29 GMT
last-modified
Thu, 22 Jul 2021 20:45:12 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
view
googleads4.g.doubleclick.net/pcs/ Frame 7A4F 		0
622 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvfT1ktQcCCwwZCordvxUNEPHBOOYcFgr0kiFh0vKpfQexjz7yjjJK50gc-J2Xy_IVkEXcX7JBt28AyVtag_1uhxgqb_eMMZ6jis-oJS7t9x0MmjGy0wxJnPp7GM5DUVs9EQQb-Jn6YJM_yDhODxRxtI22xFXOGzOKeljZkJVbP1MtHxJnwLEt06_ZMs-RPzFwureg9Y0XcWBs6Q6mhvgrqGRB_C9q95oTomuwhMptJ_hal7SKo2SFUxySZD067_G5uKeRBmkNSvX9uU0q5lLkPEU1Qng5dqzSadM8_4uKR5tLrHgFQJNDb6oGZE1qFLniC450GioKYQv5ymndag6YBFZItIlY0xovN6Li5wflQUyiQ_7nF9IsX4ue3lUVDn1SHsuN2wo_HozJrdDdge_tkr8QnAYVneNU5W4APbZaW3X-sUAt2Io76eIG9-G3rmGHhj8-0gF-sECDajOWd0Ao40C9kR_4SPbV_JhvQf6t_H8ZnpnUOoQDIR-SrhwFJin7h4IKlwPNiWP9m_btuTEcncNazlsEFRNvfg1xid9ph_ZqZxtnc5S1Y2NiKHroNnivwOue7LIEwNP1IrOXVUMSMiDgUmYQbCfXdF1ofFWQu1ycHlhLJEkd0QbhmURfwDJL_UIMSgLxbnVCEir7zkdDO0brjK342n8Bo_tsGSCf2t1_PUED2AGYJ1vhTkBnds65PALEcuems6OwjwfHCapewZ1B1fcMIhMUat8sylpDq81GuiNmGHHegWhtyTRetZ_YWwNXwubaaljTSasVSAbEYdiImbkQ_pr88-w52YBfhKv6SytjhGNMSk1eVKFirgNbuCaooXCk9X6AlgIEQ39V8CuKKH43kXImNPxc-zktuoABpavaHoQ6Dc6kfm6cujPINNK9ZRgurFrhplwRi3hunU7FieRvwmm8Lc-mZNBFJddUspC7uJnIaoZqYykSpUnzXXaw0HhoT3syA55OmK2_xzpRWJssh9LF29QRMj_MR4QJh_dM61BvQWtSSTQKGY8amh9cpd41jo7L0MoSiHBIIddwXK2OGjsYwMiYSrmHzXdLfx5VRfhU4dYD1FTwCmC9g-6E4SOuX0YrBcr8ssFbXpipW846iT9Yf8wH9RlKkg3vZBhrOMrWcN8C0qdyh_vqGGYwQ5ASRzKOkMhgPQImkm6CK_O21QrfXWPRSxCbHEVwz3n_ghJXmtbVPpcCWc2N1UsGsBpUyV95sfcdnXu1OjICB38DfxZZioUd7tRRaHDmjpbPzoocQ&sai=AMfl-YSYB3kEXfeDXzv9qdA9dLF2bmqsAvKdJvE15a2ZCg8e79B6V4Zg59eyC7eu5OdOoyMjFv_QqPutWfQuEgTeblUliklrXcjIUu9u_APFl32Igx8f_na-08xRE_IbMlAjwIl_JHQ0S7tFA1JHYld74zXmE0EFLQ0nlUzbunv0Qv38rCrh_Fx5&sig=Cg0ArKJSzPcJ9Yim1E_REAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=90&cbvp=1&cstd=85&cisv=r20220412.95856&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date
Thu, 14 Apr 2022 15:54:29 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
pixel
googleads.g.doubleclick.net/xbbe/ Frame 13F9 		640 B
316 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3NLhD2ksmmAxiSnp_IATAB&v=APEucNW8bzd6fAl1_Ptdpzz_Af_jXiu3vlOnOWQgycctToIzi8iDB9sRlG-S2f-kb2cT979_9_3xk4inrN3elW1sWHs2QwQAFrpZFuM4xri7jHfks-m6Y39ZXxg9dgozhEjM1zJhuCC3eNKoHba75WP3PHIgRBaB56rUFSaVrf760UBgc_pLoqEpay4gMfswFx2dmNQ9ux9eFI96s-XRRyb0Nrij8pVP8w
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
gzip
content-length
295
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:54:29 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ad
googleads.g.doubleclick.net/dbm/ Frame 8073 		14 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BJPLkOycQYQ2561jYwrlg-j5d2W-BZiDbKcn_qvUg-eOKYAZqP-PXzGQtpNUOyMmRi6OfSHirSyRgpKE__QiAX8JThlre6SvKI6qjzljNkfyfse5GE_sn-4SDhM-Z1XQ8bG02vYF5hO_ojrRJqrTmI_O1Hpw&cry=1&dbm_d=AKAmf-DPu7LFbMK-D5MK-jYw-eUW5zyL1K5zu9awlAe-EfQZDVXl27Kgc0S9DH-y58BFtVaftJXYriobTFK7q9x3dmWfJc4IFnQxU7e74eJkAYLj2Z3nqbn8yq7lS8s9wlfojdz5gmhHnvlYmy1Dd-ZudNZFw_cIYr8LCvBLP5cH_bBdZUP0g-QHrmSz9xjwMBZGIBNVP2p0Ex0wJnJ-QufrIpd0cxkGZ4yvk_N0A7ZDwQx_GWiHgxZ2JsewuS-9MDr0uVL596bRsEuwLctn9J_8ac6CmRV-gDT_C6d-7mEUNlgd_B8U0X9dDnb4nd8hXHDoDfQQIeEYHetJOXlaobmcP2zxxXy9bKV13gOX_WhBtHlDsN2lukejnhLdL5nv9Y0HaMmNISzlUgJgwPmjkxf7jutNU1E9frFANZcTGfOyKY_mEczT5AsNVIWZadb954vLd--e4m6AKz3rzNhD4mmsnKI9rwQi9HpIW-v3mdcVa99MmUHuF0f-ZmvfPgwEbcnWJOzKBy0stzDBSFYG7XIafQoRKnaf1EgP3PDbvKbykWa8oumDkIDOjGCeeZhn_6h6_ESJd1rEQ103b80CrRm9FpBo8AzBJWSIP3eHZHexRtMnmYeMri9LeEUEzrw2gNtP3JiJ9TsWXHIM2EnNrpA2xsm-cCQkFN5hDl8tOGg7gHphpi6jZ9JP-NXWetMXkzwoZE0E-LTQHdWom4liVnKSSow6n5CKXNdB9ddj0n5jD4gsqsRN8JKhHX8dGbDjL1baOjXPIVVR-c8wAgbtYLMoPJb4-Kyzsaq7OWNI6JkCyv-e-KwBYLwoMkel_KjO4ecYZmlao2JAAfWE0fyWOvFGDyfV1ULuWrEy_jcn8xjHCCu7sNVNreROMLeUpKyiNEfGg_QZaTaeGQftOLVGvehsD71DO8RKQIYqgrLs5nKZSFyElOmMrfB5P3bxMzZ4i_nY80q7pOs2g1Tv-TN8CiKkXD7BYR5E1O6tAEeSM1dIf-GxJgbyzlO8rAXIcEj209tzDdFxMKY6Que0Eqhq_hAhA-ZNjLW7Bl0kyfhKUTdR7YPhfAmSvzxe9iFfq-ACjNrdXnHvmdL0BRENhzJ-D3cza2QKdEeUNvRQa1sg5Y6U67O3Mi8cBMRQ4lRLLNlRW0gRyRkCAfGtcUO0_X3gkws8MmQIQBJrg6sicx7KcPghAPp108OgKj_7zLVMaVCYcQmMkdhsFkvRoFZdH8Ttv1urWiPjNJupYS0fq3hrSQy0TtuqyJn4xuqqlmTHccSIP_d78G4xDCWSg2dIr5xlf_fbjktedxLKPKSN78cA_Zxb5ip_IDoL_Xw5nNHLHoDXYoHnWOYFENJyfXq1HvRlXr3sl3sbEeVbsk-KInC3uFLS7PNWRT5WrEeQIPSI1_hcG6tgO4ShQBGmMy1UMiPn7E3daZ5GrGyqljXmFEsO_M6DuWez0veFijnvVR88RqT4ADHNTnaamVLMlZ03iFaMeL2j7g02Tu_XvPJ59DzpQMBSoueiNBtAR-_zRhWJjW_jxHtZ9GyQZ9FP8AlvtqJNR48ibaEAK3fC2YkzT7Egof-WcXVYKlgKrKReBov3Ok1mEq3xpy_zkER4iGAGd-a8pqLWy3gFusAH3CrgFEqm62FQrxPeiFhUJy1DFHSoz-X3BZ4GICAqpcEXvpccmq6Y_wVD-Dehyp_ZOVTcNgX7S5zISaxL389CBelXYDvFJbRbyUWK9LTCqx0gmfRC4Le_cv-4HJSG6aXMYfSJU-vcv8kOGZr3TEyRtmkRtIzLtzB7igdnVDB5p7KvQv2uexHZ7ZHZXs7utOQ3siDjUBrGOF3tBaNv5HV_swQBtZ8On11xZixiLgVWNXWFLx-rdp2dxe4pGs3lZ88l8wZjjXLGZG3ImxSuqF9-RLTbidMtly92Uy15zvzRsAw_A37JoxR9JwJ4RsP2s5jrcoM9Qg7POUpRwRpwIDgqKbaorUrS3tQvWq_fYA2Lgqie9IgKdEvSzpo7D4k747g-jezZWLV7YHIoZqo-qomPYjyHmdcE4SYEr9TNjn9uljQ4TB36x6ev0jzV2qWry0KC6dEvAvL4bKf6qEyW0z9s7GMP0XoygvM2swUwQGLOfVU9edSRX8Q0PbPwUgkaz7X34a6XeGG4Vw9hsMenYb0ghJzq1NeinRnL8O8OHrB4eO69KZd0KyDDeh-FYGb0wML15-TXp8XQt1WTnJ7z4NN6Jh_z4-43cky0XKNLKosIhyLZCPg9ECK9R_V3oOBstb4SOJdqEvQUughv7YJKvXmUFV0G8U5ERq30gCwiuLeGIx07EXwdMFoY5v0BDIHc89838oU3kRILsT5AmZp9WVCh2CBomUmS7nGQIeXF0jVETu8DE9U-WnESxcEmsKnUkRtS9V6Lq8d6m1Q8WbgZjv_JZbrwsXxR5c8mUHY5r03T205dt-OLww1B9XON_dx9Oy0OTa2zER0heLVu2PDBeg-YBIKuJu1S3BL5Qq7_HMOVGQD-vrToEvUAgLibDQUKghazv64FJMop0loKqv2d8lyyyVYmFXLONiuSOKruVDVdk7pOY-IxZK7-oDmiZX7f47KEyuZqU3TJzvkaDKX39f4hw5yTuVNiRfmo4agAsAd_KpK1YvpysS74sCMkabNjC7GxHP6DFrCsEq5OWti5MpITgEYkKMymX8Ud4ANH92SvvcpiIj7YdWjzS7idinkKtusxwhYTGcqOIuLv3OkhbQ41CBPOae0m1BKcuQT8BgbC6CaeaZ5uF06gnTWMNZTBsIm--o80DeGYXZ4L02ZN7vDumOKACyQfc3XRMr281nrs3-dH4oTdbUNx3OeF0LSSbZimVXxn2tSwL4Np2q5JwWhnIADeuHgZwv0uToctrCy4shAk0Ey1i5_k24YyYX5BgBv4sush4NQAZW_gP_Sc4abL2xpBJd2d6EQ-AVcGtfyyllaXbUyMWq0Fj9FRHoOTgldl4v3skFYABJwpjDxvZM72X9bdUw4MwM257PTWJqIE73pHUTojz4INyOiKzEkdhZvHH_SSkdJEGaAsZllEq7OncggwBTVUwOdpU1kjZjzzcHMFH-2cmax4NZHpV15hZ2AKZqKyBtze7zPRjkzttwZB4L7kgsx3KkXV-7ZdnAcQu5WrzAaRGw3zjQMcRUS9buecHQ&cid=CAASEuRoLZ7iKi4cD-qcZbXnuU_CLw&rfl=2%2Chttps%253A%252F%252Fsecurityaffairs.co%242%2Chttps%253A%252F%252Fsecurityaffairs.co%252F%240
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
afd6f92a48c320536a232faebf93847a9471054815e658c972f48b3623fc0569
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10567
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
current
dclk-match.dotomi.com/match/bounce/ Frame F3F6 		0
104 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEJ-qfV6pdqDAoHwmOpPAzNA&google_cver=1&google_push=AYg5qPL3RQK_HawN5C7RUf2I_sKAp_KdcgbJ_5y3q_r_T1shVwincPuBJHOKNUKTkabmHeTc2yvFqDWQfKuBRCz0BJXZ_wFo25TC
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
expires
0
pixel
cm.g.doubleclick.net/ Frame F3F6
Redirect Chain
  • https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESEF6vG4pWAHy5xTn2C6yIc0Y&google_cver=1&google_push=AYg5qPIpSS_BdEjJDi2fWf4PjT6mYGQgFTv3CC605bKf8fj15FSCPNX3fekiWTe5hOB9185rxC-DWuZ45W...
  • https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESEF6vG4pWAHy5xTn2C6yIc0Y&google_cver=1&google_push=AYg5qPIpSS_BdEjJDi2fWf4PjT6mYGQgFTv3CC605bKf8fj15FSCPNX3fekiWTe5hOB9185rxC-DWuZ45W...
  • https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AYg5qPIpSS_BdEjJDi2fWf4PjT6mYGQgFTv3CC605bKf8fj15FSCPNX3fekiWTe5hOB9185rxC-DWuZ45Wl0YmplX7R0h2itxbiU&google_hm=
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AYg5qPIpSS_BdEjJDi2fWf4PjT6mYGQgFTv3CC605bKf8fj15FSCPNX3fekiWTe5hOB9185rxC-DWuZ45Wl0YmplX7R0h2itxbiU&google_hm=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Thu, 14 Apr 2022 15:54:29 GMT
server
nginx
access-control-allow-origin
*
transfer-encoding
chunked
access-control-allow-methods
POST, GET, OPTIONS
p3p
CP="NOI DEV OUR BUS UNI"
location
https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AYg5qPIpSS_BdEjJDi2fWf4PjT6mYGQgFTv3CC605bKf8fj15FSCPNX3fekiWTe5hOB9185rxC-DWuZ45Wl0YmplX7R0h2itxbiU&google_hm=
cache-control
no-cache
content-type
text/html; charset=UTF-8
access-control-allow-headers
Origin
keep-alive
timeout=10
dds
rtb.openx.net/sync/ Frame F3F6 		43 B
351 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds?google_gid=CAESEDTgkdCwKXU7ZRvHKZ_igj0&google_cver=1&google_push=AYg5qPL1OvXXu7q243zloWlU7EjVmh8cs5_OHCZ9muxEoFX7pSzCaVKptT5XSf-dv1EmAC21ipVfqk583RQW-Eu1sUg8KXPQamB1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
vervrd0n6hlaibv3ra2ucl380240js88
sync
dsp.adkernel.com/ Frame F3F6 		42 B
233 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEEygbt3-fp4PvrO4XApdwCI&google_cver=1&google_push=AYg5qPLQpydtKeyzxBFc8f7UpaJf64z7p58xkdgGSBsSlz5c3q1mmFZ4E6ui5Yt5v8aQIFCr3jSkKN7Nytgh9JCb10S2t9p5crM
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
nginx
Age
0
Content-Type
image/gif
Cache-Control
no-store
Connection
keep-alive
Content-Length
42
pixel
cm.g.doubleclick.net/ Frame F3F6
Redirect Chain
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESED5VRJ1HEVPTGpKPl0EVOBE&google_cver=1&google_push=AYg5qPIB9u7jM9CHl5xwMVufx1BlkRV_I8OALUTiQn1Rol59SJX0N6QNwozK3pO8rIg8GwLiPQVFph-di_emlsNcG...
  • https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESED5VRJ1HEVPTGpKPl0EVOBE&google_cver=1&google_push=AYg5qPIB9u7jM9CHl5xwMVufx1BlkRV_I8OALUTiQn1Rol59SJX0N6QNwozK3pO8rIg8GwLiPQVFph-di_emlsNcG...
  • https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIB9u7jM9CHl5xwMVufx1BlkRV_I8OALUTiQn1Rol59SJX0N6QNwozK3pO8rIg8GwLiPQVFph-di_emlsNcGQjOZ1Wmaw19&google_hm=23f4cd250a0c1414891cbf59
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIB9u7jM9CHl5xwMVufx1BlkRV_I8OALUTiQn1Rol59SJX0N6QNwozK3pO8rIg8GwLiPQVFph-di_emlsNcGQjOZ1Wmaw19&google_hm=23f4cd250a0c1414891cbf59
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Thu, 14 Apr 2022 15:54:29 GMT
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Location
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPIB9u7jM9CHl5xwMVufx1BlkRV_I8OALUTiQn1Rol59SJX0N6QNwozK3pO8rIg8GwLiPQVFph-di_emlsNcGQjOZ1Wmaw19&google_hm=23f4cd250a0c1414891cbf59
Access-Control-Allow-Credentials
true
Connection
close
X-Sovrn-Pod
ad_ap4ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
exptsync
ads.yieldmo.com/ Frame F3F6 		0
35 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/exptsync?google_gid=CAESEAlbJRSfOyIz8dul8pWTi5Y&google_cver=1&google_push=AYg5qPKrWTqu5bR9ukmLrqQ618CzN3Wbyo9-SNl7w40uhU0-4LbrgI0kID-Z2MNKKPM3y2Gp2MxvduvqhgBf54HOfcXSMNcCpyI3
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.250.9.127 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-250-9-127.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
attr
cm.g.doubleclick.net/pixel/ Frame F3F6 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K2sH5dE_Lz7CXtSVlU38yAuY3M3ySL7suQ60x8ikn_pq1k2LfvZ932Ya71BoVr3Q
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=Internal_320x50_0.10&adk=468307373&adf=1174745093&pi=t.ma~as.Internal_320x50_0.10&w=320&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668541&bpp=9&bdt=93&idt=126&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=338915792&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=847&biw=1600&bih=1200&isw=320&ish=50&ifk=1513131018&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31067051&oid=2&pvsid=1170057833479159&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.lj7hmau7xerh&fsb=1&xpc=1uuInyKKni&p=https%3A//securityaffairs.co&dtd=137
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
pixel
ps.eyeota.net/ Frame DB54 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ps.eyeota.net/pixel?pid=kh51m51&t=ajs&uid=cmek0bTl2v6RxyJ7Gb4ky-kOA&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.125.70.222 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-125-70-222.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.us.e-planning.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date
Thu, 14 Apr 2022 15:54:29 GMT
Content-Length
1241
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
p
a.audrte.com/ Frame DB54
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=cmek0bTl2v6RxyJ7Gb4ky-kOA&gdpr=0&gdpr_consent=
  • https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&ar_id=cmek0bTl2v6RxyJ7Gb4ky-kOA&gdpr=0&gdpr_consent=&google_gid=CAESENyZkKUiku_t5L1UkLR1r04&google_cver=1
  • https://a.audrte.com/p
68 B
617 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.audrte.com/p
Protocol
HTTP/1.1
Server
34.202.74.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-202-74-122.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.us.e-planning.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
68

Redirect headers

Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
nginx/1.18.0
Access-Control-Allow-Origin
*
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Location
https://a.audrte.com:443/p
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
match
ps.eyeota.net/ Frame DB54
Redirect Chain
  • https://dmp.adform.net/serving/cookie/match/?party=1003&gdpr=0&gdpr_consent=
  • https://a.audrte.com/a?adform_uid=3775857252217606419
  • https://ps.eyeota.net/match?bid=kh51m51&uid=cmek0bTl2v6RxyJ7Gb4ky-kOA&gdpr=0&gdpr_consent=
0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ps.eyeota.net/match?bid=kh51m51&uid=cmek0bTl2v6RxyJ7Gb4ky-kOA&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
3.125.70.222 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-125-70-222.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.us.e-planning.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date
Thu, 14 Apr 2022 15:54:29 GMT
Content-Length
0
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
nginx/1.18.0
Access-Control-Allow-Origin
*
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Location
https://ps.eyeota.net/match?bid=kh51m51&uid=cmek0bTl2v6RxyJ7Gb4ky-kOA&gdpr=0&gdpr_consent=
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 8EB1 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
115768
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 13 Apr 2022 07:45:01 GMT
expires
Thu, 13 Apr 2023 07:45:01 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
gen_204
pagead2.googlesyndication.com/pagead/ Frame EA8A 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B1NjSBN3TNSQLfaD6736XVv_RMZuIPJCmF0RwtcXhq_fdkXJngII6TY3pjVD3bfgi8f0fkWcRcSaci4--nBz6Qwb25c34spwcl1XiNQejMXUZX5-E
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adition.js
imagesrv.adition.com/js/ Frame EA8A 		32 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://imagesrv.adition.com/js/adition.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
imagesrv.adition.com
Software
/
Resource Hash
70e0a3b2c82384039a2e4b31c305c9ef1f72a59b585acad421c54a6101a25237

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
br
last-modified
Thu, 21 Oct 2021 06:32:42 GMT
etag
"4043560335-br"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
8355
js
ad9.adfarm1.adition.com/ Frame EA8A 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad9.adfarm1.adition.com/js?wp_id=4734815&gdpr=&gdpr_consent=&kid=5204563&clickurl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC_r43tENYYpj3LIrBhQaa8q6wCI7TltBpyPz2z9APwI23ARABIKOHlh5gleKQgqAHoAHGwYLEKMgBCakCJmnHrA9Qsj6oAwGqBPABT9DRsDALwfl3S2sfJ2ESNoHI1TePSLLYeS4nfoHRf0rvAH0An9AIBGwDL9qLYgI7Tik9fCVnxPIjkwh7TKCc6CPijTGhqF7Omtfo_yph1VnBMRAvYwt7TZhDOYD4VSVzNNFvhpp8jfCeMNK5WEJeB-KYE9ItBmBzjBZ-WCfiZXUcUaI6yOInzH_RWOVrnhCv5fBG126c3BbofUlCBGDJnSqtkb4D_sUH4k5Z9mnPrQ6SbZ3pmTxfjwj1qluDioH5esrTPtkJ1mhFpeUJTiFLrXAw-y2dY1GHi8DtESRbc3TpVxGkSjQTFwn3jzIXsLC8wATbifrN9wPgBAOQBgGgBk2AB8b50qMDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgdgAoDmAsByAsBgAwBsBO48-oOyBOV8ebfA9ATANgTCogUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRop3Zcof3oH4I_eOaEFraGHg%26sig%3DAOD64_0QuchhyHby5Q6Iw-qgIpyH10uW-g%26client%3Dca-pub-1575911585432548%26dbm_c%3DAKAmf-AFFj1lJZrqlxv0nl0QJIoK8o8OE-QRdtSX6LjAHPqtaV1ozCg80RGD4Oq_B-IH6F6hZutRPcOiUq9pF_Gs49pw9jjE1Tk2fhYfwa1tQrRGGXws3Bw7Cj0XGCbcnuLhQnDqvl08l66DuVrpnCZGJVv_F6DOxA%26cry%3D1%26dbm_d%3DAKAmf-AhQo_4n-WyE8a9YYAkqVnC1SnmZiGAVhHJtE2hRpNR3hOJ7ey51KAceJpwOHgClLhqBcAf3KpSohT_HzdmAlMmXOdZG4Y7jVTGsvYldfjpE653OciqdDUt6n_v2hJgVp5UcpDKnmtYluUwuHwgvbqoxTw57wYZ-btJAILxOBrGZvUuzSYsIyLcvuA5m9ugPfq0CWtwyulR6lEPExaiNpAwvRjWk2kHWoa811ddbbRFgie0vi8ab5Ep7ovb3ZPZreopCT7i2bhT4p9Ax0sola1STIlQfOqse49T-Vqyk70dM7vtNAfaErPzEgkvd1MgsDDO1RgIPYFJrR9rE3TuIBPXQbzv8ZwGJMyHwtJJNlMF5DdSRgT8Ig5nWKUIEkKERhi8oMTkBm6FmJemxYCxiCYYjSKcGBZpt7v6YtuoyImZN7WsqHBsI2ly7-abc9-VXA45ucLhWLV2IOX3SrGzca8HV5xwrGN7cPcMqoCyfj7_iQoFwOvJg5PasgjHlzmHrwnpD30v1UY1SnrtSH6UD7PDcfjiJhtrv9TM9Uk3XaQ_FzZwV4iMZ6O3kYcPg2TAuCm05481%26adurl%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.114.159.98 Rheinfelden, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
ad9.adfarm1.adition.com
Software
ADITIONSERVER v1.0 /
Resource Hash
5da2865ec3d1263ed5684e66ff4fdbf2c05294cca5f13a11bb4f8ea59e5b11b0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 17:54:29 +0200
content-encoding
gzip
content-type
application/x-javascript
server
ADITIONSERVER v1.0
cache-control
max-age=600
p3p
policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
expires
Sat, 01 Jan 2000 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220412/r20110914/client/ Frame EA8A 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220412/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:52:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
101
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1359
x-xss-protection
0
server
cafe
etag
1484984001845508991
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 28 Apr 2022 15:52:48 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame EA8A 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5c76c5cdd769bc7a048c8f65c56a7000adb29c8472d36eb4514af572a5ec5f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36908
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1649677559247379"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 14 Apr 2022 15:54:29 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220412/r20110914/client/ Frame EA8A 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220412/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:47:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
432
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6409
x-xss-protection
0
server
cafe
etag
15284592792851369840
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 28 Apr 2022 15:47:17 GMT
l
www.google.com/ads/measurement/ Frame EA8A 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTEAXx-RoWF3-idO3oQFPH7gFm0O0lxm4OkydTaN8J1i_7-KHiilOSgt18dJGfDNwKpA3UpxMHUnbcrklVyGXYCMePt1w
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers
sd
us-u.openx.net/w/1.0/ Frame 13F9
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMQL3bbNFBkePQwnDza8sic&google_cver=1
0
0
cm
us-u.openx.net/w/1.0/ Frame 13F9 		43 B
131 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3NLhD2ksmmAxiSnp_IATAB&v=APEucNW8bzd6fAl1_Ptdpzz_Af_jXiu3vlOnOWQgycctToIzi8iDB9sRlG-S2f-kb2cT979_9_3xk4inrN3elW1sWHs2QwQAFrpZFuM4xri7jHfks-m6Y39ZXxg9dgozhEjM1zJhuCC3eNKoHba75WP3PHIgRBaB56rUFSaVrf760UBgc_pLoqEpay4gMfswFx2dmNQ9ux9eFI96s-XRRyb0Nrij8pVP8w
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
gzip
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
via
1.1 google
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
56
expires
Mon, 26 Jul 1997 05:00:00 GMT
um
sync.teads.tv/ Frame 13F9
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
  • https://sync.teads.tv/um?eid=3&uid=CAESENePZ4a9Q47cg5RoSMRn3EA&google_cver=1
23 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=3&uid=CAESENePZ4a9Q47cg5RoSMRn3EA&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3NLhD2ksmmAxiSnp_IATAB&v=APEucNW8bzd6fAl1_Ptdpzz_Af_jXiu3vlOnOWQgycctToIzi8iDB9sRlG-S2f-kb2cT979_9_3xk4inrN3elW1sWHs2QwQAFrpZFuM4xri7jHfks-m6Y39ZXxg9dgozhEjM1zJhuCC3eNKoHba75WP3PHIgRBaB56rUFSaVrf760UBgc_pLoqEpay4gMfswFx2dmNQ9ux9eFI96s-XRRyb0Nrij8pVP8w
Protocol
H2
Server
104.92.106.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-106-130.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.7 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
cache-control
max-age=0, no-cache, no-store
expires
Thu, 14 Apr 2022 15:54:29 GMT
server
akka-http/10.2.7
content-length
23
content-type
image/gif

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://sync.teads.tv/um?eid=3&uid=CAESENePZ4a9Q47cg5RoSMRn3EA&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
281
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
um
sync.teads.tv/ Frame 13F9 		23 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3NLhD2ksmmAxiSnp_IATAB&v=APEucNW8bzd6fAl1_Ptdpzz_Af_jXiu3vlOnOWQgycctToIzi8iDB9sRlG-S2f-kb2cT979_9_3xk4inrN3elW1sWHs2QwQAFrpZFuM4xri7jHfks-m6Y39ZXxg9dgozhEjM1zJhuCC3eNKoHba75WP3PHIgRBaB56rUFSaVrf760UBgc_pLoqEpay4gMfswFx2dmNQ9ux9eFI96s-XRRyb0Nrij8pVP8w
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.92.106.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-106-130.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.7 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
cache-control
max-age=0, no-cache, no-store
expires
Thu, 14 Apr 2022 15:54:29 GMT
server
akka-http/10.2.7
content-length
23
content-type
image/gif
pixel
googleads.g.doubleclick.net/xbbe/ Frame 3000 		586 B
315 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3NLhD2ksmmAxi7sp_IATAB&v=APEucNVzW65EzppCRdb10CHLLu-5vg6RtfaF-WACLdp7uclrHFHZyhMFgf2oatJhwBI0Gwo7_8stiJ5SYITOynq9EJTcQ7aYOpAXXhQ-ww2PgI_SXokpy1plDDYVxp-aQzvqDBQr4rZmRkGU1ckS6vWy5diD27ZjkQcwtYxz1Akp-wBxwNN8v6e3YpZA23jUbxCHyDGg_GMkph_-GucSnFSzeAjFiNZ1VQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f12c6133a12eead81c368fe146cb489bdb7331b5e3b5ceb9ea52eac1e3feb815
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
gzip
content-length
294
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:54:29 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ad
googleads.g.doubleclick.net/dbm/ Frame EA8A 		14 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AHBhK6VwclRwu7ROjIGI9by9XLMRozK3AJtUu_JBUvq5o87HXBKLvLDXbaH6X5RIi5t7OOwblE2xuuiLeBxNUKpWk4BVQAt88DkO800E0XVi9isN0YoJ0IkoDDdMbGpYoIL7OipsOXZKlzcmFqvdUt0JwzYw&cry=1&dbm_d=AKAmf-BbRiIkuD-O8oXkmP9NzCxRDutEl3T8ciFz1OK0Hh6_gvqbDp3YsT-UEAT6kP-BNk9yXDsmav080icVz-TFSl8BelvyUUez70rKEMAFZRJp_paWitteQDrUwCothKh-T0lFElczo4TyuN_WmJI5P-3bt0BkaE_SpHlopRtJc83OjRCuCadfKufjMt-Y5XuBhz1VMiNvGAe8lIrP8gJQjVrF0PfE7QjCHpg1uHzkFlKTfHvA7SGR-yzesshepOaIauurVOyT-ZKgFvD54VCIrqUko6sTTGBfBtCjeLd8CPBgsCxa8Hspn_AcDUr-Cy1kYFo-2epzAa-jahwoH-sCOCyONujxQMoMz3TmctzprA182DgaORoNizceyD9_PVXLiI98-qWLuEiFrocJmkmoLSBfVHm5Llr5wZtUb4RLaPN8OBDYUnoCkP9dHLqUbEYeaPMDSEdlrbbN1SAdw3cMbQqJmTy9a2DptlYFayWEX_SZqe-L9bs0QygXceWVrI6jgfdPpdrNzQd8AldfOAL4pybCeV02lglZEB-_8WSsmEYXHD125K38hdP3Wl05Qr34I8UTx7uoIkQKYhyxt-pCIhCzIOu4RAm2_U45z38gwQZNzGak38UhnMhUFKBQTOk9B3jyliaBPUgcCen9sS90dSSCVtmvrgM5tZP-lFOnh_BE2xMDPJhl1t3zpbgDwhHCfxA-4UlOusmDA0_Xitaq1CdMflDZcAKmWjQMyzznl-2maf-3KKpxoT-Wfv4fHSw46Hk8Ss3EvBqtLewxOxXuV_hazQc6lCTXeTxJLFIPVnStFpwf6YQ-Lw_fIILJXcEV3BXXbWHWuKZpvfC1CJf_O9pVHMVK2AmGL-Qy4PU5Gfe8TGioAHBwrrhaKCOhzigV5P407Y-LABkIrGwJ9ZBzr8qi03k9AV4oV7kAGLOqKoZQv3MVwwl_vplRRk6IFuErqtCeqIHRUatlu0hQKtIxdHoPBN3-cJMRUIQ3_tAhXJYagkYszT4Si25CZ-_QwEH3_fXubmLV81bBagb7kbgIY7gneLMiFnmRXgrziI3sWYWT-cnA6IADQKsnmRK33Ymi9uhWbzED2xDEg7XI15D156B_GuKkpn-HepqlSzHAnkAAsM4XWDL9gvAKes2NLUOKZ_Ps_scrFZw3YxSa8X0z2j1O5Dzku-xJFD9g9iLZFQUM3L0WWEerIP_KYd7f3LB9d5iUVmwKl_pzZeJkwQw-kabXgPup0eyNy6hYnn3MjMb7MqVbK8KYR-4aPEon7ebwQEcpCsDrmuRszX_HAWf3ZOJZ4Mq3GzF663xdhbX69fVQRpAgBt0cFK7iundA_p_cVJ4HBmDTNRT-a_h_8tazegGRqwfuKOQML2kpW8qN04bz_dWL6tkzC4wHbZ9s-JfzqosFQp3J7-dCZGavqc5I8kZXw17BFxbZaNuWdZ32RQe3zqb-QUk4lQfFiy_HPJaUBcgCuD45CmFXvX2VHIrTOD2JcWjcXeMd-In5rTL2zto-CKTv2-zVXlnl_-QnJqoN1YtQp04B7lKJuzsSsaNKvV8evRaCUZBLDqI0ezbPYIfkHgkhAhzqDIIDgVMnWo0jm6U2AwVj823VCUhaZf3W5Gq-EAn-17Wc4miYUqz7t7IAv97B0cozF2-iTgPnTaKMYZ67GYyJOvyjUhsJboA2mWeS7VacFLHuLVj3eswQvX8zP5_lMwuX8qcjyg1F_fO2NNmGLiUSnktakGsKiFhAGnZ-dV_fLdpCuEC-nvBWD5YKwmXRHMXPB9pzlKcnyNnFps2h76VPElqjg0hjY1DkGM8_ALgGdvrwPHzmZe5yJv_sgIFmOapudvQdFA8JSfdb9UO2u1sKrs_hv1MNv-SleirlOlP2dzFMgwZHhixzlXfDfIMI8GMytLh-pgJV9iwFSBkD7TvwTY4xRFXdEyl482sL7FQMSIVr7GW_xY2bOAUgmFAlcjH6oIkX0lV1Gost7s-rkTySoYgySGOPeGCKVCSwMGyHfp6TS-PSSBpIGuGDJYc7pVxq6p810DHAFKagrLQhU2J0uDzLg6wxVm2S-Gii5xH35h97U7uvMgvlNMsfq_SiKEGxx8rlFymJARe61FQrkQhQFDWXdCg-Yjq8gtIevdBc_QrqMKyM-m03O6o6DCCOdapBkk_rabh8hOgDCmf9V2R_JPtWWAeHZuA0kiqIpf1Eel7G7i3JmDt4X6LeVu6PN-2W61P50Yo3TLAIxvv42d3yF97k7J0qWje16T2suKplIHIWN4mPliMp-W_nasXomiflC3OyQZkxYWIvjJ6dpuM2pr9sOtZ8M56GMhOZ5xHx4p61BLli0QtyWdN8rssxZnO1zd-197pZJAa-QwfCqRKnH1ZYHQNehSasOtgTT30BvDeVRbEEYAjQwFrJkR3CSwckc-4qqkci3-POi6IRGK9G556sDSPMNXHD-b_5sB1BnUQLOp6ojbIUWq0sKCb2rP39hC9LV8xLnCQ9KrjLjxMVMOH_rnRP4UyAgr40NiNSGLAs-8GAEfOki0bQi4PJWYBp7dDyrVzewVobHcs0tzP4QH515uVvqL-B_VHh7gWV1lEAtIVAjFbFxjgoW5WcqI1q9zhzW2_Jv5ormX1CSl9m8QTwACi7ULrQ4TFacbhVa2jq5SoXxJcqUsNTxjx6wOT_diVW1QEtRyXxRE_WPFeixB3Usl2qQbrwVPCqR-J1ebNN1O4dmMh9y4J8K6zhTF-N6807AvUmDYnuGGJUfFlVwrAX8tr9mkKeOygPd4rW_zN8U3NuL0EUloVKVuw79QtV4ZpFRcxWLAfvlUMMENOo35FBguNj5JKSMej9BPDTUAr5qtSlFybwG4qon5yG7ekZjflrV3ZaGMgL8-4WBuQZhyoGdoxB74dzZb0gURa7_iUBc2ix1dFJmFlm1u6QHktOe8O_AZLaUJEl70HwEPwbQhszrQIHkyZXH4AhDx4RbAw0mR8WQqDfQML2kEkA-zKb3PGCogiYVk4JeJkQsqFd-2pcktViW8JrCGPhMuqOz3btQaJjAe3sXP8EhkGt4DqFNYCBg_jAXybgTvl_XUgfjWDxsA445A1C5lpPtqLa8tJOQy3FRb9HZ4UATGFigfJa_fpNvrRdCgnTOqWLGCv04JGRrvj45WHogK7PwJqkIQAbrRTJwdH97PvLVfDrdoM&cid=CAASEuRop3Zcof3oH4I_eOaEFraGHg&rfl=2%2Chttps%253A%252F%252Fsecurityaffairs.co%242%2Chttps%253A%252F%252Fsecurityaffairs.co%252F%240
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2a5474b7d03487c6e04fb5cccdf5b3122b68e8e20387f44647a40924765d57ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10699
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
style.css
s0.2mdn.net/sadbundle/10934090805236727808/ Frame EAC3 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/10934090805236727808/style.css
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
18d8bc220d04c4dfebd11a051bd96d5d2ecadaee90bf11c815e6463ff12926d6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 13 Apr 2022 03:06:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
132477
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1349
x-xss-protection
0
last-modified
Thu, 22 Jul 2021 20:45:12 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 13 Apr 2023 03:06:32 GMT
Enabler_01_246.js
s0.2mdn.net/879366/ Frame EAC3 		116 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/Enabler_01_246.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b64291fc91dc77833930ffcead244193c5cfd9e882af312ecc89b580160c22a1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 11:23:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
16275
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40237
x-xss-protection
0
last-modified
Wed, 30 Jun 2021 20:54:51 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 15 Apr 2022 11:23:14 GMT
pa.js
s0.2mdn.net/sadbundle/10934090805236727808/ Frame EAC3 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/10934090805236727808/pa.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4b88a304d6162d0e7bc1ea1c3b8c9e9f6b6751002a6d58b6a7bb2c4dd383dea8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Tue, 12 Apr 2022 16:38:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
170181
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1443
x-xss-protection
0
last-modified
Thu, 22 Jul 2021 20:45:12 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 12 Apr 2023 16:38:08 GMT
logic.js
s0.2mdn.net/sadbundle/10934090805236727808/ Frame EAC3 		18 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/10934090805236727808/logic.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8542f7623714f814fce09cf5e24083983b379a792cf44fd760d756a30a864f98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Fri, 08 Apr 2022 07:01:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
550408
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3295
x-xss-protection
0
last-modified
Thu, 22 Jul 2021 20:45:12 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sat, 08 Apr 2023 07:01:01 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 8073 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BJPLkOycQYQ2561jYwrlg-j5d2W-BZiDbKcn_qvUg-eOKYAZqP-PXzGQtpNUOyMmRi6OfSHirSyRgpKE__QiAX8JThlre6SvKI6qjzljNkfyfse5GE_sn-4SDhM-Z1XQ8bG02vYF5hO_ojrRJqrTmI_O1Hpw&cry=1&dbm_d=AKAmf-DPu7LFbMK-D5MK-jYw-eUW5zyL1K5zu9awlAe-EfQZDVXl27Kgc0S9DH-y58BFtVaftJXYriobTFK7q9x3dmWfJc4IFnQxU7e74eJkAYLj2Z3nqbn8yq7lS8s9wlfojdz5gmhHnvlYmy1Dd-ZudNZFw_cIYr8LCvBLP5cH_bBdZUP0g-QHrmSz9xjwMBZGIBNVP2p0Ex0wJnJ-QufrIpd0cxkGZ4yvk_N0A7ZDwQx_GWiHgxZ2JsewuS-9MDr0uVL596bRsEuwLctn9J_8ac6CmRV-gDT_C6d-7mEUNlgd_B8U0X9dDnb4nd8hXHDoDfQQIeEYHetJOXlaobmcP2zxxXy9bKV13gOX_WhBtHlDsN2lukejnhLdL5nv9Y0HaMmNISzlUgJgwPmjkxf7jutNU1E9frFANZcTGfOyKY_mEczT5AsNVIWZadb954vLd--e4m6AKz3rzNhD4mmsnKI9rwQi9HpIW-v3mdcVa99MmUHuF0f-ZmvfPgwEbcnWJOzKBy0stzDBSFYG7XIafQoRKnaf1EgP3PDbvKbykWa8oumDkIDOjGCeeZhn_6h6_ESJd1rEQ103b80CrRm9FpBo8AzBJWSIP3eHZHexRtMnmYeMri9LeEUEzrw2gNtP3JiJ9TsWXHIM2EnNrpA2xsm-cCQkFN5hDl8tOGg7gHphpi6jZ9JP-NXWetMXkzwoZE0E-LTQHdWom4liVnKSSow6n5CKXNdB9ddj0n5jD4gsqsRN8JKhHX8dGbDjL1baOjXPIVVR-c8wAgbtYLMoPJb4-Kyzsaq7OWNI6JkCyv-e-KwBYLwoMkel_KjO4ecYZmlao2JAAfWE0fyWOvFGDyfV1ULuWrEy_jcn8xjHCCu7sNVNreROMLeUpKyiNEfGg_QZaTaeGQftOLVGvehsD71DO8RKQIYqgrLs5nKZSFyElOmMrfB5P3bxMzZ4i_nY80q7pOs2g1Tv-TN8CiKkXD7BYR5E1O6tAEeSM1dIf-GxJgbyzlO8rAXIcEj209tzDdFxMKY6Que0Eqhq_hAhA-ZNjLW7Bl0kyfhKUTdR7YPhfAmSvzxe9iFfq-ACjNrdXnHvmdL0BRENhzJ-D3cza2QKdEeUNvRQa1sg5Y6U67O3Mi8cBMRQ4lRLLNlRW0gRyRkCAfGtcUO0_X3gkws8MmQIQBJrg6sicx7KcPghAPp108OgKj_7zLVMaVCYcQmMkdhsFkvRoFZdH8Ttv1urWiPjNJupYS0fq3hrSQy0TtuqyJn4xuqqlmTHccSIP_d78G4xDCWSg2dIr5xlf_fbjktedxLKPKSN78cA_Zxb5ip_IDoL_Xw5nNHLHoDXYoHnWOYFENJyfXq1HvRlXr3sl3sbEeVbsk-KInC3uFLS7PNWRT5WrEeQIPSI1_hcG6tgO4ShQBGmMy1UMiPn7E3daZ5GrGyqljXmFEsO_M6DuWez0veFijnvVR88RqT4ADHNTnaamVLMlZ03iFaMeL2j7g02Tu_XvPJ59DzpQMBSoueiNBtAR-_zRhWJjW_jxHtZ9GyQZ9FP8AlvtqJNR48ibaEAK3fC2YkzT7Egof-WcXVYKlgKrKReBov3Ok1mEq3xpy_zkER4iGAGd-a8pqLWy3gFusAH3CrgFEqm62FQrxPeiFhUJy1DFHSoz-X3BZ4GICAqpcEXvpccmq6Y_wVD-Dehyp_ZOVTcNgX7S5zISaxL389CBelXYDvFJbRbyUWK9LTCqx0gmfRC4Le_cv-4HJSG6aXMYfSJU-vcv8kOGZr3TEyRtmkRtIzLtzB7igdnVDB5p7KvQv2uexHZ7ZHZXs7utOQ3siDjUBrGOF3tBaNv5HV_swQBtZ8On11xZixiLgVWNXWFLx-rdp2dxe4pGs3lZ88l8wZjjXLGZG3ImxSuqF9-RLTbidMtly92Uy15zvzRsAw_A37JoxR9JwJ4RsP2s5jrcoM9Qg7POUpRwRpwIDgqKbaorUrS3tQvWq_fYA2Lgqie9IgKdEvSzpo7D4k747g-jezZWLV7YHIoZqo-qomPYjyHmdcE4SYEr9TNjn9uljQ4TB36x6ev0jzV2qWry0KC6dEvAvL4bKf6qEyW0z9s7GMP0XoygvM2swUwQGLOfVU9edSRX8Q0PbPwUgkaz7X34a6XeGG4Vw9hsMenYb0ghJzq1NeinRnL8O8OHrB4eO69KZd0KyDDeh-FYGb0wML15-TXp8XQt1WTnJ7z4NN6Jh_z4-43cky0XKNLKosIhyLZCPg9ECK9R_V3oOBstb4SOJdqEvQUughv7YJKvXmUFV0G8U5ERq30gCwiuLeGIx07EXwdMFoY5v0BDIHc89838oU3kRILsT5AmZp9WVCh2CBomUmS7nGQIeXF0jVETu8DE9U-WnESxcEmsKnUkRtS9V6Lq8d6m1Q8WbgZjv_JZbrwsXxR5c8mUHY5r03T205dt-OLww1B9XON_dx9Oy0OTa2zER0heLVu2PDBeg-YBIKuJu1S3BL5Qq7_HMOVGQD-vrToEvUAgLibDQUKghazv64FJMop0loKqv2d8lyyyVYmFXLONiuSOKruVDVdk7pOY-IxZK7-oDmiZX7f47KEyuZqU3TJzvkaDKX39f4hw5yTuVNiRfmo4agAsAd_KpK1YvpysS74sCMkabNjC7GxHP6DFrCsEq5OWti5MpITgEYkKMymX8Ud4ANH92SvvcpiIj7YdWjzS7idinkKtusxwhYTGcqOIuLv3OkhbQ41CBPOae0m1BKcuQT8BgbC6CaeaZ5uF06gnTWMNZTBsIm--o80DeGYXZ4L02ZN7vDumOKACyQfc3XRMr281nrs3-dH4oTdbUNx3OeF0LSSbZimVXxn2tSwL4Np2q5JwWhnIADeuHgZwv0uToctrCy4shAk0Ey1i5_k24YyYX5BgBv4sush4NQAZW_gP_Sc4abL2xpBJd2d6EQ-AVcGtfyyllaXbUyMWq0Fj9FRHoOTgldl4v3skFYABJwpjDxvZM72X9bdUw4MwM257PTWJqIE73pHUTojz4INyOiKzEkdhZvHH_SSkdJEGaAsZllEq7OncggwBTVUwOdpU1kjZjzzcHMFH-2cmax4NZHpV15hZ2AKZqKyBtze7zPRjkzttwZB4L7kgsx3KkXV-7ZdnAcQu5WrzAaRGw3zjQMcRUS9buecHQ&cid=CAASEuRoLZ7iKi4cD-qcZbXnuU_CLw&rfl=2%2Chttps%253A%252F%252Fsecurityaffairs.co%242%2Chttps%253A%252F%252Fsecurityaffairs.co%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 13 Apr 2022 07:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
115768
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 13 Apr 2023 07:45:01 GMT
banner
ad9.adfarm1.adition.com/ Frame 8073 		4 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad9.adfarm1.adition.com/banner?sid=4734816&adjsver=3&fvers=&iframe=1&ref=https%3A//securityaffairs.co/&ro=https%3A//googleads.g.doubleclick.net/pagead/ads%3Fclient%3Dca-pub-1575911585432548%26output%3Dhtml%26h%3D90%26slotname%3DInternal_728x90_0.10%26adk%3D1194620937%26adf%3D1174745092%26pi%3Dt.ma%7Eas.Internal_728x90_0.10%26w%3D728%26lmt%3D1649951668%26url%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F130123%252Fapt%252Frussia-sandworm-targets-energy-facilities-ukraine.html%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1649951668508%26bpp%3D13%26bdt%3D70%26idt%3D99%26shv%3Dr20220412%26mjsv%3Dm202204060102%26ptt%3D5%26saldr%3Dsa%26correlator%3D5488069475642%26frm%3D21%26ife%3D1%26pv%3D2%26ga_vid%3D2002356130.1649951667%26ga_sid%3D1649951669%26ga_hid%3D75734682%26ga_fc%3D1%26nhd%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D320%26ady%3D520%26biw%3D1600%26bih%3D1200%26isw%3D728%26ish%3D90%26ifk%3D1435227353%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C44760475%252C31067052%26oid%3D2%26pvsid%3D3588828389046315%26pem%3D197%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D640%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C90%26vis%3D1%26rsz%3D%257C%257CeE%257C%26abl%3DCS%26pfx%3D0%26fu%3D4%26bc%3D31%26ifi%3D1%26uci%3D1.arv5l61scydw%26fsb%3D1%26xpc%3DHUVeQKcNjK%26p%3Dhttps%253A//securityaffairs.co%26dtd%3D116&uao=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/100.0.4896.75%20Safari/537.36&os=17&browser=11&userid=0&kid=5204563&screen_res=6&wpt=J&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCGpoCtENYYvKuLOKKrr4Pq%5Fa2qAmO05bQafD89s%5FQD8CNtwEQASCjh5YeYJXikIKgB6ABxsGCxCjIAQmpAiZpx6wPULI%2DqAMBqgTsAU%5FQAIrgSkG%2Di4GpuxBCJGPXSoTpEahQJe1895PeAb4eL3T4I154uiNL3p%5FyZ4k%2D21%2DINhU1sv56exXgPLuTPR%2Dj4DVa7CObqyo0rbtHxcPYeOH7zTqpX6%2DCsmMErmWohXFQPfUqZYqU%2DSO6OLoGutt8lCu9rFXKW3mys1RXM6gnojt2WRC2%2DYy2TRjcvUrSSlrNmYPp6jD7bihNxKiI4STUxx8cdNmIneui%2D4UJgg4f0vmJEl5WYVyIC1XwhC0XUean9kl7lS9CKNAmz0tkk7VGQ9DFjiVaQbIQBRrRBZYmPplCSsw8yqxiWJNAwATbifrN9wPgBAOQBgGgBk2AB8b50qMDqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgHpKOxAqgH1ckbqAemvhuoB%5FPRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgdgAoDmAsByAsBgAwBsBO48%2DoOyBOV8ebfA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRoLZ7iKi4cD%2DqcZbXnuU%5FCLw%26sig%3DAOD64%5F0goE2PfxwGddWBEmDO%2DOeGR8FaKA%26client%3Dca%2Dpub%2D1575911585432548%26dbm%5Fc%3DAKAmf%2DAfzOj%2Db9jyMkB%5FXRJzyEEzvwkHlJGIjkzt4XEhyTlIiud1FtkSERLaRUxsnyPXYQt3PpipSKKThIqaSrKmiuRqMWXuNkJi48K4glAHSrmRqm4n9lnSxJtgbp14u4nUhRQMJWqzwglYdgcM7hzEAQVRAxOBbg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DD6bV50501vbx1dctzMZfNUvk%2Dv01d63SG5kDyGrsMCkd1PzHGaPn75xNjV4Cu3XhwUH%2DlMTLwPBSNKXjV7eBsBA7W9TLUTxDY8SujS%5FeaHkEGsJVv%5F9o0TQd6XrjienRXhyPVLM4MlMzzkSuAOiiXUKkA9YFV6earyVhjmsNsgBUqr%5FNdm06zwcNY0YMbnrsXwy0AbcAKV3HuoCz%2DOZ45zqWM%2D6iE08hn9Nu2r0%2DbEABItKhRi1%2Dx%2DcshVebilx8mrf%5FM5s234rFCUitI3hAPow2MxmSFISSz%5FlhHWf8VJhE8eYqbHhzEN2VwjdbqU8e0VZxQeZ2q0Du6KGMno%5FK4hnxdNl3H3vYGes4csWKSoEhlUwGWJjp6uKPmYxNHbAa8nJq0Zn%5FrM6B1Wp9XsXiZ10IC%2DZQza4EN92yIjqwfaWsV2xpyEa0MO3DYDg8evxlOEJdxjdD3pG3OqNLenz7WSVF%2Dd7SptZRnals4Y%5F1RjAsGlcoDtlbFTpmY7ACR1YKkiXc87sjCmbHwTkO08fDGbPefJ5gEz5XIqfYJWgq3xiGzOJJwblCDT1Sx6IoIxLorB6ICc%26adurl%3D
Requested by
Host: ad9.adfarm1.adition.com
URL: https://ad9.adfarm1.adition.com/js?wp_id=4734816&gdpr=&gdpr_consent=&kid=5204563&clickurl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCGpoCtENYYvKuLOKKrr4Pq_a2qAmO05bQafD89s_QD8CNtwEQASCjh5YeYJXikIKgB6ABxsGCxCjIAQmpAiZpx6wPULI-qAMBqgTsAU_QAIrgSkG-i4GpuxBCJGPXSoTpEahQJe1895PeAb4eL3T4I154uiNL3p_yZ4k-21-INhU1sv56exXgPLuTPR-j4DVa7CObqyo0rbtHxcPYeOH7zTqpX6-CsmMErmWohXFQPfUqZYqU-SO6OLoGutt8lCu9rFXKW3mys1RXM6gnojt2WRC2-Yy2TRjcvUrSSlrNmYPp6jD7bihNxKiI4STUxx8cdNmIneui-4UJgg4f0vmJEl5WYVyIC1XwhC0XUean9kl7lS9CKNAmz0tkk7VGQ9DFjiVaQbIQBRrRBZYmPplCSsw8yqxiWJNAwATbifrN9wPgBAOQBgGgBk2AB8b50qMDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgdgAoDmAsByAsBgAwBsBO48-oOyBOV8ebfA9ATANgTCtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRoLZ7iKi4cD-qcZbXnuU_CLw%26sig%3DAOD64_0goE2PfxwGddWBEmDO-OeGR8FaKA%26client%3Dca-pub-1575911585432548%26dbm_c%3DAKAmf-AfzOj-b9jyMkB_XRJzyEEzvwkHlJGIjkzt4XEhyTlIiud1FtkSERLaRUxsnyPXYQt3PpipSKKThIqaSrKmiuRqMWXuNkJi48K4glAHSrmRqm4n9lnSxJtgbp14u4nUhRQMJWqzwglYdgcM7hzEAQVRAxOBbg%26cry%3D1%26dbm_d%3DAKAmf-D6bV50501vbx1dctzMZfNUvk-v01d63SG5kDyGrsMCkd1PzHGaPn75xNjV4Cu3XhwUH-lMTLwPBSNKXjV7eBsBA7W9TLUTxDY8SujS_eaHkEGsJVv_9o0TQd6XrjienRXhyPVLM4MlMzzkSuAOiiXUKkA9YFV6earyVhjmsNsgBUqr_Ndm06zwcNY0YMbnrsXwy0AbcAKV3HuoCz-OZ45zqWM-6iE08hn9Nu2r0-bEABItKhRi1-x-cshVebilx8mrf_M5s234rFCUitI3hAPow2MxmSFISSz_lhHWf8VJhE8eYqbHhzEN2VwjdbqU8e0VZxQeZ2q0Du6KGMno_K4hnxdNl3H3vYGes4csWKSoEhlUwGWJjp6uKPmYxNHbAa8nJq0Zn_rM6B1Wp9XsXiZ10IC-ZQza4EN92yIjqwfaWsV2xpyEa0MO3DYDg8evxlOEJdxjdD3pG3OqNLenz7WSVF-d7SptZRnals4Y_1RjAsGlcoDtlbFTpmY7ACR1YKkiXc87sjCmbHwTkO08fDGbPefJ5gEz5XIqfYJWgq3xiGzOJJwblCDT1Sx6IoIxLorB6ICc%26adurl%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.114.159.98 Rheinfelden, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
ad9.adfarm1.adition.com
Software
ADITIONSERVER v1.0 /
Resource Hash
b259dc3618f6532dde986ca56aa26c19bb67973ddf1231f8bddad563eabaefa9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 17:54:29 +0200
content-encoding
gzip
server
ADITIONSERVER v1.0
p3p
policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
cache-control
no-cache
content-type
text/javascript
expires
Sat, 01 Jan 2000 00:00:00 GMT
jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
pagead2.googlesyndication.com/bg/ Frame 8EB1 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8c2914cd6e0c26e9fe3a9de23853632be1862891bf9bcfdda7053e1995319563
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 12:00:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
14059
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13627
x-xss-protection
0
last-modified
Mon, 11 Apr 2022 15:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 14 Apr 2023 12:00:10 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 721F 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
115768
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 13 Apr 2022 07:45:01 GMT
expires
Thu, 13 Apr 2023 07:45:01 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
partner
sync.search.spotxchange.com/ Frame 3000
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
  • https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEBbwlyNywQsZhVWkB2o8Yic&google_cver=1
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEBbwlyNywQsZhVWkB2o8Yic&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3NLhD2ksmmAxi7sp_IATAB&v=APEucNVzW65EzppCRdb10CHLLu-5vg6RtfaF-WACLdp7uclrHFHZyhMFgf2oatJhwBI0Gwo7_8stiJ5SYITOynq9EJTcQ7aYOpAXXhQ-ww2PgI_SXokpy1plDDYVxp-aQzvqDBQr4rZmRkGU1ckS6vWy5diD27ZjkQcwtYxz1Akp-wBxwNN8v6e3YpZA23jUbxCHyDGg_GMkph_-GucSnFSzeAjFiNZ1VQ
Protocol
HTTP/1.1
Server
185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
20
Connection
keep-alive
Content-Length
43

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEBbwlyNywQsZhVWkB2o8Yic&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
306
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 3000
Redirect Chain
  • https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
  • https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
  • https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MmIxMTBjNjktYmMwYi0xMWVjLTkwMzgtMWJmOWFkOTIwMjA2
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MmIxMTBjNjktYmMwYi0xMWVjLTkwMzgtMWJmOWFkOTIwMjA2
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3NLhD2ksmmAxi7sp_IATAB&v=APEucNVzW65EzppCRdb10CHLLu-5vg6RtfaF-WACLdp7uclrHFHZyhMFgf2oatJhwBI0Gwo7_8stiJ5SYITOynq9EJTcQ7aYOpAXXhQ-ww2PgI_SXokpy1plDDYVxp-aQzvqDBQr4rZmRkGU1ckS6vWy5diD27ZjkQcwtYxz1Akp-wBxwNN8v6e3YpZA23jUbxCHyDGg_GMkph_-GucSnFSzeAjFiNZ1VQ
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
nginx
Location
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MmIxMTBjNjktYmMwYi0xMWVjLTkwMzgtMWJmOWFkOTIwMjA2
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
6
Connection
keep-alive
Content-Length
0
sync
ups.analytics.yahoo.com/ups/55946/ Frame 3000
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_dbm&_origin=1
  • https://pixel.advertising.com/ups/55946/sync?uid=CAESEKfG_fRfBfnitJp1Ep6pXAY&_origin=1&google_cver=1
  • https://ups.analytics.yahoo.com/ups/55946/sync?uid=CAESEKfG_fRfBfnitJp1Ep6pXAY&_origin=1&google_cver=1&apid=UP2a3a52c3-bc0b-11ec-a35c-02f04bb15154
0
18 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/55946/sync?uid=CAESEKfG_fRfBfnitJp1Ep6pXAY&_origin=1&google_cver=1&apid=UP2a3a52c3-bc0b-11ec-a35c-02f04bb15154
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3NLhD2ksmmAxi7sp_IATAB&v=APEucNVzW65EzppCRdb10CHLLu-5vg6RtfaF-WACLdp7uclrHFHZyhMFgf2oatJhwBI0Gwo7_8stiJ5SYITOynq9EJTcQ7aYOpAXXhQ-ww2PgI_SXokpy1plDDYVxp-aQzvqDBQr4rZmRkGU1ckS6vWy5diD27ZjkQcwtYxz1Akp-wBxwNN8v6e3YpZA23jUbxCHyDGg_GMkph_-GucSnFSzeAjFiNZ1VQ
Protocol
H2
Server
18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.46 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
server
ATS/9.1.0.46
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/55946/sync?uid=CAESEKfG_fRfBfnitJp1Ep6pXAY&_origin=1&google_cver=1&apid=UP2a3a52c3-bc0b-11ec-a35c-02f04bb15154
date
Thu, 14 Apr 2022 15:54:29 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
pixel
cm.g.doubleclick.net/ Frame 3000
Redirect Chain
  • https://pixel.advertising.com/ups/55946/sync?_origin=1&redir=true
  • https://ups.analytics.yahoo.com/ups/55946/sync?_origin=1&redir=true&apid=UP2a3a52c3-bc0b-11ec-a35c-02f04bb15154
  • https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_hm=VVAyYTNhNTJjMy1iYzBiLTExZWMtYTM1Yy0wMmYwNGJiMTUxNTQ%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_hm=VVAyYTNhNTJjMy1iYzBiLTExZWMtYTM1Yy0wMmYwNGJiMTUxNTQ%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3NLhD2ksmmAxi7sp_IATAB&v=APEucNVzW65EzppCRdb10CHLLu-5vg6RtfaF-WACLdp7uclrHFHZyhMFgf2oatJhwBI0Gwo7_8stiJ5SYITOynq9EJTcQ7aYOpAXXhQ-ww2PgI_SXokpy1plDDYVxp-aQzvqDBQr4rZmRkGU1ckS6vWy5diD27ZjkQcwtYxz1Akp-wBxwNN8v6e3YpZA23jUbxCHyDGg_GMkph_-GucSnFSzeAjFiNZ1VQ
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_hm=VVAyYTNhNTJjMy1iYzBiLTExZWMtYTM1Yy0wMmYwNGJiMTUxNTQ%3D
date
Thu, 14 Apr 2022 15:54:29 GMT
server
ATS/9.1.0.46
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame EA8A 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AHBhK6VwclRwu7ROjIGI9by9XLMRozK3AJtUu_JBUvq5o87HXBKLvLDXbaH6X5RIi5t7OOwblE2xuuiLeBxNUKpWk4BVQAt88DkO800E0XVi9isN0YoJ0IkoDDdMbGpYoIL7OipsOXZKlzcmFqvdUt0JwzYw&cry=1&dbm_d=AKAmf-BbRiIkuD-O8oXkmP9NzCxRDutEl3T8ciFz1OK0Hh6_gvqbDp3YsT-UEAT6kP-BNk9yXDsmav080icVz-TFSl8BelvyUUez70rKEMAFZRJp_paWitteQDrUwCothKh-T0lFElczo4TyuN_WmJI5P-3bt0BkaE_SpHlopRtJc83OjRCuCadfKufjMt-Y5XuBhz1VMiNvGAe8lIrP8gJQjVrF0PfE7QjCHpg1uHzkFlKTfHvA7SGR-yzesshepOaIauurVOyT-ZKgFvD54VCIrqUko6sTTGBfBtCjeLd8CPBgsCxa8Hspn_AcDUr-Cy1kYFo-2epzAa-jahwoH-sCOCyONujxQMoMz3TmctzprA182DgaORoNizceyD9_PVXLiI98-qWLuEiFrocJmkmoLSBfVHm5Llr5wZtUb4RLaPN8OBDYUnoCkP9dHLqUbEYeaPMDSEdlrbbN1SAdw3cMbQqJmTy9a2DptlYFayWEX_SZqe-L9bs0QygXceWVrI6jgfdPpdrNzQd8AldfOAL4pybCeV02lglZEB-_8WSsmEYXHD125K38hdP3Wl05Qr34I8UTx7uoIkQKYhyxt-pCIhCzIOu4RAm2_U45z38gwQZNzGak38UhnMhUFKBQTOk9B3jyliaBPUgcCen9sS90dSSCVtmvrgM5tZP-lFOnh_BE2xMDPJhl1t3zpbgDwhHCfxA-4UlOusmDA0_Xitaq1CdMflDZcAKmWjQMyzznl-2maf-3KKpxoT-Wfv4fHSw46Hk8Ss3EvBqtLewxOxXuV_hazQc6lCTXeTxJLFIPVnStFpwf6YQ-Lw_fIILJXcEV3BXXbWHWuKZpvfC1CJf_O9pVHMVK2AmGL-Qy4PU5Gfe8TGioAHBwrrhaKCOhzigV5P407Y-LABkIrGwJ9ZBzr8qi03k9AV4oV7kAGLOqKoZQv3MVwwl_vplRRk6IFuErqtCeqIHRUatlu0hQKtIxdHoPBN3-cJMRUIQ3_tAhXJYagkYszT4Si25CZ-_QwEH3_fXubmLV81bBagb7kbgIY7gneLMiFnmRXgrziI3sWYWT-cnA6IADQKsnmRK33Ymi9uhWbzED2xDEg7XI15D156B_GuKkpn-HepqlSzHAnkAAsM4XWDL9gvAKes2NLUOKZ_Ps_scrFZw3YxSa8X0z2j1O5Dzku-xJFD9g9iLZFQUM3L0WWEerIP_KYd7f3LB9d5iUVmwKl_pzZeJkwQw-kabXgPup0eyNy6hYnn3MjMb7MqVbK8KYR-4aPEon7ebwQEcpCsDrmuRszX_HAWf3ZOJZ4Mq3GzF663xdhbX69fVQRpAgBt0cFK7iundA_p_cVJ4HBmDTNRT-a_h_8tazegGRqwfuKOQML2kpW8qN04bz_dWL6tkzC4wHbZ9s-JfzqosFQp3J7-dCZGavqc5I8kZXw17BFxbZaNuWdZ32RQe3zqb-QUk4lQfFiy_HPJaUBcgCuD45CmFXvX2VHIrTOD2JcWjcXeMd-In5rTL2zto-CKTv2-zVXlnl_-QnJqoN1YtQp04B7lKJuzsSsaNKvV8evRaCUZBLDqI0ezbPYIfkHgkhAhzqDIIDgVMnWo0jm6U2AwVj823VCUhaZf3W5Gq-EAn-17Wc4miYUqz7t7IAv97B0cozF2-iTgPnTaKMYZ67GYyJOvyjUhsJboA2mWeS7VacFLHuLVj3eswQvX8zP5_lMwuX8qcjyg1F_fO2NNmGLiUSnktakGsKiFhAGnZ-dV_fLdpCuEC-nvBWD5YKwmXRHMXPB9pzlKcnyNnFps2h76VPElqjg0hjY1DkGM8_ALgGdvrwPHzmZe5yJv_sgIFmOapudvQdFA8JSfdb9UO2u1sKrs_hv1MNv-SleirlOlP2dzFMgwZHhixzlXfDfIMI8GMytLh-pgJV9iwFSBkD7TvwTY4xRFXdEyl482sL7FQMSIVr7GW_xY2bOAUgmFAlcjH6oIkX0lV1Gost7s-rkTySoYgySGOPeGCKVCSwMGyHfp6TS-PSSBpIGuGDJYc7pVxq6p810DHAFKagrLQhU2J0uDzLg6wxVm2S-Gii5xH35h97U7uvMgvlNMsfq_SiKEGxx8rlFymJARe61FQrkQhQFDWXdCg-Yjq8gtIevdBc_QrqMKyM-m03O6o6DCCOdapBkk_rabh8hOgDCmf9V2R_JPtWWAeHZuA0kiqIpf1Eel7G7i3JmDt4X6LeVu6PN-2W61P50Yo3TLAIxvv42d3yF97k7J0qWje16T2suKplIHIWN4mPliMp-W_nasXomiflC3OyQZkxYWIvjJ6dpuM2pr9sOtZ8M56GMhOZ5xHx4p61BLli0QtyWdN8rssxZnO1zd-197pZJAa-QwfCqRKnH1ZYHQNehSasOtgTT30BvDeVRbEEYAjQwFrJkR3CSwckc-4qqkci3-POi6IRGK9G556sDSPMNXHD-b_5sB1BnUQLOp6ojbIUWq0sKCb2rP39hC9LV8xLnCQ9KrjLjxMVMOH_rnRP4UyAgr40NiNSGLAs-8GAEfOki0bQi4PJWYBp7dDyrVzewVobHcs0tzP4QH515uVvqL-B_VHh7gWV1lEAtIVAjFbFxjgoW5WcqI1q9zhzW2_Jv5ormX1CSl9m8QTwACi7ULrQ4TFacbhVa2jq5SoXxJcqUsNTxjx6wOT_diVW1QEtRyXxRE_WPFeixB3Usl2qQbrwVPCqR-J1ebNN1O4dmMh9y4J8K6zhTF-N6807AvUmDYnuGGJUfFlVwrAX8tr9mkKeOygPd4rW_zN8U3NuL0EUloVKVuw79QtV4ZpFRcxWLAfvlUMMENOo35FBguNj5JKSMej9BPDTUAr5qtSlFybwG4qon5yG7ekZjflrV3ZaGMgL8-4WBuQZhyoGdoxB74dzZb0gURa7_iUBc2ix1dFJmFlm1u6QHktOe8O_AZLaUJEl70HwEPwbQhszrQIHkyZXH4AhDx4RbAw0mR8WQqDfQML2kEkA-zKb3PGCogiYVk4JeJkQsqFd-2pcktViW8JrCGPhMuqOz3btQaJjAe3sXP8EhkGt4DqFNYCBg_jAXybgTvl_XUgfjWDxsA445A1C5lpPtqLa8tJOQy3FRb9HZ4UATGFigfJa_fpNvrRdCgnTOqWLGCv04JGRrvj45WHogK7PwJqkIQAbrRTJwdH97PvLVfDrdoM&cid=CAASEuRop3Zcof3oH4I_eOaEFraGHg&rfl=2%2Chttps%253A%252F%252Fsecurityaffairs.co%242%2Chttps%253A%252F%252Fsecurityaffairs.co%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 13 Apr 2022 07:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
115768
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 13 Apr 2023 07:45:01 GMT
000002315573.gif
imagesrv.adition.com/banners/3506/files/00/23/55/35/ Frame 8073 		60 KB
60 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://imagesrv.adition.com/banners/3506/files/00/23/55/35/000002315573.gif
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
imagesrv.adition.com
Software
/
Resource Hash
de573c488ade930ff3bc9391c14bad6229ffcbd7c494eff35945a048efac35a8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 14 Apr 2022 15:54:29 GMT
last-modified
Thu, 14 Apr 2022 06:57:58 GMT
accept-ranges
bytes
etag
"3214689721"
content-length
61240
content-type
image/gif
view
googleads4.g.doubleclick.net/pcs/ Frame 7A4F 		0
26 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvfT1ktQcCCwwZCordvxUNEPHBOOYcFgr0kiFh0vKpfQexjz7yjjJK50gc-J2Xy_IVkEXcX7JBt28AyVtag_1uhxgqb_eMMZ6jis-oJS7t9x0MmjGy0wxJnPp7GM5DUVs9EQQb-Jn6YJM_yDhODxRxtI22xFXOGzOKeljZkJVbP1MtHxJnwLEt06_ZMs-RPzFwureg9Y0XcWBs6Q6mhvgrqGRB_C9q95oTomuwhMptJ_hal7SKo2SFUxySZD067_G5uKeRBmkNSvX9uU0q5lLkPEU1Qng5dqzSadM8_4uKR5tLrHgFQJNDb6oGZE1qFLniC450GioKYQv5ymndag6YBFZItIlY0xovN6Li5wflQUyiQ_7nF9IsX4ue3lUVDn1SHsuN2wo_HozJrdDdge_tkr8QnAYVneNU5W4APbZaW3X-sUAt2Io76eIG9-G3rmGHhj8-0gF-sECDajOWd0Ao40C9kR_4SPbV_JhvQf6t_H8ZnpnUOoQDIR-SrhwFJin7h4IKlwPNiWP9m_btuTEcncNazlsEFRNvfg1xid9ph_ZqZxtnc5S1Y2NiKHroNnivwOue7LIEwNP1IrOXVUMSMiDgUmYQbCfXdF1ofFWQu1ycHlhLJEkd0QbhmURfwDJL_UIMSgLxbnVCEir7zkdDO0brjK342n8Bo_tsGSCf2t1_PUED2AGYJ1vhTkBnds65PALEcuems6OwjwfHCapewZ1B1fcMIhMUat8sylpDq81GuiNmGHHegWhtyTRetZ_YWwNXwubaaljTSasVSAbEYdiImbkQ_pr88-w52YBfhKv6SytjhGNMSk1eVKFirgNbuCaooXCk9X6AlgIEQ39V8CuKKH43kXImNPxc-zktuoABpavaHoQ6Dc6kfm6cujPINNK9ZRgurFrhplwRi3hunU7FieRvwmm8Lc-mZNBFJddUspC7uJnIaoZqYykSpUnzXXaw0HhoT3syA55OmK2_xzpRWJssh9LF29QRMj_MR4QJh_dM61BvQWtSSTQKGY8amh9cpd41jo7L0MoSiHBIIddwXK2OGjsYwMiYSrmHzXdLfx5VRfhU4dYD1FTwCmC9g-6E4SOuX0YrBcr8ssFbXpipW846iT9Yf8wH9RlKkg3vZBhrOMrWcN8C0qdyh_vqGGYwQ5ASRzKOkMhgPQImkm6CK_O21QrfXWPRSxCbHEVwz3n_ghJXmtbVPpcCWc2N1UsGsBpUyV95sfcdnXu1OjICB38DfxZZioUd7tRRaHDmjpbPzoocQ&sai=AMfl-YSYB3kEXfeDXzv9qdA9dLF2bmqsAvKdJvE15a2ZCg8e79B6V4Zg59eyC7eu5OdOoyMjFv_QqPutWfQuEgTeblUliklrXcjIUu9u_APFl32Igx8f_na-08xRE_IbMlAjwIl_JHQ0S7tFA1JHYld74zXmE0EFLQ0nlUzbunv0Qv38rCrh_Fx5&sig=Cg0ArKJSzPcJ9Yim1E_REAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=223&vt=11&dtpt=133&dett=3&cstd=85&cisv=r20220412.95856&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 14 Apr 2022 15:54:29 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
banner
ad9.adfarm1.adition.com/ Frame EA8A 		4 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad9.adfarm1.adition.com/banner?sid=4734815&adjsver=3&fvers=&iframe=1&ref=https%3A//securityaffairs.co/&ro=https%3A//googleads.g.doubleclick.net/pagead/ads%3Fclient%3Dca-pub-1575911585432548%26output%3Dhtml%26h%3D250%26slotname%3DInternal_300x250_0.10%26adk%3D1639670682%26adf%3D1174745090%26pi%3Dt.ma%7Eas.Internal_300x250_0._%26w%3D300%26lmt%3D1649951668%26url%3Dhttps%253A%252F%252Fsecurityaffairs.co%252Fwordpress%252F130123%252Fapt%252Frussia-sandworm-targets-energy-facilities-ukraine.html%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1649951668529%26bpp%3D11%26bdt%3D73%26idt%3D111%26shv%3Dr20220412%26mjsv%3Dm202204040101%26ptt%3D5%26saldr%3Dsa%26correlator%3D5488069475642%26frm%3D21%26ife%3D1%26pv%3D1%26ga_vid%3D2002356130.1649951667%26ga_sid%3D1649951669%26ga_hid%3D1913949800%26ga_fc%3D1%26nhd%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D320%26ady%3D2945%26biw%3D1600%26bih%3D1200%26isw%3D300%26ish%3D250%26ifk%3D3438626221%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759837%252C44761793%26oid%3D2%26pvsid%3D2959394414853345%26pem%3D197%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D640%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C250%26vis%3D1%26rsz%3D%257C%257CeEbr%257C%26abl%3DCS%26pfx%3D0%26fu%3D4%26bc%3D31%26ifi%3D1%26uci%3D1.tpmg6fb487dt%26btvi%3D1%26fsb%3D1%26xpc%3DvOc9fd5tzw%26p%3Dhttps%253A//securityaffairs.co%26dtd%3D126&uao=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/100.0.4896.75%20Safari/537.36&os=17&browser=11&userid=7086488458340532675&kid=5204563&screen_res=6&wpt=J&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC%5Fr43tENYYpj3LIrBhQaa8q6wCI7TltBpyPz2z9APwI23ARABIKOHlh5gleKQgqAHoAHGwYLEKMgBCakCJmnHrA9Qsj6oAwGqBPABT9DRsDALwfl3S2sfJ2ESNoHI1TePSLLYeS4nfoHRf0rvAH0An9AIBGwDL9qLYgI7Tik9fCVnxPIjkwh7TKCc6CPijTGhqF7Omtfo%5Fyph1VnBMRAvYwt7TZhDOYD4VSVzNNFvhpp8jfCeMNK5WEJeB%2DKYE9ItBmBzjBZ%2DWCfiZXUcUaI6yOInzH%5FRWOVrnhCv5fBG126c3BbofUlCBGDJnSqtkb4D%5FsUH4k5Z9mnPrQ6SbZ3pmTxfjwj1qluDioH5esrTPtkJ1mhFpeUJTiFLrXAw%2Dy2dY1GHi8DtESRbc3TpVxGkSjQTFwn3jzIXsLC8wATbifrN9wPgBAOQBgGgBk2AB8b50qMDqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgHpKOxAqgH1ckbqAemvhuoB%5FPRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgdgAoDmAsByAsBgAwBsBO48%2DoOyBOV8ebfA9ATANgTCogUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRop3Zcof3oH4I%5FeOaEFraGHg%26sig%3DAOD64%5F0QuchhyHby5Q6Iw%2DqgIpyH10uW%2Dg%26client%3Dca%2Dpub%2D1575911585432548%26dbm%5Fc%3DAKAmf%2DAFFj1lJZrqlxv0nl0QJIoK8o8OE%2DQRdtSX6LjAHPqtaV1ozCg80RGD4Oq%5FB%2DIH6F6hZutRPcOiUq9pF%5FGs49pw9jjE1Tk2fhYfwa1tQrRGGXws3Bw7Cj0XGCbcnuLhQnDqvl08l66DuVrpnCZGJVv%5FF6DOxA%26cry%3D1%26dbm%5Fd%3DAKAmf%2DAhQo%5F4n%2DWyE8a9YYAkqVnC1SnmZiGAVhHJtE2hRpNR3hOJ7ey51KAceJpwOHgClLhqBcAf3KpSohT%5FHzdmAlMmXOdZG4Y7jVTGsvYldfjpE653OciqdDUt6n%5Fv2hJgVp5UcpDKnmtYluUwuHwgvbqoxTw57wYZ%2DbtJAILxOBrGZvUuzSYsIyLcvuA5m9ugPfq0CWtwyulR6lEPExaiNpAwvRjWk2kHWoa811ddbbRFgie0vi8ab5Ep7ovb3ZPZreopCT7i2bhT4p9Ax0sola1STIlQfOqse49T%2DVqyk70dM7vtNAfaErPzEgkvd1MgsDDO1RgIPYFJrR9rE3TuIBPXQbzv8ZwGJMyHwtJJNlMF5DdSRgT8Ig5nWKUIEkKERhi8oMTkBm6FmJemxYCxiCYYjSKcGBZpt7v6YtuoyImZN7WsqHBsI2ly7%2Dabc9%2DVXA45ucLhWLV2IOX3SrGzca8HV5xwrGN7cPcMqoCyfj7%5FiQoFwOvJg5PasgjHlzmHrwnpD30v1UY1SnrtSH6UD7PDcfjiJhtrv9TM9Uk3XaQ%5FFzZwV4iMZ6O3kYcPg2TAuCm05481%26adurl%3D
Requested by
Host: ad9.adfarm1.adition.com
URL: https://ad9.adfarm1.adition.com/js?wp_id=4734815&gdpr=&gdpr_consent=&kid=5204563&clickurl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC_r43tENYYpj3LIrBhQaa8q6wCI7TltBpyPz2z9APwI23ARABIKOHlh5gleKQgqAHoAHGwYLEKMgBCakCJmnHrA9Qsj6oAwGqBPABT9DRsDALwfl3S2sfJ2ESNoHI1TePSLLYeS4nfoHRf0rvAH0An9AIBGwDL9qLYgI7Tik9fCVnxPIjkwh7TKCc6CPijTGhqF7Omtfo_yph1VnBMRAvYwt7TZhDOYD4VSVzNNFvhpp8jfCeMNK5WEJeB-KYE9ItBmBzjBZ-WCfiZXUcUaI6yOInzH_RWOVrnhCv5fBG126c3BbofUlCBGDJnSqtkb4D_sUH4k5Z9mnPrQ6SbZ3pmTxfjwj1qluDioH5esrTPtkJ1mhFpeUJTiFLrXAw-y2dY1GHi8DtESRbc3TpVxGkSjQTFwn3jzIXsLC8wATbifrN9wPgBAOQBgGgBk2AB8b50qMDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgdgAoDmAsByAsBgAwBsBO48-oOyBOV8ebfA9ATANgTCogUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASEuRop3Zcof3oH4I_eOaEFraGHg%26sig%3DAOD64_0QuchhyHby5Q6Iw-qgIpyH10uW-g%26client%3Dca-pub-1575911585432548%26dbm_c%3DAKAmf-AFFj1lJZrqlxv0nl0QJIoK8o8OE-QRdtSX6LjAHPqtaV1ozCg80RGD4Oq_B-IH6F6hZutRPcOiUq9pF_Gs49pw9jjE1Tk2fhYfwa1tQrRGGXws3Bw7Cj0XGCbcnuLhQnDqvl08l66DuVrpnCZGJVv_F6DOxA%26cry%3D1%26dbm_d%3DAKAmf-AhQo_4n-WyE8a9YYAkqVnC1SnmZiGAVhHJtE2hRpNR3hOJ7ey51KAceJpwOHgClLhqBcAf3KpSohT_HzdmAlMmXOdZG4Y7jVTGsvYldfjpE653OciqdDUt6n_v2hJgVp5UcpDKnmtYluUwuHwgvbqoxTw57wYZ-btJAILxOBrGZvUuzSYsIyLcvuA5m9ugPfq0CWtwyulR6lEPExaiNpAwvRjWk2kHWoa811ddbbRFgie0vi8ab5Ep7ovb3ZPZreopCT7i2bhT4p9Ax0sola1STIlQfOqse49T-Vqyk70dM7vtNAfaErPzEgkvd1MgsDDO1RgIPYFJrR9rE3TuIBPXQbzv8ZwGJMyHwtJJNlMF5DdSRgT8Ig5nWKUIEkKERhi8oMTkBm6FmJemxYCxiCYYjSKcGBZpt7v6YtuoyImZN7WsqHBsI2ly7-abc9-VXA45ucLhWLV2IOX3SrGzca8HV5xwrGN7cPcMqoCyfj7_iQoFwOvJg5PasgjHlzmHrwnpD30v1UY1SnrtSH6UD7PDcfjiJhtrv9TM9Uk3XaQ_FzZwV4iMZ6O3kYcPg2TAuCm05481%26adurl%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
85.114.159.98 Rheinfelden, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
ad9.adfarm1.adition.com
Software
ADITIONSERVER v1.0 /
Resource Hash
d8cf277ce65233b7bededac5a8034fd47ee70bc8de25ee4897bc8238a7ccd0e2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 17:54:29 +0200
content-encoding
gzip
server
ADITIONSERVER v1.0
p3p
policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
cache-control
no-cache
content-type
text/javascript
expires
Sat, 01 Jan 2000 00:00:00 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 8A2A 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
8897
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
724
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 13:26:12 GMT
etag
48472445140208031
expires
Fri, 15 Apr 2022 13:26:12 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
beacon
ap.lijit.com/ Frame 89EA 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/beacon?informer=13480300
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.19 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date
Thu, 14 Apr 2022 15:54:29 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
Server
nginx
X-Powered-By
raptor
X-Sovrn-Pod
ad_ap4ams1
usync.html
eus.rubiconproject.com/ Frame 617C 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-8.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Thu, 14 Apr 2022 15:54:29 GMT
ETag
"402b2-119-5d32342a551c0"
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
checksync.php
contextual.media.net/ Frame C04D 		23 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUIUMTP7&prvid=2034%2C2033%2C2031%2C2030%2C273%2C2029%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C238%2C97%2C55%2C99%2C3012%2C2043%2C3010%2C2040%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C3014%2C337%2C338%2C70%2C77%2C38%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1&itype=PREBID
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9877cb0f828bc31f516200f8f223295edb6179669ec5697fec47f5fca2ff0099
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=71095
content-encoding
gzip
content-length
8275
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:29 GMT
expires
Fri, 15 Apr 2022 11:39:24 GMT
server
Apache
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
pd
u.openx.net/w/1.0/ Frame F941 		0
91 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
20
content-type
text/html
date
Thu, 14 Apr 2022 15:54:29 GMT
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
via
1.1 google
async_usersync.html
acdn.adnxs.com/dmp/ Frame 10CF 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
37972
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Thu, 14 Apr 2022 15:54:29 GMT
ETag
W/"623de86a-cf34"
Expires
Thu, 14 Apr 2022 05:21:37 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
159827, 697734
X-Served-By
cache-lga21972-LGA, cache-hhn4068-HHN
X-Timer
S1649951670.516884,VS0,VE0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame DBC6 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.87.212.214 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-87-212-214.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=43569
content-encoding
gzip
content-length
5549
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:29 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
expires
Fri, 15 Apr 2022 04:00:38 GMT
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
check.html
biddr.brealtime.com/ Frame DDCC 		926 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://biddr.brealtime.com/check.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.17.119.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Age
5063
CF-Cache-Status
HIT
CF-RAY
6fbd9ece9fc068ef-FRA
Cache-Control
public, max-age=3600
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Thu, 14 Apr 2022 15:54:29 GMT
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Expires
Thu, 14 Apr 2022 16:54:29 GMT
Last-Modified
Tue, 08 Sep 2020 13:51:51 GMT
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
x-amz-id-2
D8bCfiUfQmFaOPGY9GG00VqkPR8LyxoPPUMDv8kTzcs2w4+RBsqydpo2MRUbL19ONaisLRL7BCw=
x-amz-request-id
AGCHCGNC05GTWZVJ
async_usersync.html
acdn.adnxs.com/dmp/ Frame 0695 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
37972
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Thu, 14 Apr 2022 15:54:29 GMT
ETag
W/"623de86a-cf34"
Expires
Thu, 14 Apr 2022 05:21:37 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
159827, 706556
X-Served-By
cache-lga21972-LGA, cache-hhn4047-HHN
X-Timer
S1649951670.516933,VS0,VE0
/
ssc-cms.33across.com/ps/ Frame CAFB 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=azC7qard4r6OkMaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.21 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip21.67-202-105.static.steadfastdns.net
Software
33XP003 /
Resource Hash

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
server
33XP003
x-33x-status
2000208
checksync.php
contextual.media.net/ Frame 7644 		23 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUIUMTP7&prvid=2034%2C2033%2C2031%2C2030%2C273%2C2029%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C238%2C97%2C55%2C99%2C3012%2C2043%2C3010%2C2040%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C3014%2C337%2C338%2C70%2C77%2C38%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1&itype=PREBID
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9877cb0f828bc31f516200f8f223295edb6179669ec5697fec47f5fca2ff0099
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=71095
content-encoding
gzip
content-length
8275
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:29 GMT
expires
Fri, 15 Apr 2022 11:39:24 GMT
server
Apache
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
beacon
ap.lijit.com/ Frame 613B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/beacon?informer=13480300
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.19 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date
Thu, 14 Apr 2022 15:54:29 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
Server
nginx
X-Powered-By
raptor
X-Sovrn-Pod
ad_ap4ams1
checksync.php
contextual.media.net/ Frame C826 		23 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUIUMTP7&prvid=2034%2C2033%2C2031%2C2030%2C273%2C2029%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C238%2C97%2C55%2C99%2C3012%2C2043%2C3010%2C2040%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C3014%2C337%2C338%2C70%2C77%2C38%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1&itype=PREBID
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9877cb0f828bc31f516200f8f223295edb6179669ec5697fec47f5fca2ff0099
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=71095
content-encoding
gzip
content-length
8275
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:29 GMT
expires
Fri, 15 Apr 2022 11:39:24 GMT
server
Apache
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
check.html
biddr.brealtime.com/ Frame 5AE9 		926 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://biddr.brealtime.com/check.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.17.119.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Age
872
CF-Cache-Status
HIT
CF-RAY
6fbd9ece9d8a905b-FRA
Cache-Control
public, max-age=3600
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Thu, 14 Apr 2022 15:54:29 GMT
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Expires
Thu, 14 Apr 2022 16:54:29 GMT
Last-Modified
Tue, 08 Sep 2020 13:51:51 GMT
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
x-amz-id-2
TZDfxO4uwORNUA/4irnRs9qqp9lI3eH+ruz8qqqAX5jBwgQ1rzgBbhsPKs2FgAnYzrbwWSW5JnM=
x-amz-request-id
15DYQDFYDGXZWWWF
beacon
ap.lijit.com/ Frame 4A0A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/beacon?informer=13480300
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.19 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date
Thu, 14 Apr 2022 15:54:29 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
Server
nginx
X-Powered-By
raptor
X-Sovrn-Pod
ad_ap4ams1
async_usersync.html
acdn.adnxs.com/dmp/ Frame CF31 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
37971
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Thu, 14 Apr 2022 15:54:29 GMT
ETag
W/"623de86a-cf34"
Expires
Thu, 14 Apr 2022 05:21:37 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
159827, 703830
X-Served-By
cache-lga21972-LGA, cache-hhn4046-HHN
X-Timer
S1649951670.516976,VS0,VE0
async_usersync.html
acdn.adnxs.com/dmp/ Frame 87E6 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
37972
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Thu, 14 Apr 2022 15:54:29 GMT
ETag
W/"623de86a-cf34"
Expires
Thu, 14 Apr 2022 05:21:37 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
159827, 697735
X-Served-By
cache-lga21972-LGA, cache-hhn4068-HHN
X-Timer
S1649951670.532804,VS0,VE0
check.html
biddr.brealtime.com/ Frame B87B 		926 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://biddr.brealtime.com/check.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.17.119.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Age
594
CF-Cache-Status
HIT
CF-RAY
6fbd9ecea8b29993-CDG
Cache-Control
public, max-age=3600
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Thu, 14 Apr 2022 15:54:29 GMT
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Expires
Thu, 14 Apr 2022 16:54:29 GMT
Last-Modified
Tue, 08 Sep 2020 13:51:51 GMT
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
x-amz-id-2
64a2/mMiEAEcE6A0Bt+2Erlf5G8/Vr6F+aKm35SudGm/mhDDMsfdh3kdR47hqOgX9Nj5IT4Nh94=
x-amz-request-id
WMCZ1XWCTS57FSV5
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A08C 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.87.212.214 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-87-212-214.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=43569
content-encoding
gzip
content-length
5549
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:29 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
expires
Fri, 15 Apr 2022 04:00:38 GMT
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
checksync.php
contextual.media.net/ Frame DE5A 		23 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUIUMTP7&prvid=2034%2C2033%2C2031%2C2030%2C273%2C2029%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C238%2C97%2C55%2C99%2C3012%2C2043%2C3010%2C2040%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C3014%2C337%2C338%2C70%2C77%2C38%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1&itype=PREBID
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-228-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9877cb0f828bc31f516200f8f223295edb6179669ec5697fec47f5fca2ff0099
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=71095
content-encoding
gzip
content-length
8275
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:29 GMT
expires
Fri, 15 Apr 2022 11:39:24 GMT
server
Apache
strict-transport-security
max-age=604800
vary
Accept-Encoding
x-mnet-hl2
E
pd
u.openx.net/w/1.0/ Frame 4E0B 		0
80 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
20
content-type
text/html
date
Thu, 14 Apr 2022 15:54:29 GMT
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
via
1.1 google
pd
u.openx.net/w/1.0/ Frame 3C6A 		0
80 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
20
content-type
text/html
date
Thu, 14 Apr 2022 15:54:29 GMT
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
via
1.1 google
beacon
ap.lijit.com/ Frame 5C5A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/beacon?informer=13480300
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.19 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date
Thu, 14 Apr 2022 15:54:29 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
Server
nginx
X-Powered-By
raptor
X-Sovrn-Pod
ad_ap4ams1
check.html
biddr.brealtime.com/ Frame 8FEB 		926 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://biddr.brealtime.com/check.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.17.119.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Age
594
CF-Cache-Status
HIT
CF-RAY
6fbd9eceaa0f3ac3-CDG
Cache-Control
public, max-age=3600
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Thu, 14 Apr 2022 15:54:29 GMT
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Expires
Thu, 14 Apr 2022 16:54:29 GMT
Last-Modified
Tue, 08 Sep 2020 13:51:51 GMT
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
x-amz-id-2
64a2/mMiEAEcE6A0Bt+2Erlf5G8/Vr6F+aKm35SudGm/mhDDMsfdh3kdR47hqOgX9Nj5IT4Nh94=
x-amz-request-id
WMCZ1XWCTS57FSV5
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame D776 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.87.212.214 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-87-212-214.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=43569
content-encoding
gzip
content-length
5549
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:29 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
expires
Fri, 15 Apr 2022 04:00:38 GMT
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 63C8 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.87.212.214 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-87-212-214.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=43569
content-encoding
gzip
content-length
5549
content-type
text/html; charset=UTF-8
date
Thu, 14 Apr 2022 15:54:29 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
expires
Fri, 15 Apr 2022 04:00:38 GMT
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
pd
u.openx.net/w/1.0/ Frame 0E36 		0
80 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
20
content-type
text/html
date
Thu, 14 Apr 2022 15:54:29 GMT
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
via
1.1 google
truncated
/ Frame 8073 		218 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
64373cb4c186e98f5465ac6deeed39f21f8c31ed18ba0ca0e971abeee0e99e64

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type
image/png
vtr.php
served-by.pixfuture.com/www/headerbid/library/tracking/ 		0
309 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/vtr.php
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
nginx/1.10.3 (Ubuntu)
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
max-age=172800
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Sat, 16 Apr 2022 15:54:29 GMT
vtr.php
served-by.pixfuture.com/www/headerbid/library/tracking/ 		0
309 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/vtr.php
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
nginx/1.10.3 (Ubuntu)
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
max-age=172800
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires
Sat, 16 Apr 2022 15:54:29 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 35E0 		13 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220412&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&bust=31067051
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0e59a021648d125647974c69a00b8d8c323ea890a26629c8ba8a8a19cc3fc3d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10485
x-xss-protection
0
000002315571.gif
imagesrv.adition.com/banners/3506/files/00/23/55/33/ Frame EA8A 		53 KB
53 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://imagesrv.adition.com/banners/3506/files/00/23/55/33/000002315571.gif
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
imagesrv.adition.com
Software
/
Resource Hash
5bfb11cb8d72ded34d048679193ed674daeb3f046d4724b3afe374926e3c7872

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 14 Apr 2022 15:54:29 GMT
last-modified
Thu, 14 Apr 2022 06:56:22 GMT
accept-ranges
bytes
etag
"3345499487"
content-length
54069
content-type
image/gif
jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
pagead2.googlesyndication.com/bg/ Frame 721F 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8c2914cd6e0c26e9fe3a9de23853632be1862891bf9bcfdda7053e1995319563
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 12:00:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
14059
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13627
x-xss-protection
0
last-modified
Mon, 11 Apr 2022 15:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 14 Apr 2023 12:00:10 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame EA91 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
115768
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 13 Apr 2022 07:45:01 GMT
expires
Thu, 13 Apr 2023 07:45:01 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 1A74 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
8897
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
724
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 13:26:12 GMT
etag
48472445140208031
expires
Fri, 15 Apr 2022 13:26:12 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
usync.js
eus.rubiconproject.com/ Frame 617C 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-8.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
92db40d16cb8ca6e243d000bc0a2f249aeb503b3109c6ea0d5892f531204c078

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date
Thu, 14 Apr 2022 15:54:29 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 16:28:01 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=9985
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9542
Expires
Thu, 14 Apr 2022 18:40:54 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 35E0 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&bust=31067051
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 14 Apr 2022 15:54:29 GMT
truncated
/ Frame EA8A 		211 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5ad66c65174ac81b2f8d733f3b51054e9257cb2aab8c59c27ea5b8e306608ef9

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type
image/png
async_usersync
ib.adnxs.com/ Frame 10CF 		0
743 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:29 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
4db76899-74b7-4a19-9636-cf4330732e86
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 8A2A
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEPscK1fV4mAwCT0aRjvqwgA&google_cver=1&google_push=AYg5qPJ9JkElNve4oIs5NwS9KPbbcVjxYHutgpqKdrGM9wPwKZIMh6KmEDbPwkkT27IZk6lP4-zvwGcYTSO1VREm...
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=viRiWEO0QgCUhJdx7hEx5A&google_push=AYg5qPJ9JkElNve4oIs5NwS9KPbbcVjxYHutgpqKdrGM9wPwKZIMh6KmEDbPwkkT27IZk6lP4-zvwGcYTSO1VREmF-9hpz1tWFs
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=viRiWEO0QgCUhJdx7hEx5A&google_push=AYg5qPJ9JkElNve4oIs5NwS9KPbbcVjxYHutgpqKdrGM9wPwKZIMh6KmEDbPwkkT27IZk6lP4-zvwGcYTSO1VREmF-9hpz1tWFs
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
MT3 4335 2c68c00 master ord-pixel-x57 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=viRiWEO0QgCUhJdx7hEx5A&google_push=AYg5qPJ9JkElNve4oIs5NwS9KPbbcVjxYHutgpqKdrGM9wPwKZIMh6KmEDbPwkkT27IZk6lP4-zvwGcYTSO1VREmF-9hpz1tWFs
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Thu, 14 Apr 2022 15:54:28 GMT
pixel
cm.g.doubleclick.net/ Frame 8A2A
Redirect Chain
  • https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D81312610%26google_hm%3D%24DSP_CKID&google_gid=CAESEHnycEJbSj_5f1S2Rf7DZyU&google_cver=1&google_p...
  • https://cm.g.doubleclick.net/pixel?google_nid=81312610&google_hm=ZGNmNTAzMTktM2VkOC00OTJhLWExYWUtZDNkNjUyYzc0MGM4
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=81312610&google_hm=ZGNmNTAzMTktM2VkOC00OTJhLWExYWUtZDNkNjUyYzc0MGM4
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=81312610&google_hm=ZGNmNTAzMTktM2VkOC00OTJhLWExYWUtZDNkNjUyYzc0MGM4
date
Thu, 14 Apr 2022 15:54:29 GMT
content-length
0
strict-transport-security
max-age=15724800; includeSubDomains
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 8A2A
Redirect Chain
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEP_QNo_KHTe9s2ZQDtMsMeo&google_cver=1&google_push=AYg5qPIVtLanFX6CIIh3LlGfYzWbjoSQn72CDPhgxQuMKuPtQXEd2vGKywoG9wT5IzjOk9ZEDMuf02Qj...
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzc3NTg1NzI1MjIxNzYwNjQxOQ&google_push=AYg5qPIVtLanFX6CIIh3LlGfYzWbjoSQn72CDPhgxQuMKuPtQXEd2vGKywoG9wT5IzjOk9ZEDMuf02...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzc3NTg1NzI1MjIxNzYwNjQxOQ&google_push=AYg5qPIVtLanFX6CIIh3LlGfYzWbjoSQn72CDPhgxQuMKuPtQXEd2vGKywoG9wT5IzjOk9ZEDMuf02Qjk7CA7mOOVeMlMwdkdKs
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
nginx
location
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=Mzc3NTg1NzI1MjIxNzYwNjQxOQ&google_push=AYg5qPIVtLanFX6CIIh3LlGfYzWbjoSQn72CDPhgxQuMKuPtQXEd2vGKywoG9wT5IzjOk9ZEDMuf02Qjk7CA7mOOVeMlMwdkdKs
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
pixel
cm.g.doubleclick.net/ Frame 8A2A
Redirect Chain
  • https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESEK_f2Fe-HVQrRYotbK67Rq0&google_cver=1&google_push=AYg5qPKg8toOeVW4lijBvcplYoY-oLn_IctHmzodxU8zhachy0GNoO5A4Um3I4wz7kX8U...
  • https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPKg8toOeVW4lijBvcplYoY-oLn_IctHmzodxU8zhachy0GNoO5A4Um3I4wz7kX8UzEprGfDss9WpUf3nup-34oKq8gI0rpH&google_hm=QXJJR1J0Qk5SeDRscnQxQTl2...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPKg8toOeVW4lijBvcplYoY-oLn_IctHmzodxU8zhachy0GNoO5A4Um3I4wz7kX8UzEprGfDss9WpUf3nup-34oKq8gI0rpH&google_hm=QXJJR1J0Qk5SeDRscnQxQTl2bUMweUE=
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
//cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPKg8toOeVW4lijBvcplYoY-oLn_IctHmzodxU8zhachy0GNoO5A4Um3I4wz7kX8UzEprGfDss9WpUf3nup-34oKq8gI0rpH&google_hm=QXJJR1J0Qk5SeDRscnQxQTl2bUMweUE=
Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
pixel
cm.g.doubleclick.net/ Frame 8A2A
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6...
0
0
pixel
cm.g.doubleclick.net/ Frame 8A2A
Redirect Chain
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEIBWj7hyCKNyigCJw5FiKqo&google_cver=1&google_push=AYg5qPI-UF7LKL4CuCZ2OYX9Ij3FXYrASuea9m3sgBW2NoLSQH2P6_QBlG1-gQ3Yfc1WLBtpz9FZ9cyc0pjVfUfZ...
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPI-UF7LKL4CuCZ2OYX9Ij3FXYrASuea9m3sgBW2NoLSQH2P6_QBlG1-gQ3Yfc1WLBtpz9FZ9cyc0pjVfUfZJWI1i2WCCnAq
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPI-UF7LKL4CuCZ2OYX9Ij3FXYrASuea9m3sgBW2NoLSQH2P6_QBlG1-gQ3Yfc1WLBtpz9FZ9cyc0pjVfUfZJWI1i2WCCnAq
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Thu, 14 Apr 2022 15:54:29 GMT
via
1.1 8e487d5d50ba943ec340041b0945bbf4.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
DUS51-P1
x-cache
FunctionGeneratedResponse from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPI-UF7LKL4CuCZ2OYX9Ij3FXYrASuea9m3sgBW2NoLSQH2P6_QBlG1-gQ3Yfc1WLBtpz9FZ9cyc0pjVfUfZJWI1i2WCCnAq
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
QdGILQKEVxOH8oJNv6hAaW6hMoUuvMBohApfZKYCo0AvU2cXIVCAYA==
/
onetag-sys.com/sync/i,19/ Frame 8A2A
Redirect Chain
  • https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEOW_xUSp8xXk0HPMywuqOoE&google_cver=1&google_push=AYg5qPIsnJoPRYFHRbdMtGE06eXRGAvV1j_b_chpTG4uQgqqLtQq4XIWJZoXjPfDUh1-FLBkCkolFqrDhys...
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgCjIfaus-8SgHVWHewiG0oH0NkUDS9Xs5A&google_push=AYg5qPIsnJoPRYFHRbdMtGE06eXRGAvV1j_b_chpTG4uQgqqLtQq4XIWJZoXjPfDUh1-FLBkCkolFqrDhy...
  • https://onetag-sys.com/sync/i,19/?google_error=5
0
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/sync/i,19/?google_error=5
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H2
Server
51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip251.ip-51-89-9.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-cache, no-transform
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://onetag-sys.com/sync/i,19/?google_error=5
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
245
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
attr
cm.g.doubleclick.net/pixel/ Frame 8A2A 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IhXhUp-C6V43AnEzVsuVYhL4-cUhWngRYvtSY4DSZ8AkufW3bUz8170QXv2h83W9s43htVnw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
async_usersync
ib.adnxs.com/ Frame 0695 		0
743 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:29 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
fbbd0285-d786-4058-8010-87905830b815
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame CF31 		0
743 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:29 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
b297b88b-cb9a-499b-99df-d4834737c1aa
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Montserrat-SemiBold.woff
s0.2mdn.net/sadbundle/10934090805236727808/ Frame EAC3 		32 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/10934090805236727808/Montserrat-SemiBold.woff
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10934090805236727808/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4d841940fc5a291c2b21753932d57b24e9c4f26e6ae9788ad449392a55892c39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/10934090805236727808/style.css
Origin
https://s0.2mdn.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Tue, 12 Apr 2022 11:05:57 GMT
x-content-type-options
nosniff
age
190112
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32860
x-xss-protection
0
last-modified
Thu, 22 Jul 2021 20:45:12 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 12 Apr 2023 11:05:57 GMT
Montserrat-Black.woff
s0.2mdn.net/sadbundle/10934090805236727808/ Frame EAC3 		30 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/10934090805236727808/Montserrat-Black.woff
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10934090805236727808/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6448c95ad8e9b1f63465c57952afbf8df9df45103e966407d7b0f1588e9e009e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/10934090805236727808/style.css
Origin
https://s0.2mdn.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 06:00:50 GMT
x-content-type-options
nosniff
age
35619
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30436
x-xss-protection
0
last-modified
Thu, 22 Jul 2021 20:45:12 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 14 Apr 2023 06:00:50 GMT
Montserrat-Light.woff
s0.2mdn.net/sadbundle/10934090805236727808/ Frame EAC3 		32 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/10934090805236727808/Montserrat-Light.woff
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10934090805236727808/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e58cb72c1056d2a9345f7cbd4282f32f519cbd2d038145671674d769b7d1d359
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/10934090805236727808/style.css
Origin
https://s0.2mdn.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Tue, 12 Apr 2022 20:03:56 GMT
x-content-type-options
nosniff
age
157833
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32812
x-xss-protection
0
last-modified
Thu, 22 Jul 2021 20:45:12 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 12 Apr 2023 20:03:56 GMT
Montserrat-Regular.woff
s0.2mdn.net/sadbundle/10934090805236727808/ Frame EAC3 		32 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/10934090805236727808/Montserrat-Regular.woff
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10934090805236727808/style.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
642f5fd742a9d4ad971464adee5f82c0292f812d14e337e5448cdb29ce5f2a26
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/10934090805236727808/style.css
Origin
https://s0.2mdn.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Tue, 12 Apr 2022 19:00:10 GMT
x-content-type-options
nosniff
age
161659
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33080
x-xss-protection
0
last-modified
Thu, 22 Jul 2021 20:45:12 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 12 Apr 2023 19:00:10 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame EAC3 		7 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_246&st=int
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_246.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4124f35fc76b72692be512e82f272078ebb3ce22cbbfbf151f50da43b363c5a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5517
x-xss-protection
0
60015185_20200820245904965_ALL_Logo_WHITE.png
s0.2mdn.net/ads/richmedia/studio/60015185/ Frame EAC3 		55 KB
55 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/ads/richmedia/studio/60015185/60015185_20200820245904965_ALL_Logo_WHITE.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a6471be6b02897e0fcc27acc17e01ca5b3243b6a3f917b01987fed922b9751e9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 13 Apr 2022 19:55:24 GMT
x-content-type-options
nosniff
age
71945
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
56405
x-xss-protection
0
last-modified
Thu, 20 Aug 2020 07:59:05 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 14 Apr 2022 19:55:24 GMT
60015185_20220330074303462_KV_LADY_YELLOW.jpg
s0.2mdn.net/ads/richmedia/studio/60015185/ Frame EAC3 		359 KB
359 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/ads/richmedia/studio/60015185/60015185_20220330074303462_KV_LADY_YELLOW.jpg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8ffb654275301919bb42930c2dd518d3fd93d0a98407bd4f04001d46c9d9664e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 13 Apr 2022 21:53:48 GMT
x-content-type-options
nosniff
age
64841
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
367576
x-xss-protection
0
last-modified
Wed, 30 Mar 2022 14:43:03 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 14 Apr 2022 21:53:48 GMT
60015185_20220330074254081_KV_DESTINATION.jpg
s0.2mdn.net/ads/richmedia/studio/60015185/ Frame EAC3 		513 KB
513 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/ads/richmedia/studio/60015185/60015185_20220330074254081_KV_DESTINATION.jpg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
41fbbac12d7d653541f0a0dfe0842d3e917546f06c700c7572e0ee45bc1ed4db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 13 Apr 2022 21:53:03 GMT
x-content-type-options
nosniff
age
64886
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
525235
x-xss-protection
0
last-modified
Wed, 30 Mar 2022 14:42:54 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 14 Apr 2022 21:53:03 GMT
60015185_20220330074258745_KV_HOTEL.jpg
s0.2mdn.net/ads/richmedia/studio/60015185/ Frame EAC3 		483 KB
483 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/ads/richmedia/studio/60015185/60015185_20220330074258745_KV_HOTEL.jpg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f4b2474113dddc55ebc90156e84591220ba900000b3d332da0c0db15fdd20b3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/10934090805236727808/index.html?e=69&leftOffset=0&topOffset=0&c=VNpNHqWNqp&t=1&renderingType=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Wed, 13 Apr 2022 21:53:03 GMT
x-content-type-options
nosniff
age
64886
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
494627
x-xss-protection
0
last-modified
Wed, 30 Mar 2022 14:42:58 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 14 Apr 2022 21:53:03 GMT
async_usersync
ib.adnxs.com/ Frame 87E6 		0
743 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:29 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
483ad0d3-a969-4ff6-995b-6d82b1dee339
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame EAC3 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_246.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 14 Apr 2022 15:54:29 GMT
PugMaster
image6.pubmatic.com/AdServer/ Frame DBC6 		6 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=72704617&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.82.242.209 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
da3ba6bda1b3fa1fd8395ba212eaf5f9c565d7e3c50525a03ff76f1e435db2f2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
content-type
text/html; charset=UTF-8
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
dpixel
cms.quantserve.com/ Frame 1A74 		35 B
465 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEKstVbt5SUZ_oxBto7kQXIE&google_cver=1&google_push=AYg5qPJfJho8lOuet3-7e-O-b3rmC9ZABFbie66Nzf0ByvLgpfab8_IHRiODhpZyWH4WP2sJlYPTrGUyeY3iGpiVCQ7fmZT7A7ev
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
current
dclk-match.dotomi.com/match/bounce/ Frame 1A74 		0
103 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEJ-qfV6pdqDAoHwmOpPAzNA&google_cver=1&google_push=AYg5qPKOTQioJZRb7BbTrc46E0QUFk7qYAKk8vR0ifm_U8t-qbqgnEMCmUSDjW0MyKaxXx5stJ4GdezmDcWQWtoz2_n5qRPqsYmX
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
expires
0
pixelSync
pixel-sync.sitescout.com/dmp/ Frame 1A74 		0
191 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESELDbthXaxAudRqz7SXBqegE&google_cver=1&google_push=AYg5qPK8UCP8hqriNn93OvXKJMZwvMbhbRUa9aRNyWmwZOvpS-RyogHzqD9e7LHwShRegJX00_D43I8tldwYgofjUCTZeWlM9vk
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
66.155.71.25 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
cache-control
max-age=0,no-cache,no-store
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires
Tue, 11 Oct 1977 12:34:56 GMT
pixel
cm.g.doubleclick.net/ Frame 1A74
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESECZJU2e4UDFOB8D9-LeWzl0&google_cver=1&google_push=AYg5qPIM0-bRMcda1QBVLe3YYT7a6G_hEI2ypBH8aRCwWLTbgGjGynh7xtzkDvh3O2lZxueK30jwz6Uxpc-7BfHsmj7y...
  • https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=google
  • https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google
  • https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=d2e8182a-a1bd-4636-bb80-fc387b014fb3&ssp=google
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIM0-bRMcda1QBVLe3YYT7a6G_hEI2ypBH8aRCwWLTbgGjGynh7xtzkDvh3O2lZxueK30jwz6Uxpc-7BfHsmj7y1ONdLy0&google_hm=63uq-vtnTW2yyxcAoY_K3A==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIM0-bRMcda1QBVLe3YYT7a6G_hEI2ypBH8aRCwWLTbgGjGynh7xtzkDvh3O2lZxueK30jwz6Uxpc-7BfHsmj7y1ONdLy0&google_hm=63uq-vtnTW2yyxcAoY_K3A==
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
//cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIM0-bRMcda1QBVLe3YYT7a6G_hEI2ypBH8aRCwWLTbgGjGynh7xtzkDvh3O2lZxueK30jwz6Uxpc-7BfHsmj7y1ONdLy0&google_hm=63uq-vtnTW2yyxcAoY_K3A==
Date
Thu, 14 Apr 2022 15:54:30 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
us
sync.go.sonobi.com/ Frame 1A74 		0
474 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAYg5qPKWx1UghTYg4gGi0mO1uDLK63AiCrhPnXRnETO3xVLiIFeclMunZ0q-mCr3SkCgraKNmWpfcVVUL0gHZOaR98tZiSH4tqU%26google_hm%3D%5BUID%5D&google_gid=CAESEK_u8NQAsyL4FQYKPH77Oic&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 1A74
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEEINmWeStxMubJeEyfJZA9M&google_cver=1&google_push=AYg5qPL8tDofqeLjacAkqPxF1JkUjW9vci_vlsPIyRyYJBr39-c48rQHB_DI0xuY9tSZ2L9-1TkdQdpG40wxFFm6OF-B9hE-Y1ma
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPL8tDofqeLjacAkqPxF1JkUjW9vci_vlsPIyRyYJBr39-c48rQHB_DI0xuY9tSZ2L9-1TkdQdpG40wxFFm6OF-B9hE-Y1ma&goog...
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODk2OTA0MzczMjI3NDc1MjEzMTkz&google_push=AYg5qPL8tDofqeLjacAkqPxF1JkUjW9vci_vlsPIyRyYJBr39-c48rQHB_DI0xuY...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODk2OTA0MzczMjI3NDc1MjEzMTkz&google_push=AYg5qPL8tDofqeLjacAkqPxF1JkUjW9vci_vlsPIyRyYJBr39-c48rQHB_DI0xuY9tSZ2L9-1TkdQdpG40wxFFm6OF-B9hE-Y1ma
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=ODk2OTA0MzczMjI3NDc1MjEzMTkz&google_push=AYg5qPL8tDofqeLjacAkqPxF1JkUjW9vci_vlsPIyRyYJBr39-c48rQHB_DI0xuY9tSZ2L9-1TkdQdpG40wxFFm6OF-B9hE-Y1ma
date
Thu, 14 Apr 2022 15:54:29 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
pixel
cm.g.doubleclick.net/ Frame 1A74
Redirect Chain
  • https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEGyY_2sjIyj7uSGVsnU7-WQ&google_cver=1&google_push=AYg5qPJ9v59oc91L9MWtuPNVfkgqYkP9METRn8hVtee7Ufags-GavP-6iQsT3eEPfJhz0cwIqPZQNlMtSIAkTByGQHF7sV4...
  • https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPJ9v59oc91L9MWtuPNVfkgqYkP9METRn8hVtee7Ufags-GavP-6iQsT3eEPfJhz0cwIqPZQNlMtSIAkTByGQHF7sV4AVEBelQ&google_hm=Nzg0NDEyO...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPJ9v59oc91L9MWtuPNVfkgqYkP9METRn8hVtee7Ufags-GavP-6iQsT3eEPfJhz0cwIqPZQNlMtSIAkTByGQHF7sV4AVEBelQ&google_hm=Nzg0NDEyODAzNzExNjU1ODI0MA==
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AYg5qPJ9v59oc91L9MWtuPNVfkgqYkP9METRn8hVtee7Ufags-GavP-6iQsT3eEPfJhz0cwIqPZQNlMtSIAkTByGQHF7sV4AVEBelQ&google_hm=Nzg0NDEyODAzNzExNjU1ODI0MA==
Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
attr
cm.g.doubleclick.net/pixel/ Frame 1A74 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KsPLgQYilxx_PVaCcmE9_CgZ87lJyGwrvLGh9fP_rqc3k_WBCfy4HUn6aP3tMlHlqt_jskvQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=Internal_300x250_0.10&adk=1639670682&adf=1174745090&pi=t.ma~as.Internal_300x250_0._&w=300&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668529&bpp=11&bdt=73&idt=111&shv=r20220412&mjsv=m202204040101&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=1&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=1913949800&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=2945&biw=1600&bih=1200&isw=300&ish=250&ifk=3438626221&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C44761793&oid=2&pvsid=2959394414853345&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.tpmg6fb487dt&btvi=1&fsb=1&xpc=vOc9fd5tzw&p=https%3A//securityaffairs.co&dtd=126
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
sodar
pagead2.googlesyndication.com/getconfig/ Frame 1E81 		14 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220412&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8c776d56cdf0de2bdcb50dbf0e9e4abcd1542ef9c2ea28baeba453d9a006ac02
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10589
x-xss-protection
0
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 80C3 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
2771
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:08:18 GMT
expires
Fri, 14 Apr 2023 15:08:18 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 704E 		783 B
537 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
61f31fdeba8ade7c78db76e5d4831da4c09e46c1611ee5b2acc1c103f007879c
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-M51NH4Xkk+jw9c9JJg94aQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=300
content-encoding
gzip
content-length
515
content-security-policy
script-src 'report-sample' 'nonce-M51NH4Xkk+jw9c9JJg94aQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:54:29 GMT
expires
Thu, 14 Apr 2022 15:54:29 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
pagead2.googlesyndication.com/bg/ Frame EA91 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8c2914cd6e0c26e9fe3a9de23853632be1862891bf9bcfdda7053e1995319563
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 12:00:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
14059
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13627
x-xss-protection
0
last-modified
Mon, 11 Apr 2022 15:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 14 Apr 2023 12:00:10 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 1E81 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204040101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 14 Apr 2022 15:54:29 GMT
tap.php
pixel.rubiconproject.com/ Frame 617C
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/qi-HlQuTj0bcnFY4l0J6ww?csrc=
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3045454532576791995
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3045454532576791995
Protocol
HTTP/1.1
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
704c1e4d3fcc922a3031d436b584678b
Content-Type
image/gif

Redirect headers

date
Thu, 14 Apr 2022 15:54:30 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=3045454532576791995
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
709414.gif
id.rlcdn.com/ Frame 617C 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/709414.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers
v1
ads.yahoo.com/cms/ Frame 617C
Redirect Chain
  • https://token.rubiconproject.com/token?pid=26594
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L1Z6MEPG-1-2I93&sigv=1&esig=2~fd366345cec8b61222f198c87d9d095eedb3c898
0
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L1Z6MEPG-1-2I93&sigv=1&esig=2~fd366345cec8b61222f198c87d9d095eedb3c898
Protocol
H2
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:30 GMT
cache-control
no-store
x-content-type-options
nosniff
server
ATS
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block

Redirect headers

Location
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L1Z6MEPG-1-2I93&sigv=1&esig=2~fd366345cec8b61222f198c87d9d095eedb3c898
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4b510f0cc5fcbc9800016ef543086418
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
ecm3
aax-eu.amazon-adsystem.com/s/ Frame 617C
Redirect Chain
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=gDk-h5QsQOG_jAR0JK2YLw&rk=usync-other
  • https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=gDk-h5QsQOG_jAR0JK2YLw
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=gDk-h5QsQOG_jAR0JK2YLw
Protocol
HTTP/1.1
Server
54.239.37.45 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:30 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
06XF6PRHRH2JHT4D369G
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=gDk-h5QsQOG_jAR0JK2YLw
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
704c1e4d3fcc922a3031d436b584678b
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame 617C
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKZq-yYU_Bb0YyJImJT8H2c&google_cver=1
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKZq-yYU_Bb0YyJImJT8H2c&google_cver=1
Protocol
HTTP/1.1
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
704c1e4d3fcc922a3031d436b584678b
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKZq-yYU_Bb0YyJImJT8H2c&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
326
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
px.ads.linkedin.com/ Frame 617C
Redirect Chain
  • https://token.rubiconproject.com/token?pid=36584
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L1Z6MEPG-1-2I93
0
706 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L1Z6MEPG-1-2I93
Protocol
H2
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 6778D751B8A843B08A873051D3F46513 Ref B: FRAEDGE1112 Ref C: 2022-04-14T15:54:30Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
x-li-proto
http/2
content-length
0
x-li-uuid
AAXcn08xPV6Ltr9f8Z7qgQ==

Redirect headers

Location
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L1Z6MEPG-1-2I93
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4b510f0cc5fcbc9800016ef543086418
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
pixel
cm.g.doubleclick.net/ Frame 617C
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFaNk1FUEctMS0ySTkz
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFaNk1FUEctMS0ySTkz
Protocol
H3
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFaNk1FUEctMS0ySTkz
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
4b510f0cc5fcbc9800016ef543086418
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
ecm3
s.amazon-adsystem.com/ Frame 617C
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=hjsWJdjzQuO8tJjW9fG9lQ&rk=usync-na
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=hjsWJdjzQuO8tJjW9fG9lQ
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=hjsWJdjzQuO8tJjW9fG9lQ
Protocol
HTTP/1.1
Server
209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:30 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
FTB2JZ4SPFVMYNBGPX4T
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=hjsWJdjzQuO8tJjW9fG9lQ
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
704c1e4d3fcc922a3031d436b584678b
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
pagead2.googlesyndication.com/bg/ Frame 7310 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8c2914cd6e0c26e9fe3a9de23853632be1862891bf9bcfdda7053e1995319563
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 12:00:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
14059
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13627
x-xss-protection
0
last-modified
Mon, 11 Apr 2022 15:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 14 Apr 2023 12:00:10 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 8EB1 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BzbTbtUNYYu60CcOs9u8P_46R8AIAAAAAOAHgBAI&bg=!mJulm9_NAAZvJBiFTyQ7ACkAdvg8Wt7sFFgpzYYtJn3eFuOGM6KTolfXGclA2w3D-YHR5gn7XPm6_gIAAAHTUgAAAAdoAQeZAuwWlqntZp9I-zHHxtLftyJqv5heaupSoabW2cGxil6pGPrlKL7o8uANmmOx5kfkAzLtWn50RbtSlsD-xPS7pRMVVEBpw9AXZor10d5yOxc6LpF9s-145vLz8phWHrwsBoP-EWAscpidG9xYdyWEUeGht5YxW4Mo3Fnw3tA7JabUiiXt3uYzMDZZDsO_ikl1VT0w9bzR1ve2jOeUbusZ0WUJ0zYcttFLT_tdxdjaKUR3Lj7de2EY6eiX6okPiqT6WSFehngB2KOtzsdK9XASYT5h1DUr0sJzbqNtSc7FcmPuGx1dNReO7bv0xcJqoMkb0mvAhrk_ZZ_XSt2Obg-wkThB6ufL37m8uN8xASf8Kjz22crHF14YM3g6elZU1yNlaw0xT1VmZvP9oqCxf0TMaaLwMLpg2zSF1bO61OatRFNTVT3Hh27pYQaGtWthfAibzXobAal9uphTovoGEh5HkaMnBrlwnT8V81M5MXfkJKztXX6iOyPnMPj-lAQqLYS89SCMN-1EBbRBfPN7-FqZFn9ZHCz5bGFUbgCwBJOsqx97L8JtC0u4DJpjcMfeA_NnaDiNhMG6BvDLKQP_p38lq9GVv05fRQg2QiBlkmtc-GTAMBQhbafrRlcWjD_zrRhRGArOYL5ElBMPo6Fo3uk0j7RPYb8VAmvwQXC31Jk5fYGxmcHcn4V9jpt0Kb6IA0DQCzEDCUp9v6Es8ggzK30s3HGJmyl8frE1YFfYHm7KcH5uYw9FDuQVQtFdECIhvtwwbm2e8Pu45tYcychDFnPjQ-42TWBcduE4nnfU5gv-XM4TU1j7VZ449iTL1gsXvEUH-FQsq6nX_v6tlNT3Ru0jvnvaL5QtI0gdKunet7XJZrLZkhiiekUugGMfGWV9EhaY0hvjm92BY9nyIi_vpAtQUliy1xtWzSoI3C-5h_1koPmn-cXQwmGwf_MBfDapfoSnxOL43evkzuS2Sf3TDAoKLCSNJT-CZwJ196GV_Jkl
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 704E 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220412&jk=1170057833479159&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame C3C7 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
2772
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:08:18 GMT
expires
Fri, 14 Apr 2023 15:08:18 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame D51D 		783 B
534 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
f5312b6bb79c166acabd8d3351b0cd3c7dfc89665f6a50ee9408b6c533d5a7d7
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-lZrgAyhJA1KRAI6da7F0nA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://securityaffairs.co/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=300
content-encoding
gzip
content-length
512
content-security-policy
script-src 'report-sample' 'nonce-lZrgAyhJA1KRAI6da7F0nA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:54:30 GMT
expires
Thu, 14 Apr 2022 15:54:30 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
pagead2.googlesyndication.com/bg/ Frame 80C3 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8c2914cd6e0c26e9fe3a9de23853632be1862891bf9bcfdda7053e1995319563
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 12:00:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
14060
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13627
x-xss-protection
0
last-modified
Mon, 11 Apr 2022 15:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 14 Apr 2023 12:00:10 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame D51D 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220412&jk=2959394414853345&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers
gen_204
pagead2.googlesyndication.com/pagead/ Frame 721F 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BxYbRtUNYYoGOFIXq3gPVma3ADgAAAAA4AeAEAg&bg=!FxSlFFDNAAZvJBiFTyQ7ACkAdvg8Wgr2V1J3ZojcpsCajcdpFXRBTpAsYsIRgm_KRVo74yq11H1PTAIAAAEsUgAAAAFoAQcKADFUlszKkaL-gy7U4-UB6aZ4b7uaF3pvEQMb0WIrhh2YAl5LXcZbY2LEBmhKwFZSy_rZmQLXt5HxXz0hgI5ZkDacGBGPCz63KQudF6gLSi8h57iFcP7c9BiZTfXi9f-DSTBwlMdFyGPVLiax1mY8nI0wFmHw7DRSBda6WxYe8JiGfBM0ecnWamRDWwowaBcbJfvmH38QQYpWaHAvIjbNcTDIyxWcUR7f26YE1xDCqvkZimJMN9IKLDhxbawWGpJcQEGEARoHSxvavyYc0SKCpO9U2OvbqFZbNY99ZkNPddHuirqR3Ewbl2iI7-9BV5kPvXinv4-OX-ITZNj_-_BOk8aVvYvs_psv2UcaRLFwsTnG9g27jIHAG1Hq_glAQpiSRTyc8HUR56FASsVOY2TrNq68_MQbL3SL0xWVIy_IHu68SxPfB13cEAHd2eNgWKAFtNtM71o6uMNzPc_4Qmkwb_GQvRlyujMGg6Zh5RYhpxiFfZwpGm7CQpFjky6mpb5y2AzUzLgmNnzDnnKAI6gHIMErMj0qc64uR24UzuGJ5jAFboqqvnFzVIvozLoKINgpE6XB919tgHLABvT9xv_D5JMYUayDwh9OQagvspQ7mNlTjkrBOUYPSnQUD1KRmbG2EjOGsAtR0Re5EeWBwDLkrx1z3S-n6hr6afvuA1k7tzXq6Kpv0_b2uyH_65Sg5376RsAqYFf25w_zLWKQM02cjc6idzWG2_faIsczWjjA-YrTrkIP0hieyhXmQkIcPO0vnMAe-m2FKsXQ5RTU0f4JZJCLOQqMUGWByDys5Lpr0OhmPDAD_EydgyAYFA820sIyIXHzzRaqTkieLIh-f5vspReLHzHUPF7PWX91NDJJ0EgDr5O3yA-elMt_Zt_qcbFxsQ0tLxVbyNzz0_81PF9eApRy1Vb1PkWDg74Cb4TQnSCRfZ7tzOMcr1S5OLwORJU4OVUjQWV3Q_ZZfHH2o0jIXp8mwCuiYEdkMpha49PltTYjaWg0BXjaxsRMZAJI1UVh35vDpHlqC9hfG0StVg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=Internal_728x90_0.10&adk=1194620937&adf=1174745092&pi=t.ma~as.Internal_728x90_0.10&w=728&lmt=1649951668&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F130123%2Fapt%2Frussia-sandworm-targets-energy-facilities-ukraine.html&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649951668508&bpp=13&bdt=70&idt=99&shv=r20220412&mjsv=m202204060102&ptt=5&saldr=sa&correlator=5488069475642&frm=21&ife=1&pv=2&ga_vid=2002356130.1649951667&ga_sid=1649951669&ga_hid=75734682&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=320&ady=520&biw=1600&bih=1200&isw=728&ish=90&ifk=1435227353&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C44760475%2C31067052&oid=2&pvsid=3588828389046315&pem=197&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.arv5l61scydw&fsb=1&xpc=HUVeQKcNjK&p=https%3A//securityaffairs.co&dtd=116
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
pagead2.googlesyndication.com/bg/ Frame C3C7 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/jCkUzW4MJun-Op3iOFNjK-GGKJG_m8_dpwU-GZUxlWM.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8c2914cd6e0c26e9fe3a9de23853632be1862891bf9bcfdda7053e1995319563
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 12:00:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
14060
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13627
x-xss-protection
0
last-modified
Mon, 11 Apr 2022 15:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 14 Apr 2023 12:00:10 GMT
generate_204
tpc.googlesyndication.com/ Frame 80C3 		0
9 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?u1oWDw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:30 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
gen_204
pagead2.googlesyndication.com/pagead/ Frame EA91 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BmmTLtUNYYtCcGIOGjuwPjIag2A4AAAAAOAHgBAI&bg=!GBulG1_NAAZvJBiFTyQ7ACkAdvg8WpqAVedSiAGfUsrmRL0m5-hzz4M2_1cb_HOcVFmxezSKVU4RWgIAAADnUgAAAAJoAQeZAuIXsjiKw2cPiKUnxidyEp2zTWZmJI8w_MiLia4sU5yZYuIrqDu1ekqA5-eYf_DOlJ9N1IjeCZ3STK17XtVYdkz1Jvhr7lnqWeNuxHsvcocXyviEMGb6St8WiMs31gPEjDApN4g1ND_T_by8kp4Oy7DLAq5Q6XcRjHc_FK3e6CkibZbr1r8dmbzfJLMm9hpLsH-zWxMPecaq21jv4gOu5PihIsmxKRQdaLrj5pICP1QO_puXqTS77SfIeoi9K0lMBj3pBilGrJv3WN0BIXDB2mes1mX8md5m_9zavVvR64FWwnCjtjPH6wQVSkQXmrsanQOGmX1ZGc5liRj4QJydltZNMXGeBy1DNYYT2vFfCfa1plXvbdf65a91YBv62ZJLfckd_8XMvNh-irLTkjWUWeUIDoY_RcTASAU9nam18Uj8FY8a3bwbYuBeB6T92yKslWNHmm-Rf3gX2uckOoFGfkVENQXrK2uwcdDQaZoUCJXzEXTyXLKzfK-mL1US7HDUFQ9HSnqcw8FipxyuLMQOnmJDXDwLOoPdrVRKMAgC0RW5AA9S073ufeawz0GLAR5b9xw83cVjkTPr1dsyilZYxpjbKj7x5gti4MStDPFT7EpPN7esF9Ei8ThEhN-mwgcwdAR5aaDav70g6o6VMB9uAke9bD5mcMZIyfmOJBUCIBG1Uc7xl6tSU8Th6TlVd-hkWdkK4T81WIUML6wldjCFXCQT7tktJ-BqYW0sJTEqmiyjZwDAvH-rQ0Fx0pyuKkliB-KI6xUqa5SzbLpeIvrbFbmBRlt_jwD3vCcmPHYrhU-FLZofXzIhme9gPdPPY8Uw50KGLioe2Q0zdlUdGVvsjdb4W-TQKclSyl8EUP31_9tpDDsTGemdOJJ7cp2RBRgXy1c1HIAKZ3Ts3wXktP5R_bXWaY6i5JYb9c84l5vOvTg_ggS2tRhmYCZRWZERVAr6fG2j1Vs1L-N4GYP9WvfucGjZ8ik
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
generate_204
tpc.googlesyndication.com/ Frame C3C7 		0
9 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?O4CZIQ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:30 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
match
c1.adform.net/serving/cookie/ Frame B33A 		35 B
468 B 		Document
General
Check archive.org
Download Go to
Full URL
https://c1.adform.net/serving/cookie/match?party=14&cid=259147D8-7EFA-450F-8AD8-7BA5CF40924F
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.3.29 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
content-type
image/gif
date
Thu, 14 Apr 2022 15:54:30 GMT
expires
-1
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
Pug
simage2.pubmatic.com/AdServer/ Frame 3A38
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YlhDtgAUjGeeagAy&gdpr=0&gdpr_consent=&_test=YlhDtgAUjGeeagAy
1 B
389 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YlhDtgAUjGeeagAy&gdpr=0&gdpr_consent=&_test=YlhDtgAUjGeeagAy
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
1
content-type
text/html; charset=utf-8
date
Thu, 14 Apr 2022 13:41:15 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
x-lat
sfopug019:0:277

Redirect headers

accept-ranges
bytes
cache-control
no-cache
content-length
0
date
Thu, 14 Apr 2022 15:54:30 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YlhDtgAUjGeeagAy&gdpr=0&gdpr_consent=&_test=YlhDtgAUjGeeagAy
pragma
no-cache
retry-after
0
server
Varnish
via
1.1 varnish
x-cache
HIT
x-cache-hits
0
x-served-by
cache-hhn4058-HHN
x-timer
S1649951671.861526,VS0,VE0
Pug
simage2.pubmatic.com/AdServer/ Frame EF24
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:be246258-43b4-4200-9484-9771ee1131e4&gdpr=0&gdpr_consent=
42 B
498 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:be246258-43b4-4200-9484-9771ee1131e4&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Thu, 14 Apr 2022 13:40:55 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
x-lat
sfopug008:0:559

Redirect headers

Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
Date
Thu, 14 Apr 2022 15:54:30 GMT
Expires
Thu, 14 Apr 2022 15:54:29 GMT
Keep-Alive
timeout=360
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server
MT3 4335 2c68c00 master ord-pixel-x49 config:1.0.0
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:be246258-43b4-4200-9484-9771ee1131e4&gdpr=0&gdpr_consent=
adx
match.prod.bidr.io/cookie-sync/ Frame 1F28
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFISGIwN0VzSWNBQURtcU9oT3drUQ&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sy...
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
43 B
430 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.228.20 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-171-228-20.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Length
43
Date
Thu, 14 Apr 2022 15:54:30 GMT
Server
nginx
cache-control
no-cache, must-revalidate
content-type
image/gif
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma
no-cache
strict-transport-security
max-age=2592000; includeSubDomains

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
355
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:54:30 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
location
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
HTTP server (unknown)
x-xss-protection
0
bridge
cm.adgrx.com/ Frame 4D32 		43 B
408 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.251.232.165 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
Cowboy /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate, proxy-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Thu, 14 Apr 2022 15:54:30 GMT
Expires
Thu, 23 Sep 2004 17:42:04 GMT
P3P
CP="NOI OTC OTP OUR NOR"
Pragma
no-cache
X-RealServer-NX
ams-delivery-9
server
Cowboy
usersync.aspx
dis.criteo.com/dis/ Frame 2948 		43 B
363 B 		Document
General
Check archive.org
Download Go to
Full URL
https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache
content-type
image/gif
cross-origin-resource-policy
cross-origin
date
Thu, 14 Apr 2022 15:54:30 GMT
expires
Thu, 14 Apr 2022 00:00:00 GMT
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
440613
strict-transport-security
max-age=31536000; preload;
x-errorlevel
0
141
match.deepintent.com/usersync/ Frame 6FCD 		0
44 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software
c /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
0
date
Thu, 14 Apr 2022 15:54:30 GMT
server
c
Pug
simage2.pubmatic.com/AdServer/ Frame B55B
Redirect Chain
  • https://ums.acuityplatform.com/tum?umid=6
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=663174453031
42 B
515 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=663174453031
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Thu, 14 Apr 2022 13:40:52 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
x-lat
sfopug009:0:408

Redirect headers

access-control-allow-origin
*
content-length
0
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=663174453031
Pug
simage2.pubmatic.com/AdServer/ Frame 2585
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:Sw6PvsyN1NF1NI5&gdpr=0&gdpr_consent=
42 B
366 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:Sw6PvsyN1NF1NI5&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Thu, 14 Apr 2022 09:17:11 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
x-lat
sfopug010:0:391

Redirect headers

Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Date
Thu, 14 Apr 2022 15:54:30 GMT
Expires
Fri, 01 Jan 1990 00:00:00 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:Sw6PvsyN1NF1NI5&gdpr=0&gdpr_consent=
Pragma
no-cache
Server
PingMatch/v2.0.30-713-gdae83a2#rel-ec2-master i-04fd973f611872bb0@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
noop
px.owneriq.net/ Frame 5EB5
Redirect Chain
  • https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
  • https://px.owneriq.net/noop?ct=image%2Fgif
0
287 B 		Document
General
Check archive.org
Download Go to
Full URL
https://px.owneriq.net/noop?ct=image%2Fgif
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.75.246.168 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-75-246-168.deploy.static.akamaitechnologies.com
Software
Apache/2.4.6 (CentOS) / PHP/7.3.33
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Length
0
Content-Type
image/gif
Date
Thu, 14 Apr 2022 15:54:30 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server
Apache/2.4.6 (CentOS)
X-Powered-By
PHP/7.3.33

Redirect headers

Connection
keep-alive
Content-Length
0
Date
Thu, 14 Apr 2022 15:54:30 GMT
Location
https://px.owneriq.net/noop?ct=image%2Fgif
Server
AkamaiGHost
i.match
s.tribalfusion.com/z/ Frame B073
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...
43 B
418 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:230b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache private
cf-cache-status
DYNAMIC
cf-ray
6fbd9ed65cd63746-MXP
content-length
43
content-type
image/gif; charset=utf-8
date
Thu, 14 Apr 2022 15:54:30 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
Thu, 01 Jan 1970 00:00:00 GMT
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
x-function
302

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache private
cf-cache-status
DYNAMIC
cf-ray
6fbd9ed4e9613746-MXP
content-type
text/html
date
Thu, 14 Apr 2022 15:54:30 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
x-function
206
x-reuse-index
62397
usersync
match.bnmla.com/ Frame 4F3B 		0
114 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.bnmla.com/usersync?sspid=10738&redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw%26piggybackCookie%3D%5BUUID%5D
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
38.27.122.101 Chestertown, United States, ASN174 (COGENT-174, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Length
0
Date
Thu, 14 Apr 2022 15:54:30 GMT
Server
nginx
Pug
image2.pubmatic.com/AdServer/ Frame 221B
Redirect Chain
  • https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=dcf50319-3ed8-492a-a1ae-d3d652c740c8
1 B
165 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=dcf50319-3ed8-492a-a1ae-d3d652c740c8
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
1
content-type
text/html; charset=utf-8
date
Thu, 14 Apr 2022 08:27:10 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
x-lat
amspug0028:0:286

Redirect headers

content-length
0
date
Thu, 14 Apr 2022 15:54:30 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=dcf50319-3ed8-492a-a1ae-d3d652c740c8
strict-transport-security
max-age=15724800; includeSubDomains
pbmtc.gif
beacon.lynx.cognitivlabs.com/ Frame 5788
Redirect Chain
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=6560be7e-c5a9-43a2-ac58-f12ad823d6a0&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=259147D8-7EFA-450F-8AD8-7BA5CF40924F
42 B
352 B 		Document
General
Check archive.org
Download Go to
Full URL
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=259147D8-7EFA-450F-8AD8-7BA5CF40924F
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.199.37.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-199-37-161.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
42
content-type
image/gif
date
Thu, 14 Apr 2022 15:54:31 GMT
server
Kestrel

Redirect headers

cache-control
no-store, no-cache, private
date
Thu, 14 Apr 2022 08:12:05 GMT
location
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=259147D8-7EFA-450F-8AD8-7BA5CF40924F
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
x-lat
sfopug024:0:385
Pug
simage2.pubmatic.com/AdServer/ Frame 7601
Redirect Chain
  • https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={device_id}&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
0
107 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 14 Apr 2022 13:50:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
x-lat
sfopug020:2:289

Redirect headers

content-length
0
date
Thu, 14 Apr 2022 15:54:30 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={device_id}&gdpr=0
server
_
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame DBC6
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=JZFH2H76RQ-K2Hulz0CSTw%3D%3D
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
184.87.212.214 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-87-212-214.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:30 GMT
content-encoding
gzip
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
server
Apache/2.2.15 (CentOS)
etag
"1300708-3de4-5d6ef246ef4cf"
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=43568
accept-ranges
bytes
content-type
text/html; charset=UTF-8
content-length
5549
expires
Fri, 15 Apr 2022 04:00:38 GMT

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
272
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
420486.gif
idsync.rlcdn.com/ Frame DBC6 		0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/420486.gif?partner_uid=259147D8-7EFA-450F-8AD8-7BA5CF40924F
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:30 GMT
via
1.1 google
alt-svc
clear
content-length
0
SPug
image4.pubmatic.com/AdServer/ Frame DBC6
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=be246258-43b4-4200-9484-9771ee1131e4
0
48 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=be246258-43b4-4200-9484-9771ee1131e4
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:30 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Thu, 14 Apr 2022 15:54:30 GMT
Server
MT3 4335 2c68c00 master ord-pixel-x55 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=be246258-43b4-4200-9484-9771ee1131e4
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Thu, 14 Apr 2022 15:54:29 GMT
Pug
image2.pubmatic.com/AdServer/ Frame DBC6
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MjU5MTQ3RDgtN0VGQS00NTBGLThBRDgtN0JBNUNGNDA5MjRG&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
341 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
cache-control
no-store, no-cache, private
x-lat
amspug006:0:420
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame DBC6
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJ8aU8eFVA1SltomfSndR_k&google_cver=1
42 B
281 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJ8aU8eFVA1SltomfSndR_k&google_cver=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
cache-control
no-store, no-cache, private
x-lat
amspug010:0:1048
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJ8aU8eFVA1SltomfSndR_k&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubmatic
um.simpli.fi/ Frame DBC6 		43 B
610 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
169.50.137.182 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
b6.89.32a9.ip4.static.sl-reverse.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:30 GMT
x-content-type-options
nosniff
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
43
expires
Wed, 13 Apr 2022 15:54:30 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame DBC6
Redirect Chain
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7357394540411526230&gdpr=0&gdpr_consent=&us_privacy=
1 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7357394540411526230&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 13:40:45 GMT
cache-control
no-store, no-cache, private
x-lat
sfopug018:0:379
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7357394540411526230&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Pug
simage2.pubmatic.com/AdServer/ Frame DBC6
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=9ea79823-2611-4b51-88b2-d42fdb532721
42 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=9ea79823-2611-4b51-88b2-d42fdb532721
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
cache-control
no-store, no-cache, private
x-lat
sfopug022:0:303
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=9ea79823-2611-4b51-88b2-d42fdb532721
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
313
259147D8-7EFA-450F-8AD8-7BA5CF40924F
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame DBC6 		43 B
990 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/pubmatic/259147D8-7EFA-450F-8AD8-7BA5CF40924F?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:d29:3605:9b3d:59c:490d:6d21 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:30 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
SPug
image4.pubmatic.com/AdServer/ Frame DBC6
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=259147D8-7EFA-450F-8AD8-7BA5CF40924F&redir=true&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-k7jZGuxE2uUsuqYKh72VM0GbkIq_Uds-~A&gdpr=0&gdpr_consent=
0
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-k7jZGuxE2uUsuqYKh72VM0GbkIq_Uds-~A&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:30 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-k7jZGuxE2uUsuqYKh72VM0GbkIq_Uds-~A&gdpr=0&gdpr_consent=
date
Thu, 14 Apr 2022 15:54:30 GMT
server
ATS/9.1.0.46
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Pug
image2.pubmatic.com/AdServer/ Frame DBC6
Redirect Chain
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6686298214416655647&gdpr=0&gdpr_consent=
42 B
313 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6686298214416655647&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:29 GMT
cache-control
no-store, no-cache, private
x-lat
amspug020:0:523
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:30 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
c5242f67-309e-4194-b881-e4d9ea48005c
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6686298214416655647&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame DBC6
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=2bc6e580-bc0b-11ec-b297-832d259745f8&gdpr=0&gdpr_consent=
1 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=2bc6e580-bc0b-11ec-b297-832d259745f8&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 13:40:31 GMT
cache-control
no-store, no-cache, private
x-lat
sfopug006:0:388
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=2bc6e580-bc0b-11ec-b297-832d259745f8&gdpr=0&gdpr_consent=
Date
Thu, 14 Apr 2022 15:54:29 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
Content-Length
0
X-CI-RTID
2bc6e581-bc0b-11ec-b297-832d259745f8
current
pubmatic-match.dotomi.com/match/bounce/ Frame DBC6 		0
103 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=259147D8-7EFA-450F-8AD8-7BA5CF40924F&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
expires
0
pixelSync
pixel-sync.sitescout.com/dmp/ Frame DBC6 		0
191 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
66.155.71.25 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:29 GMT
cache-control
max-age=0,no-cache,no-store
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires
Tue, 11 Oct 1977 12:34:56 GMT
Pug
image2.pubmatic.com/AdServer/ Frame DBC6
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=fV-4eX9e73RmCe91clmgc3pf6XRmC-twc1vNbgvZ
42 B
466 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=fV-4eX9e73RmCe91clmgc3pf6XRmC-twc1vNbgvZ
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 08:28:30 GMT
cache-control
no-store, no-cache, private
x-lat
amspug0024:0:571
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=fV-4eX9e73RmCe91clmgc3pf6XRmC-twc1vNbgvZ
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame DBC6
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=3775857252217606419
42 B
540 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=3775857252217606419
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 07:56:17 GMT
cache-control
no-store, no-cache, private
x-lat
sfopug023:0:570
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
server
nginx
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=3775857252217606419
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
Pug
simage2.pubmatic.com/AdServer/ Frame DBC6
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://px.adhigh.net/p/cm/bsw?u=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&bidswitch_ssp_id=pubmatic
  • https://px.adhigh.net/p/cm/bsw?u=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&bidswitch_ssp_id=pubmatic&bounced=1
  • https://x.bidswitch.net/sync?dsp_id=9&user_id=M2gRQqD2odl.AikABlGAKMiBIw&expires=30&ssp=pubmatic
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&gdpr=&gdpr_consent=&gdpr_pd=
1 B
338 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 13:40:33 GMT
cache-control
no-store, no-cache, private
x-lat
sfopug014:0:370
server
nginx
content-type
text/html; charset=utf-8
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
//simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=eb7baafa-fb67-4d6d-b2cb-1700a18fcadc&gdpr=&gdpr_consent=&gdpr_pd=
Date
Thu, 14 Apr 2022 15:54:30 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
sn.ashx
pmp.mxptint.net/ Frame DBC6
Redirect Chain
  • https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R1B342_EE52EA7D_3519F7F4&r=https://pmp.mxptint.net/sn.ashx?ak=1
  • https://pmp.mxptint.net/sn.ashx?ak=1
43 B
266 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pmp.mxptint.net/sn.ashx?ak=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
HTTP/1.1
Server
204.2.255.233 , United States, ASN2914 (NTT-LTD-2914, US),
Reverse DNS
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Strict-Transport-Security max-age=-332938471; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:30 GMT
Cache-Control
no-cache
Expires
-1
Content-Length
43
Strict-Transport-Security
max-age=-332938471; includeSubDomains
Content-Type
image/gif

Redirect headers

location
https://pmp.mxptint.net/sn.ashx?ak=1
date
Thu, 14 Apr 2022 08:21:43 GMT
cache-control
no-store, no-cache, private
x-lat
sfopug025:0:412
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Pug
simage2.pubmatic.com/AdServer/ Frame DBC6
Redirect Chain
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=6686298214416655647
42 B
187 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=6686298214416655647
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Server
104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 13:40:27 GMT
cache-control
no-store, no-cache, private
x-lat
sfopug004:0:304
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:30 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
fe8b8531-0de9-462d-9f80-a7340347f965
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=6686298214416655647
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 7A4F 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu2O_Vw2fvcDsPj0MwPeF2bwDCGhGcx0N4D2m3-NyEQYFMtBYFsqGuZ2kj-mnUHPrXyEZeKWrKFvxMPEvTzbYBMWy0o4sUGouET3IQFEIk7m7jzGLHThw&sai=AMfl-YRqYRe7b-r3S8SMyku99L3eMRuLwTlNyHlPxUeL6qfVMIZEfg086drk_pa9fsYXEwXoXPB415nP8K0gzlyH2WBXfDk-lq1m1PM&sig=Cg0ArKJSzC0CS6WdXJKyEAE&cid=CAASEuRoLv-GyL05TVBaCUCDxb5UAg&id=lidar2&mcvt=1002&p=0,0,50,320&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20220411&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=468307373&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1649951668679&rpt=849&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 10CF 		0
743 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:30 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
fc8f4076-03fc-43a6-b953-e223b1751a24
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 0695 		0
743 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:30 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
61b0703e-bd5f-477c-aa67-f6d2ec45720f
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame CF31 		0
743 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:30 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
1d1c797e-8f64-4396-ab61-71f1d7170478
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 35E0 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220412&jk=1170057833479159&bg=!NTalNnLNAAZvJBiFTyQ7ACkAdvg8Wi8CaGOgDjgCGeCgffAXNDzJZpcuJTDDWBVNejnOnvwldEYe3wIAAACWUgAAAAJoAQcKAL10QTGDxJ4wFNiIFWX0elkrPXpHB-jlhkFl7Otl4zH4aRciMZIb4SxGbfyAazjleo3K3KCMO6ubSImCMCmKoc-th4FtN91QEO_-mQOxEPk1CxTmAKtfRGI5gCybvLYuUwxOD2DJEvrcyQ_2cw6nH_rLc5KmAskMsER-XhdlS6k8UE5Mk29WsF8Y76LggN3XSFJHrY2i8u_iW_ytZhEiddF4H5lFaq-cmsY_fjNlU94gP7_fLjHJoLJrnVeIg3-ZArw9lvkxepprhzjkAIts1PBeslTHLiRuQz-C3TuhYvNllbpXQtapTXwLbFNMCqJQpcnNjz5Hc0_dt5yhdnxHcjhHPKhQzUsnHD0NQ4g2iOxHZ9TwufitrModICitKEh0ntOrlFnpmsZF7Xv6jyJirWZgegwyQF-jH_iO55ejHNFzf1oVY8xyWMyjnpq_3b_G64qeDSCT4IZ8VivnIveWJOIeKpJ-Wpc4AqsvHM7LH5efTKA9yXeaecZFpyhCbvpdzrG8hQAsit-URbu8TuUsyf8rJeLiWwc_C4PdT0aX8Oxcd5_TDmsYB1pjKewYH-NHpURBhEVcRsJZVGIGCrH28DTbn51FgKbeiEuvmFIAamX6ReWYSPEHnU9B-vL2KWFX7d77oALOpBsWDrKxVIk-Q8gn-TwG-TLdJh4r7veAsHG51aFtfdtzaeghCbBBiOiidOxRuhce5BIAqvwzR61Y2aFDcTIvCZYmUq6VZd-NO-3o2XjevseYsPF8jtDJjsMYEALBENDUJVGKiWJAunh4VGGd87ahD37lZbrzjkct2oLDZtCu_6UusufMqfBS2zZtEFo8CJDISkH2WuWcHwh53d_AlcdUXb6B7yMy_uBhIDEKR55Cf8nWIxx5N4eI1fZ8W_aCWk4Rpe9_q7m2jy4TTkKPnOnh0xDmDGu3WsrtXjX7CP3wE--c-GH0HNpt6w8jRawlIypdATi3_PAiPkvetC-ma-vYOz1jcJOQLIHehxbI33GoBLGEzy_bLxiIMV-PYyEKuOwyChesgHDbRoA359MihQyX4LEc7DoCc3KR3-bGqftHT7j-z04RSI5zWa1BkvwBeUBYKWRUNNFUTv4AiXyMLjiP6XCuWTS_jLUdHKRV9rgjCw6ooIE8kW0qRfKOxwEgdVtWq6U5FXqCMNxyffzd086-UjIutaLz2nkI
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 87E6 		0
743 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.14 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 14 Apr 2022 15:54:30 GMT
X-Proxy-Origin
146.70.117.69; 146.70.117.69; 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
8853a529-4b0f-4898-beef-e0516632988c
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 1E81 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220412&jk=2959394414853345&bg=!jI-lj8vNAAZvJBiFTyQ7ACkAdvg8WrOyId-7CYzW0EHZC2IgRhWnuGyt9lzY_f_CMg3WRIAr26teDAIAAABgUgAAAANoAQeZAscslsqXhag1-yIBdLS1KlmuO_m6x-KiZLmI5bm8XzzfjJ5VyQ_akrvfmeYHS1cct4ra7G0vxd84ClVuHi7hQyS-FBvEnAvhyXYMvwc4uoqq84pwLYtinL1Fkkwanpj8j8tI6jO9jkJR3vXNh1GYNeHR6RrR72xQKRaKCsf-jAlLeUTzJxX2Mls1fVqgGuo_AYvReHWG9A09t004HorDxAPe30E_FMbk1f2jF53Dh2_TV-y7cwiCueMo8X9FDHxyUIOV5Fkhi-FsFlhwkOXMuuRXhXvEAwFFouEqgBM-c3799-26fE2NWJHlF6W6Z-mb9X1TG8W7Url0QJd3_2_71s0LVXquCM6A1rqdpqCVM4luciXc5QBNvB-Na_rrdil9T7S1R4MNja8PpHksjtMvZz_1MTdLr-Twfi_LLDeZpMxyP3x4Bi5kV-F7ieEfPzCuO6niGOtuLt8ItthSTXI6iX7DUk8nOhdcZIb95LpQ-lbLWx9Z1vpqeO0v_pYL4VLGS9IRcQyc5HUAdfhMQBN7vrvA2Ed9tUpTgs-ZWrlbnVYD-cpbqnnjrRkqMyd_RrzarShwfg4mo24M1rQ8YZIISXmPRg7nsSmv_r66hNFO1EMZrom3rmnp5-cXXk1aQOyaquTEQ-pQudqsKlf8M-_wuQPCW4P4zfqULnvqksvZ7CZBdyTp-EuI1N314uYzghSH4wT1XJ1-08u5dHn46REWSTfueO3bnYletYlPqaqqmrveVWP-bVWcSmiXNmMuPi0-bP28724ucZ-VKi9yMN7cxFu1mVCVxpFlqKLkkVa3872-7fL5oI2KAvp2LZvQbmyJitWpw8dII7VyL8Tdsabj8RH3JwymSCEIp-JTCznLl2Gysq5WgXsOPX95BtpTfILYvOete52FyHeC-U5y8CJJEiFnRL6HLTSyYVhibBBm6awUHnUkQd6TVj4
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 14 Apr 2022 15:54:30 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
SPug
simage4.pubmatic.com/AdServer/ Frame DBC6 		0
128 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=158127&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158127
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 15:54:32 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
PugMaster
image6.pubmatic.com/AdServer/ Frame A08C 		0
0
PugMaster
image6.pubmatic.com/AdServer/ Frame 63C8 		0
0
PugMaster
image6.pubmatic.com/AdServer/ Frame D776 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=225d2128214efd4cb439b1095d30ca5b
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=225d2128214efd4cb439b1095d30ca5b
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=225d2128214efd4cb439b1095d30ca5b
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=225d2128214efd4cb439b1095d30ca5b
Domain
api.rlcdn.com
URL
https://api.rlcdn.com/api/identity/envelope?pid=c2d18b01-4905-4aba-a83e-e41eac932694
Domain
pagead2.googlesyndication.com
URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Domain
us-u.openx.net
URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMQL3bbNFBkePQwnDza8sic&google_cver=1
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ
Domain
image6.pubmatic.com
URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=46950998&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Domain
image6.pubmatic.com
URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=30399443&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Domain
image6.pubmatic.com
URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=3580152&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=

Verdicts & Comments Add Verdict or Comment

135 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| 25 object| 26 object| 27 object| 28 object| 29 object| 30 object| 31 object| 32 object| 33 object| 34 object| 35 object| 36 object| 37 object| 38 object| 39 function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails object| _wpemojiSettings undefined| $ function| jQuery object| Cli_Data object| cli_cookiebar_settings object| log_object object| CLI_Cookie object| CLI object| cliBlocker string| CLI_ACCEPT_COOKIE_NAME string| CLI_PREFERNCE_COOKIE number| CLI_ACCEPT_COOKIE_EXPIRE boolean| CLI_COOKIEBAR_AS_POPUP object| mnetCustomerData function| injectMnetScript object| _mNHandle string| medianet_versionId object| stlib boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus boolean| sop_pview_logged string| stWidgetVersion object| stLight boolean| st_showing object| st object| __stdos__ function| __sharethis__docReady object| __sharethis__ string| GoogleAnalyticsObject function| ga object| dataLayer object| WPCOM_sharing_counts object| click_object object| Main object| BrowserDetect object| mejs function| onYouTubePlayerAPIReady function| onYouTubePlayerReady function| MediaElement function| MediaElementPlayer function| $j function| imagePreview object| sharing_js_options object| WPCOMSharing undefined| windowOpen object| _stq function| st_go function| linktracker_init object| wpcom string| currentText string| categoryCookie object| categoryCookieValue object| cli_chkbox_elm string| cli_chkbox_data_id string| cli_chkbox_data_id_trimmed object| FB object| wp object| twemoji object| _mN object| _mNSrv function| setup string| _mN_Idf string| _mN_ctrM number| _mN_ctr object| mnjs object| _mNDetails function| _cmL1Require function| _cmL1Define undefined| _mNE object| _mNadPrvLog object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| google_tag_manager object| displayPlacement_PF_script boolean| pixfuture_environment_started function| init_____display____pixfuture function| onYouTubeIframeAPIReady boolean| isPending string| prebid_file function| findCMP_PixFuture function| pbjs_pixChunk object| pbjs_pix object| _pbjsGlobals object| mnet object| google_reactive_ads_global_state object| google_ad_modifications number| google_global_correlator object| google_prev_clients object| googletag

106 Cookies

Domain/Path Name / Value
securityaffairs.co/ Name: cookielawinfo-checkbox-necessary
Value: yes
securityaffairs.co/ Name: cookielawinfo-checkbox-non-necessary
Value: yes
securityaffairs.co/ Name: session_depth
Value: securityaffairs.co%3D1%7C816788371%3D2%7C184323154%3D1%7C647633027%3D2
.securityaffairs.co/ Name: _gid
Value: GA1.2.118594899.1649951667
.securityaffairs.co/ Name: _gat
Value: 1
.securityaffairs.co/ Name: _ga_P62M3QN974
Value: GS1.1.1649951667.1.0.1649951667.0
.securityaffairs.co/ Name: _ga
Value: GA1.1.2002356130.1649951667
securityaffairs.co/ Name: _pbjs_userid_consent_data
Value: 3524755945110770
securityaffairs.co/ Name: _lr_retry_request
Value: true
securityaffairs.co/ Name: _lr_env_src_ats
Value: false
.rubiconproject.com/ Name: khaos
Value: L1Z6MEPG-1-2I93
.rubiconproject.com/ Name: audit
Value: 1|hLZGFuTafB3uNmWC2JGYL/sKGGM1eolu5vVtDhgOVUO/zJBpTbUTSz10mApVed9M5FGfGNePc3/th4iWCi6WjspbV3mhqimWXjmaZkH7bMyyqVI1k5poNA==
.adsrvr.org/ Name: TDID
Value: 9ea79823-2611-4b51-88b2-d42fdb532721
securityaffairs.co/ Name: pbjs-unifiedid
Value: %7B%22TDID%22%3A%229ea79823-2611-4b51-88b2-d42fdb532721%22%2C%22TDID_LOOKUP%22%3A%22FALSE%22%2C%22TDID_CREATED_AT%22%3A%222022-04-14T15%3A54%3A27%22%7D
.adnxs.com/ Name: icu
Value: ChgI3sJXEAoYASABKAEws4fhkgY4AUABSAEQs4fhkgYYAA..
securityaffairs.co/ Name: cto_bidid
Value: QwiGT19ndiUyRkNoYXVPUlgyTzE4VCUyQmRsbU1GMmM1Smd5YUR3dWh0T3ZvOE9VWm5PeFFTNTVaN3RQbUJ4bVRPZ0d1TW0lMkZOTm95Z3ZQM2k2RW03VlV0STh1dnFVUSUzRCUzRA
securityaffairs.co/ Name: cto_bundle
Value: 6QuI0182QVhBS3RhcElXVGJmb2pHZTFYNnFYMzNSQ2tta09Fa1V2bGtUOWljYUd6U2N4VTlpQU9ldThnWVp3eXNPN1JVcjlnRVglMkZLdWRRRWJuOWhkcW5TdkZBQkdaSm4xQWZmVGlRbFl4MnhLV2xUNVFTRFpTTyUyRlhRVEdERGJGWElxV2Y
.adnxs.com/ Name: uuid2
Value: 6686298214416655647
.go.sonobi.com/ Name: HAPLB5A
Value: s56129|YlhDt
ads.us.e-planning.net/ Name: CT
Value: 1
.e-planning.net/ Name: E
Value: ADlNKkfZw6sx6xbJ
.advertising.com/ Name: APID
Value: UP2a3a52c3-bc0b-11ec-a35c-02f04bb15154
.yahoo.com/ Name: A3
Value: d=AQABBLRDWGICEF6Ts5L7kYHCe3x6tcbWot4FEgEBAQGVWWJiYgAAAAAA_eMAAA&S=AQAAAqP--QHY0sHXCTX7ynLzdgg
.adform.net/ Name: C
Value: 1
.bidswitch.net/ Name: tuuid
Value: eb7baafa-fb67-4d6d-b2cb-1700a18fcadc
.bidswitch.net/ Name: c
Value: 1649951668
.bidswitch.net/ Name: tuuid_lu
Value: 1649951668
.doubleclick.net/ Name: IDE
Value: AHWqTUnLftFXBWjJyl59CriHAYpWmt5-720GF_h8SXVfQWUCfZfrmnuIIjQ6ye8ZT1Y
.adform.net/ Name: uid
Value: 3775857252217606419
.mathtag.com/ Name: uuid
Value: be246258-43b4-4200-9484-9771ee1131e4
prebidserver.pixfuture.com/ Name: uids
Value: eyJ0ZW1wVUlEcyI6eyJlcGxhbm5pbmciOnsidWlkIjoiQURsTktrZlp3NnN4NnhiSiIsImV4cGlyZXMiOiIyMDIyLTA0LTI4VDE1OjU0OjI4LjYzNjk4ODM0M1oifX0sImJkYXkiOiIyMDIyLTA0LTE0VDE1OjU0OjI4LjYzNjk4MTY1MVoifQ==
.securityaffairs.co/ Name: __gads
Value: ID=98d527db41f31ec4-229aaa5f75cd0014:T=1649951668:RT=1649951668:S=ALNI_MYsWKrQ5gegTSAOX9m-LmblYuvwWA
.adnxs.com/ Name: anj
Value: dTM7k!M41.D>6NRF']wIg2ImSs)JwV!A#Fc.TOKKnyW<U1`VROYQM-:BF#oxL)]>nK!x)9CdQH(Z:Y_Z9+?@Mu7sof/X%W#.wL4W1Qw1IJZ]@I
.casalemedia.com/ Name: CMPS
Value: 3165
.lijit.com/ Name: ljt_reader
Value: 23f4cd250a0c1414891cbf59
.casalemedia.com/ Name: CMST
Value: YlhDtWJYQ7UA
.adfarm1.adition.com/ Name: UserID1
Value: 7086488458340532675
.eyeota.net/ Name: SERVERID
Value: 23460~DM
.casalemedia.com/ Name: CMID
Value: YlhDtc7SBXlBIe4o-vL60wAA
.casalemedia.com/ Name: CMPRO
Value: 1185
.casalemedia.com/ Name: CMRUM3
Value: 2d625843b52760CAESEGvyBNpI5lnBceFazxOws8E
.audrte.com/ Name: arcki2_ddp
Value: CAESENyZkKUiku_t5L1UkLR1r04!20210804!1649951669417
.spotxchange.com/ Name: audience
Value: 2b110c69-bc0b-11ec-9038-1bf9ad920206
.audrte.com/ Name: arcki2_adform
Value: 3775857252217606419!20210804!1649951669520
.audrte.com/ Name: arcki2_TTT
Value: 1649951669521!cmek0bTl2v6RxyJ7Gb4ky-kOA!H4sIAAAAAAAAAB2WyXFEIQxEg+GsKhACRDhsyj+EeX8OLns8LFKrF3ov68XOsvPsUtdt4q2pRPc5s03dy1LuT+tdR66+KTX2kqllyZ713FavRtmp7KzR7Ija2mKvXJkvstjtUcuJtmOmu6uxK4uu7WJ7XPGZr7S5real4+6RatcefZm8d7LUuq/sqCGjzzrtrlunpnO550SVZ6ysMy9xXyrF956xe8u7pOXnbm8uL1O98V/Z3rto1ubFRsm1p5h7PC1PbOkU61llTaU7b+WOlUd9K+lrx+dROa+zaD9O4irJPrffFm9HS93BJrLJaMPBSYdM28FKGnLfdm9J881lq29Z8S3yNmUdCpunl/GKvWyRmt8CqJzklcIes5llF+ma7z5nWXhP/T1A4JLm84o1EJ3nDvFa89sv37xPOhbae0yJW0F82pTZY3NwLOpY+5aZrPjzeo/0OZ7Ul0MYPqSIfoptLdU0Fb1jaz5sZfbWzYRdW0LvPXrOGN7S0BGnhglYc110FV/FpI35bJZHK5reeUy6Lsm3DrHC7GbOWdwocu7m6940xht1rSZ30b1BRRYtFvVyy+rA8VpapXSwAOftKvW0JcwcKuQ8a2E7A0lvlgxHTfhoYoMzGX6Wlcu6+43sPhOUycvLN+D9ddevrKZF/EJNeq3HVypZT68v5M4ZqGUfcZgt7e378u7sbcwOFRQHggri9XqFANcEedy+tWUYnZaNfXKd0uup8MkovLctetqxW2qEMpZrzhyLqK7LSbkjublkFJiS/aCBkk7f8H5wSD9w/Co4jT3lxbVnMDKbp2q1t2D/YVLfIiRVN8yaXR1CotBIr0y37Hy1KscxcyDwLO+W3TffdY2ko8VcDcn9Zb5ql1XXlNZ1aOnP9cykDVQVCGvv45tdgGP+SJG7b9VaR019ntYfh6D5EENnMicDDD8e+5i7PRTs66gGzPRPwZuaVkY8PfJdZp/+UhsPqxjgNPASc4i8uAOw7mS/G3pM00FiFxbtDZ9KOwjBqV4XmoZV6740I8bRu0Tvx6cG22cGrAlO5Y3YeFCiifBvDoilwPHPDr/q3XubUe4aelN+bazB2GMOIBhWv5omNfHrM4S6HuLM7fBB6kC3DAkb0Mui0tRwXGaGEHQGvkvhj7FWLy6uq+IvpRdc4kM++QyPcy/09a+7ge7MCuI5n8tyTWvpZoTXhkmBOCAOR7Hoh92dE3GxesC0t3eG+rJxBa6DNE7jEpApnwPJ/STFHuwDu5VOJR1JbYPDp5/V9vomaImLx+ulSwzAsgj/3Leh0Gxcu3M9+PjZdTroxed0WA/+FHhBUcefbGPgJ1UMtqyzkXmHBR0zn94RQkyvC6iQfzKq01XgU1Xo2x7+NO/GDvFM6ix+LO17ms6DeMdHT5RG3tEi/qN7HjctmuzUnkM/XS9MbEFvFFakRd2TP1rW9YlzYWe4yiQ0zTxkWS8kQsUB6Ka9R+GP6Os46UEyVgHDX/10c7FaMjfnla5d6KdPPG6BdI5/YTmCp9SJqzPZnDif2yn35i9UsW8i+xPnwzECv9qVmpRcmBjGQPxi+pd5gVnEAa3R3vW0B2yO1uRNYMfXBtVhUoXc3Y5C4CH0Rf4DZsNmWHA4EzUdOTeP2fQGiZEcOhWsVOA0i8g1WQNxcQOjxwtObWni/CcgiE4Qre3LO/SDwsB9wPvde5rt6etIslQSheQ8HylDTvgitvdnzgkHftYwSQSIEEog3m58dNXDm6COoPDreX6xZJXGavsGXDCZMeArynbeEOnBpUxoyWdaUKV8kf+48y3ty4E0V94qsxB3EMB5ZliBCnjQkc8uIS/pWjD7Q5bfy7ujKp64eB+tzz1xcEjb1jtbE43n7MQzPx8LWmHRet+by3X2QdDnRDtQJ+Lv7ujuC6D5GAD5ao2u7sxpBW5/ecFs3V/eGSzouGfGQF6J2O/2BKfOtC/oLZA5f5OH8YlzE35n9vYciy6Ku5MTAIE4R/u6o7qjY5U2KoGGq4y8NjW9+2VLPIL2ewISmN9UeadVT0DsueHuQMHTyIF9gbPwsCybzTjd55kDAev+gCF29GPJ1i73trsYXyO9EqZCpEH/zdvoSwTid5QpZRNYsXbul+Q8B+0DMbEAC2zQ5+XM1t5nc1YrYwHeg0NnGdq+vIMA2LtKxuUsENW1gh0Sm9/YiDS8oL7PmrDoM5FYabMdtbTaaJ/dE3CfYQQPwxUg2hnL0rLjvvsDADASn0ULAAA=
.audrte.com/ Name: arcki2
Value: cmek0bTl2v6RxyJ7Gb4ky-kOA!20210804!1649951669614
.mathtag.com/ Name: mt_mop
Value: 4:1649951669
.onetag-sys.com/ Name: OTP
Value: 81HAa2qK-60QAsJ5Ke_8XVGN1lAJ2GyofX6NnnnoWnk
.3lift.com/ Name: tluid
Value: 896904373227475213193
.quantserve.com/ Name: mc
Value: 625843b5-db494-212d5-ff186
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAAAOOSMXR2dA12da-MjDcqzvKszDIvDXYPK84LNdcNDwziNTQzsbQ0NTQzs7Q0sXjFiMoHABIW49s9AAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNrcwMTE0sjAwNjc0NDM1tTAyMRDiM9QNzPSPMvP2i_DLMDcAAEYDia4lAAAA
.rfihub.com/ Name: euds
Value: H4sIAAAAAAAAAOOSMXR2dA12da-MjDcqzvKszDIvDXYPK84LNdcNDwQAnBPAKR4AAAA
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNrcwMTE0sjAwNjc0NDM1tTAyMRDiM9QNzPSPMvP2i_DLMDeQ4jU0M7G0NDU0M7O0NLEAANdr6sQ0AAAA
.inmobi.com/ Name: idsp_c
Value: dcf50319-3ed8-492a-a1ae-d3d652c740c8
.scoota.co/ Name: tuuid
Value: d2e8182a-a1bd-4636-bb80-fc387b014fb3
.scoota.co/ Name: c
Value: 1649951670
.scoota.co/ Name: tuuid_lu
Value: 1649951670
.amazon-adsystem.com/ Name: ad-privacy
Value: 0
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&135fa12c-9d18-4b23-8e3a-bc3cfc5b8fc9"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NDk5NTE2NzA7MjswMjHwdniwLsvs2jqnnwOJWUQIpanRjJiOSIrN+QT7R4lF5g==
.linkedin.com/ Name: lidc
Value: "b=OGST00:s=O:r=O:a=O:p=O:g=2698:u=1:x=1:i=1649951670:t=1650038070:v=2:sig=AQGhx59XXeaoMHwXQxqVjhO9H3qRz5Rf"
.amazon-adsystem.com/ Name: ad-id
Value: A64z52t9qUpChGyn4WGie8U
.pubmatic.com/ Name: KADUSERCOOKIE
Value: 259147D8-7EFA-450F-8AD8-7BA5CF40924F
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 1
.pubmatic.com/ Name: pi
Value: 158127:2
.pubmatic.com/ Name: DPSync3
Value: 1651104000%3A201_197%7C1650499200%3A164%7C1649980800%3A174
.pubmatic.com/ Name: SyncRTB3
Value: 1650499200%3A38_223_15_2%7C1652486400%3A224%7C1650758400%3A63%7C1651190400%3A35%7C1651104000%3A56_240_165_48_21_57_239_5_176_234_220_13_54_71_104_55_8_231_204_22_7_166_3
.analytics.yahoo.com/ Name: IDSYNC
Value: "194o~24br:1762~24br:18z8~24br"
.quantserve.com/ Name: d
Value: EI4BDgHzJYEO-TA
.adsrvr.org/ Name: TDCPM
Value: CAESFwoIcHVibWF0aWMSCwjAjKOBo47POhAFGAEgASgCMgsIwISmrrmOzzoQBTgBWghwdWJtYXRpY2AC
.acuityplatform.com/ Name: auid
Value: 663174453031
.acuityplatform.com/ Name: aum
Value: "OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqANvqNdXNlck1hdGNoaW5nSWTMkWxhc3REcm9wVGltZU1pbGxpcyUBQAoZCAOemGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUAKGQgDno90aGlyZFBhcnR5VXNlcklkIfv7hnZlcnNpb27C+w=="
.w55c.net/ Name: wfivefivec
Value: Sw6PvsyN1NF1NI5
.pubmatic.com/ Name: KRTBCOOKIE_153
Value: 1923-fV-4eX9e73RmCe91clmgc3pf6XRmC-twc1vNbgvZ&KRTB&19420-fV-4eX9e73RmCe91clmgc3pf6XRmC-twc1vNbgvZ&KRTB&22979-fV-4eX9e73RmCe91clmgc3pf6XRmC-twc1vNbgvZ
.pubmatic.com/ Name: KRTBCOOKIE_57
Value: 22776-6686298214416655647&KRTB&23339-6686298214416655647
.pubmatic.com/ Name: KRTBCOOKIE_80
Value: 22987-CAESEJ8aU8eFVA1SltomfSndR_k&KRTB&16514-CAESEJ8aU8eFVA1SltomfSndR_k&KRTB&23025-CAESEJ8aU8eFVA1SltomfSndR_k
.w55c.net/ Name: matchpubmatic
Value: 5
.simpli.fi/ Name: suid
Value: AAB634511E76475B88828B74C3C40092
.turn.com/ Name: uid
Value: 7357394540411526230
ads.playground.xyz/ Name: connect.sid
Value: s%3AuzgHQZ2QQrN42NeUuZJxOHEi6y0extYX.avv8czqiDm5NBGeiLa3R4mhpKKVNcBujqIP3bc%2Blul0
.pubmatic.com/ Name: SPugT
Value: 1649951670
.bidr.io/ Name: bito
Value: AAHHb07EsIcAADmqOhOwkQ
.bidr.io/ Name: bitoIsSecure
Value: ok
.adhigh.net/ Name: gi_u
Value: M2gRQqD2odl.AikABlGAKMiBIw
.adhigh.net/ Name: bsw_sync
Value: jkh
.ipredictive.com/ Name: cu
Value: 2bc6e580-bc0b-11ec-b297-832d259745f8|1649951670676
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~YlhDtgAUjGeeagAy
.mxptint.net/ Name: mxpim
Value: R1B342_EE52EA7D_3519F7F4.1.0000000000000000625843B6
.tribalfusion.com/ Name: ANON_ID
Value: aknseFtlix88qyTAZbCam4LQSZbLnbIouZbaBsHjbMGeAuFbbMRbQ2MsYrvAMMDh8ZbWpQLJnwMAHPUJQ7jdtqrE
.pubmatic.com/ Name: KRTBCOOKIE_469
Value: 8273-663174453031
.pubmatic.com/ Name: PUBMDCID
Value: 1
.pubmatic.com/ Name: KRTBCOOKIE_218
Value: 4056-YlhDtgAUjGeeagAy&KRTB&22978-YlhDtgAUjGeeagAy&KRTB&23194-YlhDtgAUjGeeagAy&KRTB&23209-YlhDtgAUjGeeagAy
.pubmatic.com/ Name: KRTBCOOKIE_27
Value: 16735-uid:be246258-43b4-4200-9484-9771ee1131e4&KRTB&16736-uid:be246258-43b4-4200-9484-9771ee1131e4&KRTB&23019-uid:be246258-43b4-4200-9484-9771ee1131e4&KRTB&23208-uid:be246258-43b4-4200-9484-9771ee1131e4
.pubmatic.com/ Name: KRTBCOOKIE_1278
Value: 23329-6560be7e-c5a9-43a2-ac58-f12ad823d6a0&KRTB&23340-6560be7e-c5a9-43a2-ac58-f12ad823d6a0
.pubmatic.com/ Name: KRTBCOOKIE_107
Value: 1471-uid:Sw6PvsyN1NF1NI5
.pubmatic.com/ Name: KRTBCOOKIE_22
Value: 14911-7357394540411526230
.pubmatic.com/ Name: KRTBCOOKIE_52
Value: 22772-R1B342_EE52EA7D_3519F7F4&KRTB&23092-R1B342_EE52EA7D_3519F7F4
beacon.lynx.cognitivlabs.com/ Name: UID
Value: eb3b94da-bb47-4cb0-85e2-149bf5dbfedd
beacon.lynx.cognitivlabs.com/ Name: ss
Value: AdV9NLRq0lWgJGVjRRWvbekGN7k4bUhzhxkDLBV0MOpO8ZnUMgF5O7aHz9XR9BKkxX9DV1a9GBienJah82wo%2Bg%3D%3D
.pubmatic.com/ Name: KRTBCOOKIE_377
Value: 6810-9ea79823-2611-4b51-88b2-d42fdb532721&KRTB&22918-9ea79823-2611-4b51-88b2-d42fdb532721&KRTB&23031-9ea79823-2611-4b51-88b2-d42fdb532721
.pubmatic.com/ Name: KRTBCOOKIE_279
Value: 22890-2bc6e580-bc0b-11ec-b297-832d259745f8&KRTB&23011-2bc6e580-bc0b-11ec-b297-832d259745f8&KRTB&23355-2bc6e580-bc0b-11ec-b297-832d259745f8
.pubmatic.com/ Name: KRTBCOOKIE_466
Value: 16530-eb7baafa-fb67-4d6d-b2cb-1700a18fcadc
.pubmatic.com/ Name: KRTBCOOKIE_391
Value: 22924-3775857252217606419&KRTB&23263-3775857252217606419
.pubmatic.com/ Name: PugT
Value: 1649922977

10 Console Messages

Source Level URL
Text
security error URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html(Line 324)
Message:
Mixed Content: The page at 'https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=225d2128214efd4cb439b1095d30ca5b'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html(Line 325)
Message:
Mixed Content: The page at 'https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=225d2128214efd4cb439b1095d30ca5b'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html(Line 326)
Message:
Mixed Content: The page at 'https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=225d2128214efd4cb439b1095d30ca5b'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html(Line 327)
Message:
Mixed Content: The page at 'https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=225d2128214efd4cb439b1095d30ca5b'. This request has been blocked; the content must be served over HTTPS.
javascript error URL: https://securityaffairs.co/wordpress/130123/apt/russia-sandworm-targets-energy-facilities-ukraine.html
Message:
Access to XMLHttpRequest at 'https://api.rlcdn.com/api/identity/envelope?pid=c2d18b01-4905-4aba-a83e-e41eac932694' from origin 'https://securityaffairs.co' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://api.rlcdn.com/api/identity/envelope?pid=c2d18b01-4905-4aba-a83e-e41eac932694
Message:
Failed to load resource: net::ERR_FAILED
network error URL: https://id.rlcdn.com/711916.gif?ct=4&cv=
Message:
Failed to load resource: the server responded with a status of 400 ()
network error URL: https://id.rlcdn.com/709414.gif
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://idsync.rlcdn.com/420486.gif?partner_uid=259147D8-7EFA-450F-8AD8-7BA5CF40924F
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YlhDtc7SBXlBIe4o_vL60wAABKEAAAAB&google_cver=1&google_gid=CAESEPkN-qUxvTYlwRwBfD1oasY&google_push=AYg5qPL9Rh7scbVETxW9tgAdNCdEHOxaFVLe6zx5XOL3kKC5MGIi9I5Cnbea-1mLzE-T_h5LFWLIafiyx9WMRRXIlnGCvbNpShQ
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.audrte.com
a.rfihub.com
a.tribalfusion.com
aa.agkn.com
aax-eu.amazon-adsystem.com
acdn.adnxs.com
ad.turn.com
ad9.adfarm1.adition.com
ads.playground.xyz
ads.pubmatic.com
ads.us.e-planning.net
ads.yahoo.com
ads.yieldmo.com
adservice.google.com
adservice.google.de
ap.lijit.com
apex.go.sonobi.com
api.rlcdn.com
beacon.lynx.cognitivlabs.com
biddr.brealtime.com
btlr.sharethrough.com
buttons-config.sharethis.com
c.eu1.dyntrk.com
c1.adform.net
c2shb.ssp.yahoo.com
cdn.pixfuture.com
cm.adgrx.com
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
contextual.media.net
csync.loopme.me
dclk-match.dotomi.com
dis.criteo.com
dmp.adform.net
dsp.adkernel.com
dsum-sec.casalemedia.com
eb2.3lift.com
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
google-analytics.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gum.criteo.com
hb.emxdgt.com
hbopenbid.pubmatic.com
i.e-planning.net
i0.wp.com
ib.adnxs.com
id.rlcdn.com
id5-sync.com
idsync.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
image8.pubmatic.com
imagesrv.adition.com
js.cookieless-data.com
l.sharethis.com
lg3.media.net
match.adsrvr.org
match.bnmla.com
match.deepintent.com
match.prod.bidr.io
maxcdn.bootstrapcdn.com
mug.criteo.com
mweb.ck.inmobi.com
onetag-sys.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel-eu.rubiconproject.com
pixel-sync.sitescout.com
pixel.advertising.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.sitescout.com
pixel.wp.com
pixfuture2-d.openx.net
platform-api.sharethis.com
pm.w55c.net
pmp.mxptint.net
pr-bh.ybp.yahoo.com
prebid.media.net
prebidserver.pixfuture.com
prg.smartadserver.com
ps.eyeota.net
pubmatic-match.dotomi.com
px.adhigh.net
px.ads.linkedin.com
px.owneriq.net
r.scoota.co
rtb.openx.net
s.ad.smaato.net
s.amazon-adsystem.com
s.e-planning.net
s.tribalfusion.com
s0.2mdn.net
secure.adnxs.com
secure.gravatar.com
securityaffairs.co
served-by.pixfuture.com
simage2.pubmatic.com
simage4.pubmatic.com
ssbsync-global.smartadserver.com
ssc-cms.33across.com
ssc.33across.com
ssp.adriver.ru
stats.wp.com
sync-tm.everesttech.net
sync.e-planning.net
sync.go.sonobi.com
sync.ipredictive.com
sync.mathtag.com
sync.richaudience.com
sync.search.spotxchange.com
sync.teads.tv
token.rubiconproject.com
tpc.googlesyndication.com
u-ams02.e-planning.net
u.openx.net
um.simpli.fi
ums.acuityplatform.com
ups.analytics.yahoo.com
us-u.openx.net
ws.sharethis.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
api.rlcdn.com
cm.g.doubleclick.net
fonts.googleapis.com
image6.pubmatic.com
pagead2.googlesyndication.com
us-u.openx.net
104.17.119.107
104.36.113.107
104.36.113.35
104.45.178.220
104.92.106.130
104.92.74.8
108.157.4.79
13.248.245.213
135.125.160.160
138.201.8.249
142.250.181.226
142.250.186.130
142.250.186.98
151.101.129.108
151.101.66.49
154.59.122.79
157.245.94.128
169.50.137.182
174.137.133.49
178.162.133.149
178.162.133.150
178.250.0.163
178.250.2.146
18.156.0.31
18.185.251.21
18.193.172.152
184.87.212.214
184.87.213.8
185.33.221.14
185.33.221.90
185.64.189.110
185.64.189.112
185.64.190.81
185.86.137.107
185.86.138.122
185.94.180.125
192.0.76.3
192.0.77.2
192.82.242.209
193.0.160.129
193.232.150.60
2001:678:cb4:bbbb::11
2001:8d8:100f:f000::289
204.2.255.233
205.234.175.175
209.54.176.128
216.200.232.253
216.52.2.19
217.79.188.59
23.35.228.23
23.75.246.168
23.88.75.186
2600:9000:2156:7000:c:abe:f440:93a1
2600:9000:2156:7600:3:c04e:c780:93a1
2600:9000:224a:f800:1b:5138:8a40:93a1
2602:803:c004:200::143
2606:4700:20::ac43:4671
2606:4700:4400::6812:230b
2606:4700::6812:acf
2620:116:800d:21:36a9:ecb:e518:b308
2620:1ec:21::14
2a00:1288:80:807::1
2a00:1450:4001:80e::2006
2a00:1450:4001:810::2004
2a00:1450:4001:811::2002
2a00:1450:4001:811::200e
2a00:1450:4001:813::2002
2a00:1450:4001:827::2001
2a00:1450:4001:827::2002
2a00:1450:4001:828::2002
2a00:1450:4001:829::2002
2a00:1450:4001:829::2004
2a00:1450:4001:82a::2008
2a02:2638::1c
2a02:fa8:8806:12::1400
2a03:2880:f02d:100:face:b00c:0:3
2a04:fa87:fffe::c000:4902
2a05:d018:d29:3605:9b3d:59c:490d:6d21
3.122.208.3
3.124.34.143
3.125.70.222
3.64.152.215
34.102.253.54
34.107.148.139
34.149.20.76
34.202.74.122
34.250.9.127
34.98.64.218
35.156.233.6
35.157.246.167
35.186.253.211
35.244.174.68
37.157.3.29
38.27.122.101
38.91.45.7
44.199.37.161
46.249.52.249
5.178.65.245
5.178.65.246
5.178.65.253
51.15.145.115
51.89.21.8
51.89.9.251
52.223.40.198
52.59.41.116
54.146.66.83
54.171.228.20
54.239.37.45
54.77.7.200
63.251.232.165
66.155.71.150
66.155.71.25
67.202.105.21
68.183.31.14
69.173.144.139
69.173.144.165
81.222.128.214
85.114.159.98
000b818d361b9c3cc2856f63e7a941395bcc91967e4ea348b6e3afc597093a7c
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584
01e705ffb5cded4d2e41a4e38dae9ad75ac52dd34bbf2ef7560a3d1cb948092a
052ed19ea2a4ea919586adb721a89f672886f7f8a5d2a268fcda17fa9e81705f
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34
08a124e362c568f9543bfa353f6f74806fe2efc89c37102cbe93bc343fcc011f
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878
0ccdb777e91dfbbed4862eb5fa395448663a9fa9062da7475c23c4e51598c98e
0d86e6c3718a83b34cf7b26bc26653358450bee35da98fac98b5cf6dcdd78c8c
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35
0e59a021648d125647974c69a00b8d8c323ea890a26629c8ba8a8a19cc3fc3d1
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
12c89195053b32c8e6577a5049ef4b5f6aa0a3f38cc0b87a745dd5fb6d9959cc
1392873e5f0bbf480e9e929626eb3d3d3c8450e370ae54e1b8f0db1893cc28c2
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742
13c94d61380048799c56066bf7c0db45b9fb7665dcb67c2c5a3f3a1c1160fa57
149bccf7e467541fc83e870e967ac322b26065e5d6797169c8a677a67db07e60
14d79e2cf47df339b79d25ffc6d0136e5d2e70a96b75e6782198ea6bbda3ca0a
1536d07b6af9e6b855c692e59c9464e7f17dc211a4b17380f5a8b50ab13fe8df
162db2d235d3121a7659ead757e15d179ee217408765fedf28b77949a2c47b34
1630b7614bd2f42d68c49585bd0787536b4be1eef143d3d3d6db04eb83e0b6ea
17337686711c839b6ff2984299c6fdc98b211f0845101cb3cc0b54689ec71ebe
1800ae12155a44661387f750e4409fccd3a40caafe56bd7f689f0cfe40eb2931
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19
18d8bc220d04c4dfebd11a051bd96d5d2ecadaee90bf11c815e6463ff12926d6
1969dc8273e3eeb550e28414807a56cb1856b8e41644715f5adf134bc7d90970
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82
1d62126b111934a7a1ba25b60cf3d4950653a2f773b4ed924dbbc2d854f31d86
1fe67d3edf54aac56a67e6e53a9a97c50688f58d94e51e7c1356fedf6deb0271
1ff6df602fb57704169c452a951bea8f366872b7127854a0d1f3e51e29a2849b
21472dfcec727bbbfd98d940e15f7bf64a2949df9d72a07f15c1d546c6bdc393
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732
25dbbfdbfd055e7d51020184ca78a9b0077bf6735ab3c8a765d38fc31e288cfb
2629fd6a092ad59275d6cdd8d8bbc92f4561b10b3e5d963acd38033c6471f21e
28e1bef77434cf8cc2611fed00a56b9fdb40a9f7dd755bffcf2821087a07d2a8
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
2a5474b7d03487c6e04fb5cccdf5b3122b68e8e20387f44647a40924765d57ab
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2af309c16d5fe7a1b6a45b9909f817072cfadc3fa4180fcc19b6ceb4818f1449
2c02fed7f7613ae10d95e1daa88c0498e28c5840ec490764911cfa1fe85334a4
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2ee73e6555f3a25e214bc76107965b462821485f2ba63b7ea6f021cd2be651d1
30adb3d3af5cd34e8166edac56f32bfde00e84866dcbde7925cb4b74016133cb
3283a249a29a5d8b2e301a734bfd55910d1a492e0815d339fe934f101ec52f1f
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
36c83fc22305c74f7d1fd0e91fd46557a9c8d8d45eade5a3233cea99b2efd794
36ff448eedc05b30fe65395fb2f33affd77ce7e90a157d1ddb1c63dcb55d5513
37d925559381e9d5388c4a096fe1383570546b7b11548d7d6a7e560adcc24e5d
397d019db11aa94e5bfaebddad866fbe73ffd5b64fbffa00f1382ccf3bff2b00
3b4af015f4ab769d60447d9facdb83641074caeef9dff290c637515c55d4641b
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3e07a7067d4af1a7ef437fe4ccc72951b2432f3f70a3a55254efad6d72e6eb53
3e6114615513668e1a96e52e75b8821b328140de2dc1577023979edd16f35140
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
40bc46248d8f8d5fbea7678bd0c0031327e206daaf99f3bf6723b9a70f665f7f
4124f35fc76b72692be512e82f272078ebb3ce22cbbfbf151f50da43b363c5a5
414363cb8150c2f60382da1d5a33f260caad65a54d6933e6b28534763d388db8
41fbbac12d7d653541f0a0dfe0842d3e917546f06c700c7572e0ee45bc1ed4db
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6
45df10c585e01c07a3602ed16c1c6842d2572d6b15bceff9cb1f58256d330e31
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
49eb18826615b35b58120b655adeb1a11e702b4ad5531d99074cbcebebeafe75
4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98
4a8f54e70b58950234751220bbd5bcebe92906a04c85d18b084b4b182456bf00
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b84ed0d47a23278a7c7b8e55b281ced2f27d8b1448d13649e5681b4d6672bf8
4b88a304d6162d0e7bc1ea1c3b8c9e9f6b6751002a6d58b6a7bb2c4dd383dea8
4c6b4ef22f4c5dd8fd6e17ab6706d8c55d236824c20b3d8dcd310f7de744def6
4c7756e32c4ea48269399d49d610cb4cd1a935d66a3057d8ba517449ee3e09ff
4cdecc62f5b2c8e9f7cf7b14b9fd42e0c4787d912c1b71426cdfbe0144cede46
4d841940fc5a291c2b21753932d57b24e9c4f26e6ae9788ad449392a55892c39
4dbd6aaafb46a4353521b4f135d4b37aa2abf94294dea6e80db807f5282ba933
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0
4f8474dcd74dfc147e3d7c72340b737b76928ebecfddd9a5e72db6493c64886b
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
536386f4e5a08dcde004ad0d24c4ea816a2054ba53f5da25ebb12fa4493f693f
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5674f3e8cfe98894f414f0da141f69670f50ac73036f89f3807ec166c9ef017e
58b9d3687d60583ede953f60e80f6734b5243c809a9039988e41da842d2cfebf
5a2532cf7580c46271ea911060cc5ec53af119983f85a001714c30b73c65b2f5
5ad66c65174ac81b2f8d733f3b51054e9257cb2aab8c59c27ea5b8e306608ef9
5bd8bae9eaa7115d445db2d861daeda84910d8792ce1e9a307a1ff754da1d213
5bfb11cb8d72ded34d048679193ed674daeb3f046d4724b3afe374926e3c7872
5c269240acbba94ae9934f8f03c702d2b74ae4f9c15c61ecf325b506f6dae73b
5cb7a25d4f17a40cc56d49379ce472846859338e4c0480fdaca0eb7b44bc467a
5cbf31f01d7d1ce4853bcd6cc64dbfd103d412ec14d8bcc4ebca3b35dc3f3b74
5da2865ec3d1263ed5684e66ff4fdbf2c05294cca5f13a11bb4f8ea59e5b11b0
6071f4e4c890545ad0f59302890def2aebb273acd131ed7ec434b26dfebad1e2
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61f31fdeba8ade7c78db76e5d4831da4c09e46c1611ee5b2acc1c103f007879c
63524c3fbabcc150bbc40876e3a213f1bfa97c0d3d5361401b2c38a07e2610ab
642f5fd742a9d4ad971464adee5f82c0292f812d14e337e5448cdb29ce5f2a26
64373cb4c186e98f5465ac6deeed39f21f8c31ed18ba0ca0e971abeee0e99e64
6448c95ad8e9b1f63465c57952afbf8df9df45103e966407d7b0f1588e9e009e
650868ebc4c00b2ea4ea72747f655f8a0552ba53c9b5b55defd9457be75f1aa9
655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db
65cfa6801a0886fab249b224e8a6982b4740fe7879fce99ff13ddaac9aaca01a
67289e231e0f7e5160b64d6761481954fbd89cc2f3cd3bf469fca94d7b4d6c87
6d9f061cba81145d9bab0964192d66cb2e13a71591482cdfaf5b718341171da1
70e0a3b2c82384039a2e4b31c305c9ef1f72a59b585acad421c54a6101a25237
73cadf4725483d9a9290b8ea3ad87fe2afc746de5f70e89f088a3df9996bd8dd
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1
75e7ac5490ee6534f21a7f41ce13e2d59737b72255bc148d0db5bc485504e503
77589bc3d910efdcb0e7f5e80bba9b8fafcd5db031cec21ab038a754b7442a5a
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7dd12b0dc062fcbef534496a47c9eed4a9eaa2922acc8002d289205098813017
7f4da1edb1dbc4b3a90cda29f3bf1b475871803ea42ff30defd830338c52aa43
7f741a651c4429b8b02b76b9c6c010709defbd46e104f4cd3305467c19c983df
80c6647bdd25a52e26f4c29113032af7b6143fb091e4c0bf4afab09cd61d0d82
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8542f7623714f814fce09cf5e24083983b379a792cf44fd760d756a30a864f98
868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8c106f968e6dae4cc1049fd8205860cbd57eba3b59803c5688a1f417b57d9b65
8c2914cd6e0c26e9fe3a9de23853632be1862891bf9bcfdda7053e1995319563
8c3010509fc7480b59413a90d69e9fafcb3d5aa202faf7862466f6bb8be1a335
8c776d56cdf0de2bdcb50dbf0e9e4abcd1542ef9c2ea28baeba453d9a006ac02
8d47728d4b3e5b65318a927a02edd90a71efd8f78a99ae9553486bd61c24fc28
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535
8ef52dfb79375f399be0a560df8362bacc0ccc50ad43cf66905986dcf9eb0350
8ffb654275301919bb42930c2dd518d3fd93d0a98407bd4f04001d46c9d9664e
9176c0c996b6d4f69eacaf39c3a74d59a42be5cfeb5377c74997bc1b3f13fbdb
92db40d16cb8ca6e243d000bc0a2f249aeb503b3109c6ea0d5892f531204c078
94b59f7bd824b8b309f91a83e5d05df9844329ae6e9ede37c3a2a833c4520835
966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068
96b7364de35ece70ac384193e14cc8571c102ad455883b21694f50380c95d665
9877cb0f828bc31f516200f8f223295edb6179669ec5697fec47f5fca2ff0099
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b978821f78e7bd3a48e5ae8fd7121a291eec506579406745800ca0590f0907c
9c062d10663416484b5a59bb47a0308526bec56cc69e9f3499fa087d8eae5c7a
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4e60e9fb30c58f35c5c0e0b28f06dce9d8236c36f16459d132c5c38e7c93ec3
a5c76c5cdd769bc7a048c8f65c56a7000adb29c8472d36eb4514af572a5ec5f8
a6471be6b02897e0fcc27acc17e01ca5b3243b6a3f917b01987fed922b9751e9
a7796af7079cbf624a5380d0d7babb44e7713d4adaec293270ba308e94ca68d1
a9e4bf6817b125819fe973415e3e82c95bbb0cded29af3433581ae9e3f421f29
af491e62eefccf9598da4fb1cc564e722f640d156bbb8f994518e0edb15e4305
afd6f92a48c320536a232faebf93847a9471054815e658c972f48b3623fc0569
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b259dc3618f6532dde986ca56aa26c19bb67973ddf1231f8bddad563eabaefa9
b2fa5de804c23d34f72fcc61013b199f9e61d16c99342789c936456766c77b4a
b430117fc32b796c3a4b44a210347355bcfc05c84386d6816ca983f7fbb33c7a
b64291fc91dc77833930ffcead244193c5cfd9e882af312ecc89b580160c22a1
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b97d80b9eedfeb29936f0d7f89afbdd425ef8d930d09fa1f98030ceb8b26cabd
ba35a541545a031276fd3a030e2e5485a88d0c6cbccb223b7116c920838c518e
ba716187f8cc8c54806f5b9de46d1d94bec574ddf31c82f68532cd181e242b7f
bd4684f4e57f7f33197f840d8d54aa438a3241bb8ffd9828f28475b078841929
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c5e4bbd50bae53bb58fdfd9661427b0c6f2f9ba891c5cc5bf22880a9987c839b
cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c
cee79b6a6d88fb567e0c04f3d34ae8d1a56e67e364461a7bf902c901d53dcf2f
cf3f12ff2e19c82fa8f25b48bf1821e3d95a64d06bfca24de438a380c6e18267
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d3b9d1ee20eee3a02abd17bac2a5a17d19eb62eab59b0b2a913ef5f837a59695
d490f2efc64637640a21c5282a89dd22344e58974641bc7bbbfa4c7e4dc8648e
d7a8b92165eb5f38c892d4127da2801eedb94bf2a15de6c634a05a18efb53121
d8cf277ce65233b7bededac5a8034fd47ee70bc8de25ee4897bc8238a7ccd0e2
d923ee78c830ba61f65748ff977f348a9b8160f36f05c922b6431428ed693d22
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008
da3ba6bda1b3fa1fd8395ba212eaf5f9c565d7e3c50525a03ff76f1e435db2f2
db7d7df3f4aab463a34b8063205faa1646a5cc09e57e8709323c37ac37ea4967
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de573c488ade930ff3bc9391c14bad6229ffcbd7c494eff35945a048efac35a8
e20fc21ea2633a73a6bb7a873c51669ef26ae419f3974d03136cd7bc9d6e98fc
e2c277798a0b9ab3fe76e2a98b4dbe3eae79ecc525e597f45b76d78e3fcf8364
e2dc35b0dbaa16b45d96eb3691927df48e091f4983ed2cc079568b789f9559da
e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a
e3393e762db414c6b4a2b7702a3dc87d8fbb6a05b8e3e4f02fa98311e4f19614
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e503c59c36fc19803b2e9572b10e7c06236bda692aebd97f29e2a5a96f9aa5b6
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e58cb72c1056d2a9345f7cbd4282f32f519cbd2d038145671674d769b7d1d359
e66bfceb15a6ee125dff79826be02a07b766843e6c660edf55ec0c22d1a407c1
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964
e8caad51a19c5667e4fc7ae6a3b9bf8a23559bb64b09b0c6e90cad6d24083ea6
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ec8fff94e3e9c767b0749a2ae5b3390a276203d02a45ebe81453c0fbe336d8fc
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5
f12c6133a12eead81c368fe146cb489bdb7331b5e3b5ceb9ea52eac1e3feb815
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4b2474113dddc55ebc90156e84591220ba900000b3d332da0c0db15fdd20b3a
f5312b6bb79c166acabd8d3351b0cd3c7dfc89665f6a50ee9408b6c533d5a7d7
f7a761c71e69933698cdf0bbe387fbeebeb3de97c36e692f1f924cdeadce993b
f9fae20d30474c95bf8745df26cfa5c62803462a9ee57dd710c8266d7ece3f3e
fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4
fda04c7b27b3db6bda165e1d1324e7c475edc1f3cc06e927a78f739d74992fcb
fece1fa6125a9e01999ea0ae3f3d8ebbd8bf940eafe39052a92fb4d53fd0ca50
ffa50053e0d528369ac0d3e6242bfd0fef0ef9176d3c81de7b8adfc7dfe84339