urlscan.io logo urlscan.io
SecurityTrails logo

www.securityweek.com Open in urlscan Pro
2606:4700:20::6818:a103  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Submission: On February 04 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 20 IPs in 3 countries across 13 domains to perform 96 HTTP transactions. The main IP is 2606:4700:20::6818:a103, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.securityweek.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 4th 2020. Valid for: a year.
This is the only time www.securityweek.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

39    2606:4700:20::6818:a103 (United States)

ASN13335 (CLOUDFLARENET, US)
www.securityweek.com
1    2606:4700::6810:a823 (United States)

ASN13335 (CLOUDFLARENET, US)
ajax.cloudflare.com
2    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
7    2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)
platform.twitter.com
2    2606:2800:233:66b5:799a:7cd3:f74d:7071 (United States)

ASN15133 (EDGECAST, US)
platform.linkedin.com
4    2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
adservice.google.de
adservice.google.com
pagead2.googlesyndication.com
6    2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
apis.google.com
4    172.217.18.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f2.1e100.net
securepubads.g.doubleclick.net
2    2a00:1450:4001:802::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ssl.google-analytics.com
2    2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
cse.google.com
1    2a00:1450:4001:821::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ssl.google-analytics.com
1    2a00:1450:4001:801::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
accounts.google.com
1    2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
25300d651079e96f05865a1cfcda291b.safeframe.googlesyndication.com
6    2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
5    2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
pagead2.googlesyndication.com
6    168.62.202.120 (San Jose, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
app.brightinfo.com
1    104.244.42.8 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
2    2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    137.135.51.188 (San Jose, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bia.brightinfo.com
Domain Requested by
39 www.securityweek.com www.securityweek.com
ajax.cloudflare.com
7 platform.twitter.com ajax.cloudflare.com
platform.twitter.com
6 app.brightinfo.com www.securityweek.com
app.brightinfo.com
6 tpc.googlesyndication.com securepubads.g.doubleclick.net
tpc.googlesyndication.com
6 apis.google.com www.securityweek.com
apis.google.com
4 pagead2.googlesyndication.com securepubads.g.doubleclick.net
www.googletagservices.com
4 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.securityweek.com
3 ssl.google-analytics.com www.securityweek.com
3 www.googletagservices.com www.securityweek.com
securepubads.g.doubleclick.net
2 bia.brightinfo.com app.brightinfo.com
2 www.google-analytics.com app.brightinfo.com
www.google-analytics.com
2 www.google.com 1 redirects securepubads.g.doubleclick.net
2 platform.linkedin.com ajax.cloudflare.com
2 www.facebook.com www.securityweek.com
1 syndication.twitter.com 1 redirects
1 25300d651079e96f05865a1cfcda291b.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 adservice.google.com securepubads.g.doubleclick.net
1 adservice.google.de securepubads.g.doubleclick.net
1 accounts.google.com apis.google.com
1 cse.google.com www.securityweek.com
1 ajax.cloudflare.com www.securityweek.com
0 securityweek.disqus.com Failed www.securityweek.com
96 22
Subject Issuer Validity Valid
securityweek.com
Cloudflare Inc ECC CA-3		 2020-07-04 -
2021-07-04		 a year crt.sh
ajax.cloudflare.com
DigiCert ECC Secure Server CA		 2020-08-11 -
2022-08-16		 2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-12-22 -
2021-03-21		 3 months crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-05 -
2021-11-09		 a year crt.sh
platform.linkedin.com
DigiCert SHA2 Secure Server CA		 2019-10-10 -
2021-10-14		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh
*.google.com
GTS CA 1O1		 2021-01-19 -
2021-04-13		 3 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2021-01-19 -
2021-04-13		 3 months crt.sh
accounts.google.com
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh
*.google.de
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1		 2021-01-05 -
2021-03-30		 3 months crt.sh
*.brightinfo.com
DigiCert SHA2 Secure Server CA		 2020-03-11 -
2021-03-16		 a year crt.sh

This page contains 14 frames:

Primary Page: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Frame ID: 01EF53B72E2329C53121F4D05EEA75C3
Requests: 75 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21
Frame ID: AA9AE5BBFF8FB37C5895AC7DE42C2580
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21
Frame ID: 610B7401A482892E509C16999358472B
Requests: 1 HTTP requests in this frame

Frame: https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.securityweek.com&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Frame ID: 2FA9EF1264623EAEA6A6F6F4FEA73890
Requests: 1 HTTP requests in this frame

Frame: https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.securityweek.com&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Frame ID: 86F055088BE63919D6F86420F0AFE4F9
Requests: 1 HTTP requests in this frame

Frame: https://www.securityweek.com/ad.html
Frame ID: 7F06C3268534FC1C7D660AFC3285FEF8
Requests: 1 HTTP requests in this frame

Frame: https://www.securityweek.com/ad.html
Frame ID: 519034E31D98D9F8EFE51A866BD86C28
Requests: 2 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fwww.securityweek.com
Frame ID: 74E584057BC3207CD95209374199D7F5
Requests: 1 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.securityweek.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Frame ID: CEACED0CA138F17BBB4D9E7A3D570438
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Frame ID: 3A981CEA4A243ADC7C1B2F550353F700
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Frame ID: C24BFD5016E13D225BE116993941BD4E
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv32KbPrvLkr6cKQZAYRO9loAHvbymy6338SwRQ5FI32C5VziKJOZlA8DXA65QM2WLZvmWo3YBZRvELunbWh5VKu2Gd8LPP7kql5Q778PVJQX9S22APBFUf9dGIjDtw6UpQnD4S-7epKoQjPnC17tgoadECyz5oIGoFVQAYcZzTZtLwily3ZNQIxj6GKgVtQLRLL4eCt0a16ZSrKEMf3kd8jfBoeKPlcecuUzzw33LwF0IhwNR1TfDXjZKpJCO4IrhWw1OQFQsW743xaYDtu8Cd3g_y2eGSl6h4Jz89kq4KS55R7s5fCb9hUtU&sai=AMfl-YTazOnQZCbzMbJlW5CJpRMAJqi49PV262i5o6kpoUAhLjwbt3_KcN-2Wob7Kixv1lX_b5HVSXnmA15-fDCo1bksdVAUYSxmTvf-lyVdoOGBz8kP9GS4mLC-09PbY5bh&sig=Cg0ArKJSzL0e_vSwXNGeEAE&adurl=
Frame ID: CAF395C9476061FCE324538DF60B29CC
Requests: 9 HTTP requests in this frame

Frame: https://platform.twitter.com/jot.html
Frame ID: 2F3B76197772CAE715B3C8DA81353375
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: 6466752244B881DBD8C127591CA6BA56
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<(?:link|style)[^>]+"\/sites\/(?:default|all)\/(?:themes|modules)\//i
  • headers expires /19 Nov 1978/i
Overall confidence: 100%
Detected patterns
  • html /<(?:link|style)[^>]+"\/sites\/(?:default|all)\/(?:themes|modules)\//i
  • headers expires /19 Nov 1978/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • script /apis\.google\.com\/js\/[a-z]*\.js/i

Page Statistics

96
Requests

97 %
HTTPS

80 %
IPv6

13
Domains

22
Subdomains

20
IPs

3
Countries

1369 kB
Transfer

3328 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 54
  • https://www.google.com/coop/intl/en/images/google_custom_search_watermark.gif HTTP 301
  • https://cse.google.com/coop/intl/en/images/google_custom_search_watermark.gif
Request Chain 82
  • https://syndication.twitter.com/i/jot HTTP 302
  • https://platform.twitter.com/jot.html

96 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
www.securityweek.com/ 		40 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.29
Resource Hash
3550e9fe8b646f7cec573b93d199eeeac7f3f577c1f82e2ba18e74d546d98fdc

Request headers

:method
GET
:authority
www.securityweek.com
:scheme
https
:path
/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
content-type
text/html; charset=utf-8
set-cookie
__cfduid=d9047922892475fdf5cbd06d333c193bd1612465465; expires=Sat, 06-Mar-21 19:04:25 GMT; path=/; domain=.securityweek.com; HttpOnly; SameSite=Lax; Secure SESSc3f2c9572aa8f3f5ea6f60501affecb3=ed2aff7fa06b75e0a40002d60e5baf65; expires=Sat, 27-Feb-2021 22:37:45 GMT; path=/; domain=.securityweek.com
x-powered-by
PHP/5.3.29
expires
Sun, 19 Nov 1978 05:00:00 GMT
cache-control
must-revalidate
last-modified
Thu, 04 Feb 2021 16:14:45 GMT
cf-cache-status
DYNAMIC
cf-request-id
081007811d00004a987b32b000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=nDeBOUot%2BtzclbZRmZvH5Me2%2FY6%2FJzzZJCPd0dX89mys%2BBz6zeEMuFriVxWC4dcBqIxWTYGdTaWaTqVdRnRJz05SGfF%2BwZJewIo7UOx%2FLCkLYl4Un6a4sFcuXjuMRMZmLQ%3D%3D"}],"max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
61c6a8482f054a98-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
MtZjAddKzhFJoLq5xYGl1vZkDn8.js
www.securityweek.com/cdn-cgi/apps/head/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/cdn-cgi/apps/head/MtZjAddKzhFJoLq5xYGl1vZkDn8.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8dd5483dc29044f06c3a45f8fd05d0f122a2b4315292df6da919775189351c9

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5866661
content-type
application/javascript; charset=utf-8
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
9D7676ECF72C63F9
x-amz-id-2
0xGkw3tMrnTlmaIdMRQ1nPOkVlhn00QQLGQ9gViAs8CwIMwdeNYUxK3VIXqSFWH3lkNmDPniutA=
last-modified
Tue, 04 Dec 2018 19:44:59 GMT
server
cloudflare
etag
W/"6998744eb932e2ecef296a28191978ed"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5v%2FGLf1hhiCbtUVFH%2B2wK%2BE3c286fiwgniJ87q2QZlvoYUrA3kUWLGhBNnhpevABf7c%2FI5Mi3uwO4b50f5ra%2BP%2FTEupC5bx922PeWS6zJKbqVeTeLzS2ZimxhUm7mvek4w%3D%3D"}],"max_age":604800}
x-amz-version-id
JCMgPdMNLoo3bIn5Dbz15QtzSlH_yitT
cache-control
public, max-age=31536000
cf-request-id
08100781f200004a98fea92000000001
cf-ray
61c6a8497adf4a98-FRA
css_636fa26ba16f5959acb96ee0d8919061.css
www.securityweek.com/sites/default/files/css/ 		24 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/sites/default/files/css/css_636fa26ba16f5959acb96ee0d8919061.css
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d10a778caafc69e25249f7b7fa00a1bfaa240991b6c7cdedb7f562fff418eb21

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
101329
cf-polished
origSize=24799
cf-bgj
minify
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
08100781ef00004a987682e000000001
last-modified
Wed, 03 Feb 2021 14:54:07 GMT
server
cloudflare
etag
W/"3c18d2-60df-5ba6fc25235be"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ftrZb%2Fe4woZAjpYaxQtmJUVS%2FBJewJ4QlYoVaqZtR58u%2FszUoB7WwD8MAXfKYui6cqy1pvHE2%2BkpeV%2B83LamgTIWx8ocvy%2FIwRvYCZnOH7xCAA0EspvqJRBh7xIdOutsyQ%3D%3D"}],"max_age":604800}
content-type
text/css
cache-control
max-age=1209600
cf-ray
61c6a8497ad74a98-FRA
expires
Wed, 17 Feb 2021 14:55:36 GMT
css_718fafafcc386276c845e7bdb0114c58.css
www.securityweek.com/sites/default/files/css/ 		27 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0deae7d488b0316e0149f1dc2caec46821b2272127b61b4ffadf6f99a303ea16

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
101329
cf-polished
origSize=27647
cf-bgj
minify
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
08100781f000004a98a2929000000001
last-modified
Wed, 03 Feb 2021 14:54:07 GMT
server
cloudflare
etag
W/"3c18d4-6bff-5ba6fc2524176"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vnIUHDm6Kmz%2FxdX%2FLlh1a0fmaJIPHu1%2Fwp70Ww8p68Zk1ul9oguXYtzd58Lfi1%2FiPo5m32yemhH8k1HezEXbMeEJzIts7CdbUxpQQEKFLYkvoAuLWqBR1j0G%2BhvFALwuhw%3D%3D"}],"max_age":604800}
content-type
text/css
cache-control
max-age=1209600
cf-ray
61c6a8497add4a98-FRA
expires
Wed, 17 Feb 2021 14:55:36 GMT
securityweek_logo.jpg
www.securityweek.com/sites/default/files/ 		19 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/securityweek_logo.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5ae75bcb392ec9110db2837a9134c1b414c373244ea62816c63cc5bb41a90cfe

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
432703
cf-polished
origSize=20250
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
19584
cf-request-id
081007820c00004a9884b5a000000001
last-modified
Sat, 02 Jan 2021 18:33:44 GMT
server
cloudflare
etag
"c60712-4f1a-5b7ef18cbdb45"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HiPKs0ZJ%2F497rLUTL1S38kSslUc3GWPdW2GaVXmsmYsDkyY7lna1tHhhaUwANE1InmgJBcDMjxth0%2B5ilv7d07NTiEvMPLr%2FZn9%2BAgO6lEmxpFBDGtvVT3SMpoDexDtp5A%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Sat, 13 Feb 2021 18:52:42 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849ab504a98-FRA
cf-bgj
imgq:100,h2pri
IoT_Lockdown-970x250.jpg
www.securityweek.com/sites/default/files/features/ 		86 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/features/IoT_Lockdown-970x250.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
afedf855d6d8ece53e013419b411dd4870baa7594fe221ab1e493d78be8eb957

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
82074
cf-polished
origSize=101635
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
88472
cf-request-id
081007822900004a98bcb7b000000001
last-modified
Wed, 20 Jan 2021 20:12:19 GMT
server
cloudflare
etag
"c60752-18d03-5b95a927ff00e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Bs31t5ydGAerYx2%2BSE9d4WunX9XB3qNVpJ8k9eYZWPJeu9Ku6mzjgoILBn9XFplCRvLjNydV3MBietsFSaW6tV9ieGKEfXm9lCw4zF99OnHYea8%2FVAECc169pZdAqTo65Q%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Wed, 17 Feb 2021 20:16:30 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849dbc24a98-FRA
cf-bgj
imgq:100,h2pri
picture-142.jpg
www.securityweek.com/sites/default/files/imagecache/auth_story/pictures/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/imagecache/auth_story/pictures/picture-142.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8c3472f82c523707024b21c9c02755fb4fc9540558895e5ec10ceb1a7ac7977

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6439
cf-polished
origSize=2275
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1946
cf-request-id
081007822900004a98e8a0f000000001
last-modified
Wed, 31 Aug 2016 11:41:29 GMT
server
cloudflare
etag
"3c191c-8e3-53b5c9400d9a0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=VHWgxvUzoBlRn2ZLY5i2CQVdb6HRIUkXjcOwmoD5KaLSxTn9WuR0sDaAw8UpZ6bSbsvpqsYYFBcdrgzlLqkPR1OufRPPzMDalbwBN%2FdIzSImRab251R2Bg2MCe2xwg8Wlg%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Thu, 18 Feb 2021 17:17:06 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849dbc74a98-FRA
cf-bgj
imgq:100,h2pri
RSS-Icon.png
www.securityweek.com/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/images/RSS-Icon.png
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62b425148295a81e4162a87cb36eba754d16b295ec5b733140e2b82c7f77a731

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1028611
cf-polished
origSize=2844
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2637
cf-request-id
081007822900004a98c7862000000001
last-modified
Wed, 06 Oct 2010 06:57:24 GMT
server
cloudflare
etag
"1e133b-b1c-491ed4a241d00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mtS8ZALwPMDlsv9MtaQpZCDmRT8gtZnhVO4rLRGNpMpqA1lzJOubkm7wkH23w2YkjeQqa8BaTMX1cOPqnoa5YmioM%2BAmRZCiprqlXziQrALHGHxdPoQGWHq7jvVuhIu2cQ%3D%3D"}],"max_age":604800}
content-type
image/png
expires
Sat, 06 Feb 2021 21:20:54 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849dbcc4a98-FRA
cf-bgj
imgq:100,h2pri
serve.php
www.securityweek.com/sites/all/modules/ad/ 		695 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=1296
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.29
Resource Hash
ad853a72ac4fa4a7ea4700fb824906dbba6fd62e4f61e92449a5cba3f60ff1dc

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:26 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 04 Feb 2021 19:04:26 GMT
server
cloudflare
x-powered-by
PHP/5.3.29
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"report_to":"cf-nel","max_age":604800}
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Ez0r4YPBVGX%2FoHBA7Kv8RYg17WXu1OUk0OZ1il1jnoNPz%2F9xf0zozTWQj96tkeGpx9jeI30s%2BjmF3pIzyzVekHyqZnjgktiNoZswZrN4xiiB9xtBdCcgx%2F6K5ANIMStaiw%3D%3D"}],"max_age":604800}
content-type
image/jpeg
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
61c6a849dbd24a98-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
081007822a00004a988c9d5000000001
expires
Mon, 26 Jul 1997 05:00:00 GMT
serve.php
www.securityweek.com/sites/all/modules/ad/ 		695 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=1030
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.29
Resource Hash
ad853a72ac4fa4a7ea4700fb824906dbba6fd62e4f61e92449a5cba3f60ff1dc

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:26 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 04 Feb 2021 19:04:26 GMT
server
cloudflare
x-powered-by
PHP/5.3.29
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"report_to":"cf-nel","max_age":604800}
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wdZdgkf5f9Wa%2BhNyRCy2vHjyuivMX1sN9RyXcFOWHeAb2ThCLIB3sCHbwBB1%2BsUKfC64uBkaBawmOI8eLpvU%2BCPhAHW1IpXAcbTTANBKiEYy0GHuXy2eYAgFFlpMKg4SMA%3D%3D"}],"max_age":604800}
content-type
image/jpeg
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
61c6a849dbd54a98-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
081007822a00004a987b348000000001
expires
Mon, 26 Jul 1997 05:00:00 GMT
serve.php
www.securityweek.com/sites/all/modules/ad/ 		695 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=683
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.29
Resource Hash
ad853a72ac4fa4a7ea4700fb824906dbba6fd62e4f61e92449a5cba3f60ff1dc

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:26 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 04 Feb 2021 19:04:26 GMT
server
cloudflare
x-powered-by
PHP/5.3.29
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"report_to":"cf-nel","max_age":604800}
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=8NGAJ76KnRqcHuX4RqDc3rzw1eCXKXMaQ1e%2Boa8o%2FqrpYLD9kQ7uACCCje1jfIVxVFjIg6szjmT1WOsG9QDTP0IGIZpDmfg1eY2oMD936OqKozijl1EarzyrtQHdE2yILA%3D%3D"}],"max_age":604800}
content-type
image/jpeg
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
61c6a849dbda4a98-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
081007822a00004a98b20b4000000001
expires
Mon, 26 Jul 1997 05:00:00 GMT
serve.php
www.securityweek.com/sites/all/modules/ad/ 		695 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=693
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.29
Resource Hash
ad853a72ac4fa4a7ea4700fb824906dbba6fd62e4f61e92449a5cba3f60ff1dc

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:26 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 04 Feb 2021 19:04:26 GMT
server
cloudflare
x-powered-by
PHP/5.3.29
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"report_to":"cf-nel","max_age":604800}
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=r%2BcgyOFEbQhqfD0qQ6hKLAL3SWhgQ%2FN2eJ5CHctmVtcmyk5QHEhCtC8EVHR5Ela0A04m6Mdsg8vkY1clmgD%2FHWfYQpBpbhDyuRv0r2gu3MryKo3QEPK2od%2BV3DOZNBr3AA%3D%3D"}],"max_age":604800}
content-type
image/jpeg
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
61c6a849dbdd4a98-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
081007822a00004a988a346000000001
expires
Mon, 26 Jul 1997 05:00:00 GMT
serve.php
www.securityweek.com/sites/all/modules/ad/ 		695 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/modules/ad/serve.php?o=image&a=894
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.29
Resource Hash
ad853a72ac4fa4a7ea4700fb824906dbba6fd62e4f61e92449a5cba3f60ff1dc

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:26 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 04 Feb 2021 19:04:26 GMT
server
cloudflare
x-powered-by
PHP/5.3.29
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"report_to":"cf-nel","max_age":604800}
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=qdajPcWJG2x5TK89PLiWWJskhCxSdiqrLthHHMJWnyEq47TFkDnI0kOYMzBBsEEsDUnpYB4tQ2PLovm3F3euFelegJK%2FxkUE5f9J748YG84Gmy0LukAek5k19IRbRdtf5g%3D%3D"}],"max_age":604800}
content-type
image/jpeg
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
61c6a849dbe04a98-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
081007822b00004a98d28da000000001
expires
Mon, 26 Jul 1997 05:00:00 GMT
tag_icon.jpg
www.securityweek.com/images/ 		680 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/images/tag_icon.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
65cc8600f521d4e99aa77e95337426f53ec86dd569e8db164bcda70d5c1da388

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
391952
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
680
cf-request-id
081007822b00004a98af08e000000001
last-modified
Fri, 06 Aug 2010 07:41:12 GMT
server
cloudflare
etag
"1e133a-2a8-48d22ca765600"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=g8RuZwYq5aTghzcxYFkf%2FiaNzbQFa9hhr1nhd0xjZNdAc%2FVmly3wHw8XV7iXUHgEaCbsIGIy6XSQzSz8vaHmH1o6T04PjBgWqLKfPhNJkT8YLPomzzYfIJzwRyMBbH7MbQ%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Sun, 14 Feb 2021 06:11:53 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849dbe24a98-FRA
cf-bgj
imgq:100,h2pri
security_newsletter.gif
www.securityweek.com/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/images/security_newsletter.gif
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
200abde0c426b23abe8a9c501ab4e8e72c048cc0653203817cc9ff96cc6e394d

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
220796
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1084
cf-request-id
081007822b00004a98b5081000000001
last-modified
Fri, 22 Apr 2011 17:43:08 GMT
server
cloudflare
etag
"1e134c-43c-4a185640ae300"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0a%2FMtcQX8Oju0IPXoSSN1uTU9D4pwehzvgofFPf8txm9C99Qch151d%2BsX8Sq2Sl2wPvC%2FTg43ruJuc2rUq0Q6i7x1QCkOjcY4IBo8%2BILCwSvGpywqJpzhPLbZj3r6GqH7g%3D%3D"}],"max_age":604800}
content-type
image/gif
expires
Tue, 16 Feb 2021 05:44:29 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849dbe44a98-FRA
cf-bgj
imgq:100,h2pri
Twitter-security-icon.png
www.securityweek.com/sites/default/files/logos/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/logos/Twitter-security-icon.png
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
10f0e5158e45d76ba649af69ed465a28489483ac934b3e491773cb5e4c9704f0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
771673
cf-polished
origSize=2314
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1238
cf-request-id
081007822c00004a98b4ae5000000001
last-modified
Tue, 12 Jan 2021 20:28:49 GMT
server
cloudflare
etag
"c6072c-90a-5b8b9deca4eed"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=V5sAIMp30CyH0wnGBr9%2BmsoIABkcKgfIn8AGnlH2ZnQZd8TmpBFQnjFB7nu1Eq%2FwFOL8a5hm4TQEYsaEks2KuhcAXdAhOBV78%2BFw9MKkK4efV%2BeC3mOO4vvnzDjtkvd8bA%3D%3D"}],"max_age":604800}
content-type
image/png
expires
Tue, 09 Feb 2021 20:43:12 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849dbe84a98-FRA
cf-bgj
imgq:100,h2pri
Facebook-Security-Group.png
www.securityweek.com/sites/default/files/logos/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/logos/Facebook-Security-Group.png
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8f9048e36baefc5cac0974c3e49ffc683d667c5b2081f6cd8d20f5a301b124c2

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
771681
cf-polished
origSize=2335
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1315
cf-request-id
081007822c00004a98bb9e2000000001
last-modified
Tue, 12 Jan 2021 20:31:23 GMT
server
cloudflare
etag
"c6072e-91f-5b8b9e7f5d191"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oRJo9qGeDD8MC05DLu%2FABbqPaBd3%2Fhb0%2FrE3cYnz25ws6VdRZyVrHUzu3Ggd%2BKOLRq8%2B3kVdYjCfoh3hrVFe8zD0mWLjflQLvLJbvvqAKyLh9WmNdgeuK56Wzghx9P4Fyg%3D%3D"}],"max_age":604800}
content-type
image/png
expires
Tue, 09 Feb 2021 20:43:04 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849dbea4a98-FRA
cf-bgj
imgq:100,h2pri
LinkedIn-Cybersecurity-icon.png
www.securityweek.com/sites/default/files/logos/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/logos/LinkedIn-Cybersecurity-icon.png
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f3d36be68e6a795cf0d621b7d8b4beb4b9f9caea3f3682f2f8f59a846000893

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
771681
cf-polished
origSize=2404
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1369
cf-request-id
081007822c00004a98803f5000000001
last-modified
Tue, 12 Jan 2021 20:28:18 GMT
server
cloudflare
etag
"c6072a-964-5b8b9dce83b9e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=TAhbfbBoDy0L%2F2G2M8p8%2BY4EoDLUfP2Mb9au6LySN%2Bx%2BHux6fk9Cl%2FGbT3Vcrl1OvSLo4LOYJ9ikAdTB7K19jCOcedxH9f7ZLt3NwVzjWPeJCNOgY4n2crvksRjVrQUWHQ%3D%3D"}],"max_age":604800}
content-type
image/png
expires
Tue, 09 Feb 2021 20:43:04 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849dbf04a98-FRA
cf-bgj
imgq:100,h2pri
Cybersecurity_News_Feed.png
www.securityweek.com/sites/default/files/logos/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/logos/Cybersecurity_News_Feed.png
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
efb9d49a04efcc971667386f67fb420e20fd130339f1c994fc7359bc34771ef9

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
771681
cf-polished
origSize=2414
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1398
cf-request-id
081007822e00004a98832e2000000001
last-modified
Tue, 12 Jan 2021 20:27:46 GMT
server
cloudflare
etag
"c60731-96e-5b8b9db04a596"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=OhCXzjqK4x5X%2FbAvJ2lamdjDIaoA3xql9WkTiVY6VvrDtqYR8xpPbgnvz831mK6cBXkfXB20cF7S6mDhPoYe8PUVnvgYeY0OMn4VWfgmtWJtCPJdBlN3HcdW5psZpVPNgA%3D%3D"}],"max_age":604800}
content-type
image/png
expires
Tue, 09 Feb 2021 20:43:04 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849ec054a98-FRA
cf-bgj
imgq:100,h2pri
IoT_Lockdown-300x250.png
www.securityweek.com/sites/default/files/features/ 		120 KB
121 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/default/files/features/IoT_Lockdown-300x250.png
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
61152d4b8363a8db7d72ece0ebb989ca0788d860b0c3cce645d16b63fa37e525

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
82934
cf-polished
origSize=148460
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
122767
cf-request-id
081007822e00004a98d9b9e000000001
last-modified
Wed, 20 Jan 2021 19:57:40 GMT
server
cloudflare
etag
"c606c9-243ec-5b95a5e19d468"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Yuyjf%2FyavAoM59PkClwksl9McnN9ZqdVLiTJFxuNktBVGHpZeINQqUOAfd1N48%2BbZzYvJWVdkm4M0hX66HY5uILyuGnXlLYLsyl95GiceybU2lL8%2FPJmwuYxqKIbNBUp%2BA%3D%3D"}],"max_age":604800}
content-type
image/png
expires
Wed, 17 Feb 2021 20:02:11 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849ec084a98-FRA
cf-bgj
imgq:100,h2pri
wired_publishing.jpg
www.securityweek.com/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/images/wired_publishing.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08fa49f20076c343e2724c631a732d8cbd3bd0daf55f4a0f8311e07dc77be29c

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
740111
cf-polished
origSize=2601
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2076
cf-request-id
081007822e00004a98c7863000000001
last-modified
Wed, 08 Dec 2010 15:26:32 GMT
server
cloudflare
etag
"1e132d-a29-496e7bef23a00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5j7KfvMOq%2BfDyvfoiquDAjzZ%2BotvqW8fFn3Gavu%2FssDDG9AnCdwT9QGhAkLfkL5yiw%2FXe9mjNsNTVx2Q28DtF0pHMrf3YM9tl5s3N6YYf0NXtx0G6j9sV6deQ930Qaycpg%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Wed, 10 Feb 2021 05:29:14 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849ec0a4a98-FRA
cf-bgj
imgq:100,h2pri
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:a823 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
nel
{"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
cf-request-id
081007823900001f159dabd000000001
last-modified
Mon, 25 Jan 2021 17:22:41 GMT
server
cloudflare
x-frame-options
DENY
etag
W/"600efe61-3016"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
report-to
{"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vZpJvYlpd55vJHbqSvWOnwgWCVkobH7v77noVEbXPFxk0F1ZflKFrjFXL%2BK25BIrM04Lx2IzKc4AgkilK4jjYiNlTD%2BUNydnbfhxsAXF8BRxneAB5y5wYz1dTqMtUUcm"}],"group":"cf-nel"}
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
61c6a849f9511f15-FRA
expires
Sat, 06 Feb 2021 19:04:25 GMT
JsfVAji5wHtjMw9KWartCq34fZY.js
www.securityweek.com/cdn-cgi/apps/body/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/cdn-cgi/apps/body/JsfVAji5wHtjMw9KWartCq34fZY.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/cdn-cgi/apps/head/MtZjAddKzhFJoLq5xYGl1vZkDn8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c9b185e1e937971dfedaafecf01bc14813a2ece31cc9af4a2097f9b3ecb061d

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
7997390
content-type
application/javascript; charset=utf-8
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
1D200412F3071A81
x-amz-id-2
ocW6f66LRM5e6Qp8eBxBVUkoliev/hyIMvHJhblhdyqBW0T870LfdE02FwNUZURk2IV3CxFownw=
last-modified
Tue, 04 Dec 2018 19:44:58 GMT
server
cloudflare
etag
W/"cb0ca31f11dc8247de26e3dcd49db722"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=WYjh2v9yYwvkWRI8SSy3r%2Bwgaf6tmduy3rnrn1m%2BiqYmSoOwQvyCVZ7z2GREgO657DQ2P3K0E0ujP%2F%2BJ%2F60GyzrYkeUIODN0AChFjaDZfRp%2BQfRuNwDkZkjKEKFLeuPd2A%3D%3D"}],"max_age":604800}
x-amz-version-id
h5OK1yTQAx2t7V4blDMielr1pB4gwYKR
cache-control
public, max-age=31536000
cf-request-id
081007822f00004a989007f000000001
cf-ray
61c6a849ec0b4a98-FRA
like.php
www.facebook.com/plugins/ Frame AA9A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

vary
Accept-Encoding
x-fb-rlafr
0
pragma
no-cache
expires
Sat, 01 Jan 2000 00:00:00 GMT
content-encoding
br
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
x-xss-protection
0
cache-control
private, no-cache, no-store, must-revalidate
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-type
text/html; charset="utf-8"
x-fb-debug
z/9FH/Jucm0MIv14NZ94vVfh4S188RmGq7D9k3/MZ3ZlsE6i7My/vDGof+SHPjVFaURpOA2UXBSvuV/Bv+J7MA==
date
Thu, 04 Feb 2021 19:04:25 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
like.php
www.facebook.com/plugins/ Frame 610B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/plugins/like.php?href=http%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&layout=button_count&show_faces=true&width=120&action=recommend&font=tahoma&colorscheme=light&height=21
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

vary
Accept-Encoding
x-fb-rlafr
0
pragma
no-cache
expires
Sat, 01 Jan 2000 00:00:00 GMT
content-encoding
br
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
x-xss-protection
0
cache-control
private, no-cache, no-store, must-revalidate
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-type
text/html; charset="utf-8"
x-fb-debug
IMvtfDmPuMmnDMPClVroDcbm7ihNTG8hx94jPoOlk36wHHYyFufe0jEUxjWdWBvqb7dGLwmaSEkPQSYk3YhQbg==
date
Thu, 04 Feb 2021 19:04:25 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
bg.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		475 B
895 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/bg.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab74e69c44356590de92b4b7354dc5ae3887e20f3dd9d07cea55cedbdd441f95

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
391344
cf-polished
origSize=13217
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
475
cf-request-id
081007822f00004a9800807000000001
last-modified
Sat, 09 Aug 2014 20:02:44 GMT
server
cloudflare
etag
"3c0013-33a1-50037ce116100"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mdlDhvFyVKdTTPDJRQNlhGe15bJAPb%2FYWyQrftTSOj5688kDXqyM3EE6O1OKlmuL08oJtpTC7RUlOg8fOpiafBEfte0fPLfiSlDH%2Bq6ClDgDpIGDw9B5C57HTUn11exaMw%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Sun, 14 Feb 2021 06:22:01 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849ec0f4a98-FRA
cf-bgj
imgq:100,h2pri
menu-leaf.gif
www.securityweek.com/sites/all/themes/securityweek/images/icons/ 		175 B
613 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/icons/menu-leaf.gif
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
913e0bff2ebdfd8aa46e82e8282910638f68fdb9f56f447f1f6b259f3fe5e539

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
481740
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
175
cf-request-id
081007822f00004a989f285000000001
last-modified
Mon, 22 Mar 2010 15:27:51 GMT
server
cloudflare
etag
"3c002d-af-482655712cbc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2B1abGmCX7m0lRiwP%2BL0uFLcvMJFujPMGT1wnGow0wj%2F51PFRAtA2GGfGmowrqH%2F73D3t2ZeuUwOawDHH793UxaSd3%2FaSK0%2BQieLLNo33dVfffagMqFhftzfDxnwl%2BMnwQQ%3D%3D"}],"max_age":604800}
content-type
image/gif
expires
Sat, 13 Feb 2021 05:15:25 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849ec124a98-FRA
cf-bgj
imgq:100,h2pri
header_bg.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		387 B
838 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/header_bg.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d55e4cb97826944c4f826821ac2688b361d7cf0303b4640c2cb3eef6ee19b233

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1028610
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
387
cf-request-id
081007823000004a98d397b000000001
last-modified
Mon, 22 Mar 2010 15:27:31 GMT
server
cloudflare
etag
"3c0020-183-4826555e19ec0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=s8y83akTXQFoiSGU%2FmQ6pd72U%2FMqR%2F67fM5m3RDCdPylLWDYZSYjj5NeHnLKSohMtH3NEL3cjkCBWxUWyClb7hfa4YryHUsxd3Git8lhk8yCEm5ZZADn1Hv6sAneyUX5WQ%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Sat, 06 Feb 2021 21:20:55 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849ec164a98-FRA
cf-bgj
imgq:100,h2pri
nav_bg.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		500 B
905 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/nav_bg.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
21b195ce0d8efa07e31b863199d8a6802cb773e2417443e534ed8c113d8949a8

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
660752
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
500
cf-request-id
081007823000004a98efb96000000001
last-modified
Mon, 22 Mar 2010 15:28:13 GMT
server
cloudflare
etag
"3c001b-1f4-4826558627d40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XaSPsy3Ec7gf5UiSYgU%2FwiFE8SW%2FyzrPS3VxMrQBxJqvE7zbh%2B1izOPZitC41UhI6BVyA6iZTWLipvjfieyAlHBbGraHw0mIGzh2B79lhNCI7TJgDMMv2oqVrVU0pnqtZQ%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Thu, 11 Feb 2021 03:31:53 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849ec184a98-FRA
cf-bgj
imgq:100,h2pri
menu-expanded.gif
www.securityweek.com/sites/all/themes/securityweek/images/icons/ 		183 B
557 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/icons/menu-expanded.gif
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa76185f417cf85d7029b35e3a6544d4495402e17f76a32633b5ba80a81faa26

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
731986
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
183
cf-request-id
081007823100004a98bb9e3000000001
last-modified
Mon, 22 Mar 2010 15:27:50 GMT
server
cloudflare
etag
"3c002a-b7-4826557038980"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=z8FYHvMDqQmZxVqBRyrGFdsYKhIXL1wm0Whbg6Lg%2BtV770TDfIBAOIzfkuhuZzK1vA1WG4kqmIVRb1kx2%2BRO18SAd8v3pwvwI%2BNNanRxPLDTd8WAp6Tclw6rqUMxwrNbPw%3D%3D"}],"max_age":604800}
content-type
image/gif
expires
Wed, 10 Feb 2021 07:44:39 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849ec1f4a98-FRA
cf-bgj
imgq:100,h2pri
line_dotted.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/line_dotted.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55851ffd45a0a3e9abd9c2ac844eba1efd50272a39360d0f3b396d26a7d0bfc8

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
659803
cf-polished
origSize=3724
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3165
cf-request-id
081007823100004a988b2ba000000001
last-modified
Sun, 15 Jan 2012 05:43:31 GMT
server
cloudflare
etag
"3c001c-e8c-4b68a93f6a6c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UBDesFQZP4lybvjQyrrUoJjz%2FtMxFjKPSraiCiM7TJM6R9MEr5eHkIcDHsZ5g3v23gn3ipdgJ7ygFJLdvTwJ79MvdER10GuRffIfM3rPafYViLuVb7h80TbhFRDMqB0c6g%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Thu, 11 Feb 2021 03:47:42 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849ec214a98-FRA
cf-bgj
imgq:100,h2pri
bullet.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/bullet.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ffad58a307aa1ac6baff90296c8edc9db313f888876bc2ad453be4db8d01bf9

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1028610
cf-polished
origSize=2285
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1901
cf-request-id
081007823200004a98c7864000000001
last-modified
Sun, 15 Jan 2012 05:30:46 GMT
server
cloudflare
etag
"3c0019-8ed-4b68a665dad80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NEdSF7o6WrfrSRdeOpsNk0P%2BGttgiqjOBueP1ErRh%2FMtkE0APRwfc4i3wkfdi7yPWNMPQilOz6%2B5RFpLEXyUGZ29FCYIWM1XMYWdwyqIp17Arf4V%2BjT2Wt9q64a2QFEHfw%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Sat, 06 Feb 2021 21:20:55 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a849ec234a98-FRA
cf-bgj
imgq:100,h2pri
subscribe-btn.gif
www.securityweek.com/sites/all/themes/securityweek/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/subscribe-btn.gif
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4986aea94d23482c38fb06749a6a5c5c6ab95db97aa3bcc9feaf7eda6cbf6626

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
391344
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2249
cf-request-id
081007825100004a98d397f000000001
last-modified
Tue, 25 Jan 2011 04:28:42 GMT
server
cloudflare
etag
"3c0021-8c9-49aa426bbd280"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2F13mms61CZ7TpfwYAGVQy2UtyJ%2Bd%2BWOOnn%2Bzo4mWyeIyT0k6HTd3w9vzEmyylVU7BMg%2BeQaD7%2BKNEkX56YIIfBif7PGr8duzMU%2FpXRdt6wfDPmmOA%2Bf8j%2FqUwFw0Ss4tDQ%3D%3D"}],"max_age":604800}
content-type
image/gif
expires
Sun, 14 Feb 2021 06:22:01 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a84a1cae4a98-FRA
cf-bgj
imgq:100,h2pri
footer_bg.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		510 B
944 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/footer_bg.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e4a85296d37106cff5d646be0fabf370fd83a9b133c3aaf41e6ffb73d108366

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
800812
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
510
cf-request-id
081007825100004a9890083000000001
last-modified
Mon, 22 Mar 2010 15:27:23 GMT
server
cloudflare
etag
"3c0015-1fe-4826555678cc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=tLwcjdjrDWpNki2P5vGeoHNMJjjHBtdm7S4ZVrQ0WUgQ2DTTNPrhIQ0Ju0%2BAPHc9M6n3gvrX74cckjmLBojOIcWApWyVOyCtq%2BL9FirbVLjLr4NBREtFUE2%2FfH33rOUIjw%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Tue, 09 Feb 2021 12:37:33 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a84a1cb14a98-FRA
cf-bgj
imgq:100,h2pri
footer_partition.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		412 B
1002 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/footer_partition.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d77a9a71769ddc2a85524914671fb1d031132a8e37366440a4b6b01d7ad0025

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
735082
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
412
cf-request-id
081007825200004a980080c000000001
last-modified
Mon, 22 Mar 2010 15:27:29 GMT
server
cloudflare
etag
"3c000f-19c-4826555c31a40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Z9ElRAcofzLI4Xrg59aeChQXFgg1xW6i10%2BBEAVSel4%2BCGskqo3c%2FIkXD%2B3HOaTffnuE2cnAeOzssga1mmoS655jIPTHS7omyn%2B3p8sY%2F9To3ixXWDAPh%2F%2FtqPUNr4zMAg%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Wed, 10 Feb 2021 06:53:03 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a84a1cb24a98-FRA
cf-bgj
imgq:100,h2pri
footer_h3_dotted.jpg
www.securityweek.com/sites/all/themes/securityweek/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/footer_h3_dotted.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11789957fc00eda3630397edd31ee6a5575a997ab4334d79b655b3830ab4caf4

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
659802
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1026
cf-request-id
081007825200004a98e48a2000000001
last-modified
Mon, 22 Mar 2010 15:27:27 GMT
server
cloudflare
etag
"3c001d-402-4826555a495c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NZKm6gOdJWHEQFJiZD92HnWHPfhKHig7wPQRjeiQYl190SQo0zi%2FTUrpRZq6oGy8Ntc6HN9n3Y4GnOGF5D0UWTY5CTpweaSMOPca5xzoBMM4Dl%2FBT7JYDNcgTcm5CKF8Iw%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Thu, 11 Feb 2021 03:47:43 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a84a1cb44a98-FRA
cf-bgj
imgq:100,h2pri
footer_bullet.gif
www.securityweek.com/sites/all/themes/securityweek/images/ 		58 B
432 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/sites/all/themes/securityweek/images/footer_bullet.gif
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f1298490f294128f086689a5654a8340ea9ec7c20c8e97f811590d5313edc9e

Request headers

Referer
https://www.securityweek.com/sites/default/files/css/css_718fafafcc386276c845e7bdb0114c58.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:25 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
729518
cf-polished
status=not_needed
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
58
cf-request-id
081007825200004a98bb9e6000000001
last-modified
Mon, 22 Mar 2010 15:27:25 GMT
server
cloudflare
etag
"3c001e-3a-4826555861140"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ycLWTNudZxYg7PsJky07hfyO%2FJR5dxDW1s5AfDCwk3%2Fq7lHnzMBA0%2FiWeZp2JqLFlFxFpU96L5OA4xISOavtJ2SGaAgjyulR0AjrRBPokKYvw5vLRKHBE7dbYk%2Bfu39GvQ%3D%3D"}],"max_age":604800}
content-type
image/gif
expires
Wed, 10 Feb 2021 08:25:47 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a84a1cb64a98-FRA
cf-bgj
imgq:100,h2pri
init.js
www.securityweek.com/sites/all/modules/custom_control/misc/ 		1 KB
865 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/sites/all/modules/custom_control/misc/init.js?1612455285
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
05f4004f999652bf4c69b8b17fd4813363473fabcf89c056d3da5a6d8eac0555

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
081007834200004a9883304000000001
last-modified
Thu, 22 Mar 2018 21:18:02 GMT
server
cloudflare
etag
W/"3c0d00-44d-56806d7baf680"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZralgPRz%2Fv15QcyFpDISO%2Fs1i2pM7VjXM7FAk3sKm7aHHtkirN5R8aw2SjoasUZnyWvB6MBTzSrab%2FFVgv6%2BoyT4eh%2F4qFtpF6SvjaVLy%2BxxlN2fgNwmjO51Xf05092fLw%3D%3D"}],"max_age":604800}
content-type
application/javascript
cache-control
max-age=1209600
cf-ray
61c6a84b99674a98-FRA
expires
Thu, 18 Feb 2021 19:04:26 GMT
js_def5b13468ddfa4386970cbe7d780b8e.js
www.securityweek.com/sites/default/files/js/ 		785 B
711 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/sites/default/files/js/js_def5b13468ddfa4386970cbe7d780b8e.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8df0ba2d8af3e602eaba8677fe2c57228955b28868c91c2850a4c3c1ad8c7f68

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
101330
cf-polished
origSize=1094
cf-bgj
minify
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
081007834300004a98fc0ae000000001
last-modified
Wed, 03 Feb 2021 14:54:07 GMT
server
cloudflare
etag
W/"3a0014-446-5ba6fc2525cce"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=37p1QEMakFGkuqgmL5zX%2Bf1DkbWgUAXWQutJczz6%2Br7xz5swH219iS7gEwog98Mo6AnQ35i2cmYOU%2FUTTein9r6PHzkUiq7aykDL3LhGBmSYgrIMO66QEYKSCOWV4olndg%3D%3D"}],"max_age":604800}
content-type
application/javascript
cache-control
max-age=1209600
cf-ray
61c6a84b996c4a98-FRA
expires
Wed, 17 Feb 2021 14:55:36 GMT
widgets.js
platform.twitter.com/ 		95 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B72) /
Resource Hash
2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:26 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Age
85
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Content-Length
28698
x-tw-cdn
VZ
Last-Modified
Thu, 01 Oct 2020 21:52:09 GMT
Server
ECS (amb/6B72)
Etag
"a671d4d584ef50954e5cebb21da17065+gzip"
Access-Control-Max-Age
3000
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
in.js
platform.linkedin.com/ 		181 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.linkedin.com/in.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F0A) /
Resource Hash
28bcb4f0306800cf4c3706d53203e0d016f6493cbb70043b819bf5f4a48d4e0c

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
gzip
x-cdn-client-ip-version
IPV6
x-cdn
ECST
age
2918
x-cache
HIT
x-cdn-proto
HTTP2
content-length
55604
x-li-uuid
ZFAl9iSeYBYgZMxxpSsAAA==
server
ECAcc (frc/8F0A)
last-modified
Thu, 04 Feb 2021 18:15:48 GMT
x-li-pop
prod-efr5
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
accept-ranges
bytes
x-li-proto
http/1.1
x-li-fabric
prod-lva1
expires
Thu, 4 Feb 2021 19:15:48 GMT
js_6e579c89d00a4fee8965bdf76dd962fa.js
www.securityweek.com/sites/default/files/js/ 		69 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/sites/default/files/js/js_6e579c89d00a4fee8965bdf76dd962fa.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1098ef7fef25a8fd6eac7dbf1442047062c4d1400c601f8ff843742c61de640c

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
101330
cf-polished
origSize=90975
cf-bgj
minify
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
081007834700004a98bcb97000000001
last-modified
Wed, 03 Feb 2021 14:54:07 GMT
server
cloudflare
etag
W/"3a0004-1635f-5ba6fc2524946"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sdxbs5eRvZf6%2BsjKC7QbEPFKcHsnEueiOXSOa7nXyvZUQ2A0ETvWhj%2F2JEX5LIQWZrXThy47O6XQYf6%2Btohh3zGp8VSWD3c7unHouPU%2FBAf%2FKYelLFvQy2DizspA%2B5gyEA%3D%3D"}],"max_age":604800}
content-type
application/javascript
cache-control
max-age=1209600
cf-ray
61c6a84b996f4a98-FRA
expires
Wed, 17 Feb 2021 14:55:36 GMT
truncated
/ 		6 KB
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
03253e6108bcbd971960c840c954069278e642928fcfaf9bc4e002fff1d61a0d

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
text/css;charset=utf-8
gpt.js
www.googletagservices.com/tag/js/ 		56 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92997675d99730ec8f0dc897926ddca4e87b1a87e94b865e12e360b87753cd39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"774 / 611 of 1000 / last-modified: 1612461383"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
19174
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:26 GMT
plusone.js
apis.google.com/js/ 		49 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/js/plusone.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d54294a6014df645a307b1ddcc2647e902b58333bc92a30d65ea1786d77457d2
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-XVsLyeMLUiHK617RdF1fUw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
x-ua-compatible
IE=edge, chrome=1
server
ESF
x-frame-options
SAMEORIGIN
etag
"3c51cc543292f02d30879e16f46128be"
strict-transport-security
max-age=31536000
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=1800, stale-while-revalidate=1800
content-security-policy
script-src 'report-sample' 'nonce-XVsLyeMLUiHK617RdF1fUw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin
*
expires
Thu, 04 Feb 2021 19:04:26 GMT
in.js
platform.linkedin.com/ 		181 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.linkedin.com/in.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:66b5:799a:7cd3:f74d:7071 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F0A) /
Resource Hash
28bcb4f0306800cf4c3706d53203e0d016f6493cbb70043b819bf5f4a48d4e0c

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
gzip
x-cdn-client-ip-version
IPV6
x-cdn
ECST
age
2918
x-cache
HIT
x-cdn-proto
HTTP2
content-length
55604
x-li-uuid
ZFAl9iSeYBYgZMxxpSsAAA==
server
ECAcc (frc/8F0A)
last-modified
Thu, 04 Feb 2021 18:15:48 GMT
x-li-pop
prod-efr5
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
accept-ranges
bytes
x-li-proto
http/1.1
x-li-fabric
prod-lva1
expires
Thu, 4 Feb 2021 19:15:48 GMT
pubads_impl_2021020101.js
securepubads.g.doubleclick.net/gpt/ 		275 KB
98 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f2.1e100.net
Software
sffe /
Resource Hash
c7736f6538aca3fcafdd33667cdcbb4baaf13cb9217f11c95fd00f01d788c6f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 01 Feb 2021 09:41:46 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
99427
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:26 GMT
cb=gapi.loaded_0
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/ 		141 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/cb=gapi.loaded_0
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1dbe94f24870455b60be49be9b72675f862260aa374086a786e893f59cb080b0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 09:20:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 27 Jan 2021 20:08:03 GMT
server
sffe
age
35061
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
50334
x-xss-protection
0
expires
Fri, 04 Feb 2022 09:20:05 GMT
cb=gapi.loaded_1
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/ 		97 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/cb=gapi.loaded_1
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
274c5c962cd8ec53ac23d6d07978901972efd7b33e2eb0d1a7222c61fb7f907d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 03:49:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 27 Jan 2021 20:08:03 GMT
server
sffe
age
54916
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
34392
x-xss-protection
0
expires
Fri, 04 Feb 2022 03:49:10 GMT
fastbutton
apis.google.com/se/0/_/+1/ Frame 2FA9 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.securityweek.com&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-EvltI5Uz33vrSowQ1EXBvA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
apis.google.com
:scheme
https
:path
/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.securityweek.com&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
NID=208=I0Jf34J0lkI8JbEulEgiMjtmgPfvXGu4FppFj5kdr79MhqfhkRs5jP6bVGWs3TvcMvdlJQg0WcSJbGdUW5frrJqZrIr6UtooxPXEuMygPNDSl30BKrOUmnQ8l9qa1YhNzd1XGwifxaYocO2hVZjZmzRWN4p6IIS7qO6JpznHSjI
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Thu, 04 Feb 2021 19:04:26 GMT
content-security-policy
script-src 'report-sample' 'nonce-EvltI5Uz33vrSowQ1EXBvA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
content-encoding
gzip
server
ESF
x-xss-protection
0
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
fastbutton
apis.google.com/se/0/_/+1/ Frame 86F0 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.securityweek.com&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-I958+W2ACYtEgVgcHJoZMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
apis.google.com
:scheme
https
:path
/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=https%3A%2F%2Fwww.securityweek.com&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&gsrc=3p&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
NID=208=I0Jf34J0lkI8JbEulEgiMjtmgPfvXGu4FppFj5kdr79MhqfhkRs5jP6bVGWs3TvcMvdlJQg0WcSJbGdUW5frrJqZrIr6UtooxPXEuMygPNDSl30BKrOUmnQ8l9qa1YhNzd1XGwifxaYocO2hVZjZmzRWN4p6IIS7qO6JpznHSjI
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Thu, 04 Feb 2021 19:04:26 GMT
content-security-policy
script-src 'report-sample' 'nonce-I958+W2ACYtEgVgcHJoZMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
content-encoding
gzip
server
ESF
x-xss-protection
0
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
plusone.js
apis.google.com/js/ 		49 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/js/plusone.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d54294a6014df645a307b1ddcc2647e902b58333bc92a30d65ea1786d77457d2
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-7Pgs5bRvefo8B6ga0lGPvQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
x-ua-compatible
IE=edge, chrome=1
server
ESF
x-frame-options
SAMEORIGIN
etag
"3c51cc543292f02d30879e16f46128be"
strict-transport-security
max-age=31536000
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=1800, stale-while-revalidate=1800
content-security-policy
script-src 'report-sample' 'nonce-7Pgs5bRvefo8B6ga0lGPvQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin
*
expires
Thu, 04 Feb 2021 19:04:26 GMT
widgets.js
platform.twitter.com/ 		95 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B72) /
Resource Hash
2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:26 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Age
85
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Content-Length
28698
x-tw-cdn
VZ
Last-Modified
Thu, 01 Oct 2020 21:52:09 GMT
Server
ECS (amb/6B72)
Etag
"a671d4d584ef50954e5cebb21da17065+gzip"
Access-Control-Max-Age
3000
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
ga.js
ssl.google-analytics.com/ 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
1906
date
Thu, 04 Feb 2021 18:32:40 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17168
expires
Thu, 04 Feb 2021 20:32:40 GMT
embed.js
securityweek.disqus.com/ 		0
0
google_custom_search_watermark.gif
cse.google.com/coop/intl/en/images/
Redirect Chain
  • https://www.google.com/coop/intl/en/images/google_custom_search_watermark.gif
  • https://cse.google.com/coop/intl/en/images/google_custom_search_watermark.gif
2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cse.google.com/coop/intl/en/images/google_custom_search_watermark.gif
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
pfe /
Resource Hash
4b4b65dc5e87ed8215fb3d74834cd100069e7eb8aaf903a4665e26079fb0777d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 18:40:28 GMT
x-content-type-options
nosniff
last-modified
Wed, 08 Feb 2012 18:07:38 GMT
server
pfe
age
1438
x-frame-options
SAMEORIGIN
content-type
image/gif
cache-control
public, max-age=1800
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2024
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:10:28 GMT

Redirect headers

date
Thu, 04 Feb 2021 18:57:25 GMT
x-content-type-options
nosniff
server
sffe
age
421
content-type
text/html; charset=UTF-8
location
https://cse.google.com/coop/intl/en/images/google_custom_search_watermark.gif
cache-control
public, max-age=1800
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
274
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:27:25 GMT
ad.html
www.securityweek.com/ Frame 7F06 		0
0
ad.html
www.securityweek.com/ Frame 5190 		556 B
577 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.securityweek.com/ad.html
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
437542a358225b118f29d8d09db80177878af0ae9581353e3e701ec7416c67b8

Request headers

:method
GET
:authority
www.securityweek.com
:scheme
https
:path
/ad.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=d9047922892475fdf5cbd06d333c193bd1612465465; SESSc3f2c9572aa8f3f5ea6f60501affecb3=ed2aff7fa06b75e0a40002d60e5baf65; SESSae1377f0cbe7278b70a9339b7853afbd=f70c4c1599e7a8c8b9a3b2bf8e5dea9b; has_js=1; sessid=1
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-type
text/html
last-modified
Mon, 04 Jan 2021 19:55:42 GMT
cache-control
max-age=1209600
expires
Thu, 18 Feb 2021 19:04:26 GMT
cf-cache-status
DYNAMIC
cf-request-id
081007848d00004a98900c8000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=D0BYK1r5dy8NYrxZ5C4%2FTiL0%2FrvnHmZ9MxcuU%2BG%2FDq%2FwrpYI%2Ful9GMy%2BGUEXLyv1Jx2q4xez1j1xEYKFLE9usNHbP%2F%2FcViWUFEvs%2BVytFptlzRxTF%2BrsF8iQgdwiElN5MA%3D%3D"}],"max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
61c6a84daf544a98-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html
platform.twitter.com/widgets/ Frame 74E5 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fwww.securityweek.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B94) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
559867
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Thu, 04 Feb 2021 19:04:26 GMT
Etag
"9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified
Thu, 01 Oct 2020 21:50:01 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (amb/6B94)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
5825
__utm.gif
ssl.google-analytics.com/r/ 		35 B
378 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1052794237&utmhn=www.securityweek.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Hijacked%20Perl.com%20Domain%20Hosted%20on%20IP%20Address%20Linked%20to%20Malicious%20Activity%20%7C%20SecurityWeek.Com&utmhid=621782356&utmr=-&utmp=%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&utmht=1612465466587&utmac=UA-11590534-1&utmcc=__utma%3D89563204.2047901894.1612465467.1612465467.1612465467.1%3B%2B__utmz%3D89563204.1612465467.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=621007841&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:26 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
button.63c51c903061d0dbd843c41e8a00aa5a.js
platform.twitter.com/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/js/button.63c51c903061d0dbd843c41e8a00aa5a.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B72) /
Resource Hash
e0a70c5d116d9c823c7d7958ecea2a7926315fac156e390bd7dc8a5fa088cdc3

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:26 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Oct 2020 21:49:51 GMT
Server
ECS (amb/6B72)
Age
591444
Etag
"62d4b0301f07768d13f3ee5de8633739+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
2294
postmessageRelay
accounts.google.com/o/oauth2/ Frame CEAC 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.securityweek.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Requested by
Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/cb=gapi.loaded_1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-Ndyjlab0VuwDADf5DbKqFw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
accounts.google.com
:scheme
https
:path
/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.securityweek.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
NID=208=I0Jf34J0lkI8JbEulEgiMjtmgPfvXGu4FppFj5kdr79MhqfhkRs5jP6bVGWs3TvcMvdlJQg0WcSJbGdUW5frrJqZrIr6UtooxPXEuMygPNDSl30BKrOUmnQ8l9qa1YhNzd1XGwifxaYocO2hVZjZmzRWN4p6IIS7qO6JpznHSjI
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Thu, 04 Feb 2021 19:04:26 GMT
content-security-policy
script-src 'report-sample' 'nonce-Ndyjlab0VuwDADf5DbKqFw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding
gzip
server
ESF
x-xss-protection
0
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
integrator.js
adservice.google.de/adsid/ 		109 B
169 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.securityweek.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
169 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.securityweek.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		65 KB
15 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1374787860578389&correlator=3507679300499&output=ldjh&impl=fifs&eid=21068773%2C21068891%2C21069727%2C21069710&vrg=2021020101&ptt=17&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20210204&iu_parts=1009451%2C300x250-Lower%2C300x600-Right-Side%2C728x90-Bottom%2CSecurityWeek-Splash-640x480%2CSecurityWeek_Home_Top_728x90%2CSecurityWeek_Home_Top_Right_300x250%2CRSA-ThreatInsights-300x600%2CRSA-ThreatInsights-728x90&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8&prev_iu_szs=300x250%2C300x600%2C728x90%2C640x480%2C728x90%2C300x250%2C300x600%2C728x90&cookie_enabled=1&bc=31&abxe=1&lmt=1612455285&dt=1612465466688&dlt=1612465465828&idt=826&frm=20&biw=1600&bih=1200&oid=3&adxs=-9%2C993%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adys=-9%2C621%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adks=2099535745%2C3057893268%2C1175233209%2C4168261516%2C3429238268%2C2944426297%2C4131204049%2C771541050&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1%7C303x610%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&msz=0x-1%7C300x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&ga_vid=108799374.1612465467&ga_sid=1612465467&ga_hid=621782356&fws=2%2C4%2C2%2C2%2C2%2C2%2C2%2C2&ohw=0%2C998%2C0%2C0%2C0%2C0%2C0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f2.1e100.net
Software
cafe /
Resource Hash
a787f22c2e2297b2acb943e47272ea96677842ee094cf0d80bfc70c55bbd1287
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14138
x-xss-protection
0
google-lineitem-id
-2,4506530349,-2,4505881099,-2,-2,-2,-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2,138308208778,-2,138298383466,-2,-2,-2,-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.securityweek.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
25300d651079e96f05865a1cfcda291b.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://25300d651079e96f05865a1cfcda291b.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
Virtual-Events-640x480.jpg
www.securityweek.com/ad/ Frame 5190 		146 KB
147 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.securityweek.com/ad/Virtual-Events-640x480.jpg
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/ad.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6818:a103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a060b3f77ac5873b42822513a8d9c2439423dd9be07cf85d3e45f3dd8028d378

Request headers

Referer
https://www.securityweek.com/ad.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
255822
cf-polished
origSize=168045
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
149643
cf-request-id
081007856200004a988004f000000001
last-modified
Mon, 04 Jan 2021 19:53:39 GMT
server
cloudflare
etag
"2c082c-2906d-5b81872459d18"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DwvTHdkhwrA8crmY6dinAgu%2Bc%2FCYgyn4292Wi7WO3z88GBoaFsI%2FoEOK09MgpHo9dAc0oWb04A%2FET0RAKsQiedJIO6hn%2BiYNyYow8YRPfn3OuKPL1zswA7KVP8sPwZ%2Fazw%3D%3D"}],"max_age":604800}
content-type
image/jpeg
expires
Mon, 15 Feb 2021 20:00:44 GMT
cache-control
max-age=1209600
accept-ranges
bytes
cf-ray
61c6a84f0b3c4a98-FRA
cf-bgj
imgq:100,h2pri
tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
platform.twitter.com/widgets/ Frame 3A98 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B72) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
591443
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Thu, 04 Feb 2021 19:04:26 GMT
Etag
"076dccdedb34f3771be52190b917884e+gzip"
Last-Modified
Thu, 01 Oct 2020 21:49:58 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (amb/6B72)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
12263
tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
platform.twitter.com/widgets/ Frame C24B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/tweet_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B72) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
591443
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Thu, 04 Feb 2021 19:04:26 GMT
Etag
"076dccdedb34f3771be52190b917884e+gzip"
Last-Modified
Thu, 01 Oct 2020 21:49:58 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (amb/6B72)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
12263
gen_204
pagead2.googlesyndication.com/pagead/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=gfp_cw_status&domain=securityweek.com&host=www.securityweek.com&success=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame CAF3 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv32KbPrvLkr6cKQZAYRO9loAHvbymy6338SwRQ5FI32C5VziKJOZlA8DXA65QM2WLZvmWo3YBZRvELunbWh5VKu2Gd8LPP7kql5Q778PVJQX9S22APBFUf9dGIjDtw6UpQnD4S-7epKoQjPnC17tgoadECyz5oIGoFVQAYcZzTZtLwily3ZNQIxj6GKgVtQLRLL4eCt0a16ZSrKEMf3kd8jfBoeKPlcecuUzzw33LwF0IhwNR1TfDXjZKpJCO4IrhWw1OQFQsW743xaYDtu8Cd3g_y2eGSl6h4Jz89kq4KS55R7s5fCb9hUtU&sai=AMfl-YTazOnQZCbzMbJlW5CJpRMAJqi49PV262i5o6kpoUAhLjwbt3_KcN-2Wob7Kixv1lX_b5HVSXnmA15-fDCo1bksdVAUYSxmTvf-lyVdoOGBz8kP9GS4mLC-09PbY5bh&sig=Cg0ArKJSzL0e_vSwXNGeEAE&adurl=
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 04 Feb 2021 19:04:26 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:26 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210202/r20110914/ Frame CAF3 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210202/r20110914/abg_lite_fy2019.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2f1eba35c5c38e67956012861717efdbc6d13c8de0d624213f66de83b8262ff3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 18:04:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3568
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7377
x-xss-protection
0
server
cafe
etag
9429885086326325396
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 18 Feb 2021 18:04:58 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210202/r20110914/client/ Frame CAF3 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210202/r20110914/client/window_focus_fy2019.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5593d7d222d4086d4427b7c81fb081bf45884d8e1499e1ac1adafb017dc102f9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 18:07:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3435
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1533
x-xss-protection
0
server
cafe
etag
10039694515999607746
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 18 Feb 2021 18:07:11 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame CAF3 		106 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f1762ce2250a6a35a6fd892b054eec13df91cf939dca3e40ade35ae57d90b215
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1612182882448455"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
33332
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:26 GMT
l
www.google.com/ads/measurement/ Frame CAF3 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQw1eb_CUhFoGI6vCZ7SAyl1SBbhpulLej06kNPYkpS1gy1OTM8R5783322hcekJl2qFza9
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
1956689884250199370
tpc.googlesyndication.com/simgad/ Frame CAF3 		200 KB
200 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/1956689884250199370
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d700d6487ef4b0198e9a669c9ec89dd2d633302b7c82808b08f37ff9d38e98b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 31 Jan 2021 18:24:18 GMT
x-content-type-options
nosniff
age
348008
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
204410
x-xss-protection
0
last-modified
Wed, 01 Apr 2020 12:54:53 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 31 Jan 2022 18:24:18 GMT
osd.js
www.googletagservices.com/activeview/js/current/ 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
208dfab1fdcf1f4e57f80d6fd873265f0ff90c42c36cb25e38dff42695e383a4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1612182870646033"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
28348
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:26 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		9 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021020101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bc575d419b988dc23317ce463b92b9bc58c28850a236ed8526828585526036aa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 04 Feb 2021 19:04:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6732
x-xss-protection
0
truncated
/ Frame CAF3 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e5340a761f7b704f687fd052d57a5e6b1a136f902e91705f30cce0e2eb043808

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021020101.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 19:04:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1611170586013198"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6403
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:27 GMT
BrightInfoVersion.aspx
app.brightinfo.com/ 		512 B
944 B 		Script
General
Check archive.org
Download Go to
Full URL
https://app.brightinfo.com/BrightInfoVersion.aspx
Requested by
Host: www.securityweek.com
URL: https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
168.62.202.120 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
d5888d7675ebd29a725b082942b3e9393bf7528c119ddb249af00c870c670493

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 04 Feb 2021 19:04:27 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control
no-cache, no-store
Content-Type
text/javascript; charset=utf-8
Content-Length
505
Expires
-1
view
securepubads.g.doubleclick.net/pcs/ Frame CAF3 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssu5hFfL5CXUfEQDTgZ7Pw4hbNQq4_CfU5rG13g8yhqdPlChGADUlpCDRuu7ZmTrepwlHKKtEtvPyRWc0Jwq321c6U8MTxUVRKRVmPiH8H95T-KhUaWh7Kr2JOiRZeSpHShYOFYCa17Z_no8b43MwuibLE9oJ1LDD37VAL4hk_YLlHXpVotu4XHuP-St__A2LBhTiKy5vY5AHtkxG9hGsbruTdZlRqyIiIAC0HgYNvdqwa6JRzecLkVaYVdUX4y1NYwS3teLwzxrGk3r-3zwTDMKMQ3m0dK05DlxZTnt9lVFvPXqoAR0IbhVLLKWw&sai=AMfl-YQsg4tJdBU-TRtFTmXRlHs1-io8M9m8NwMBcpcKXRPLey3OiAcmcCpq_oRvHO-VE8E2W8uqVLjlMyAWc8KE3kC1kvNlKaTY9qMWN1Ith7MRGWeZuk6M19Mhj-x1AZ9A&sig=Cg0ArKJSzIxrSpEJUoEdEAE&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 04 Feb 2021 19:04:27 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Thu, 04 Feb 2021 19:04:27 GMT
jot.html
platform.twitter.com/ Frame 2F3B
Redirect Chain
  • https://syndication.twitter.com/i/jot
  • https://platform.twitter.com/jot.html
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/jot.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6B72) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
Origin
https://www.securityweek.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
591440
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Thu, 04 Feb 2021 19:04:27 GMT
Etag
"d9592a6c704736fa4da218d4357976dd"
Last-Modified
Thu, 01 Oct 2020 21:52:09 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (amb/6B72)
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
80

Redirect headers

cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length
0
content-type
text/html;charset=utf-8
date
Thu, 04 Feb 2021 19:04:27 GMT
expires
Tue, 31 Mar 1981 05:00:00 GMT
last-modified
Thu, 04 Feb 2021 19:04:27 GMT
location
https://platform.twitter.com/jot.html
pragma
no-cache
server
tsa_f
status
302 Found
strict-transport-security
max-age=631138519
x-connection-hash
cde47b3133345129607fe9af078a6f73
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-response-time
103
x-transaction
00f7190900886e25
x-tsa-request-body-time
0
x-twitter-response-tags
BouncerCompliant
x-xss-protection
0
runner.html
tpc.googlesyndication.com/sodar/sodar2/221/ Frame 6466 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/221/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
4984
date
Thu, 04 Feb 2021 18:33:12 GMT
expires
Fri, 04 Feb 2022 18:33:12 GMT
last-modified
Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
1875
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
gen_204
pagead2.googlesyndication.com/pagead/ 		0
224 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gpt_2021020101&jk=1374787860578389&bg=!U1ClUBPNAAWnsTPUpzsAKQB2-DxadgpiuyqQv7MrJYBs-0A9ymErPoKtn4OaEUQSfrKf_8xzHj6oAgAAAK9SAAAAFWgBBwoBRhhITIpglQ6uSTQqtJtbAPJ3udHXtkfv5LYWVnLIQdS-AE13iK1v01ga_VeSaABA-BVz0GrrE7y--NbEIhJEqofJb1cbx5TRmg1oN6JPk7a9bsOTY4Ncls14UslX1BiAxrEDo6J7IxGMcN1SrC_W5TFnAjxQqXLYXjpf2zR6mEeNb0SsjCRPSCTwMO31hRxFXsQc7buD3UEG43pnkuoXwwzQGvUEhv2IYb9INwgVrSFVHiht2w_ITpyW1V8APIDhfZFveIL5HeB6CtdZOk8Y0kLFXG6M4PX3rPMEOUmqdy5AMrkuV8lge4MsyA-06cp8njq5ahVgiIAjLnozypMOarmZ_QbaVFHFFOo0OMgx0pmcftuYhI09kqUgMUGsG6GysWDBfIP2dsHMezc_zih3QOkntOb4C7dfftrqWBUE15KnLec_aJXpmQHO805hG-f6UM9p0XZL3Vkz2b863yqVDUEdArqCwDQOV5A837JXgYqQpnjovicd4U6cygWdG1vT6CMk-zhgenZC2RVuvLmLFztmuiVSII2Rs92vLoIsWOZWezD3l83fOR_cAdHB4onswbzQR79ZN2zxbORjJ3Q_fCORFr77D4-ODDClC4W5X3ueKMMiPRRBX1hiYmtO0XrVQdxDeR3_FSS-3kbTt-pmfcVIHZI9RDk9FdLuVoLn969Gaq18-8Kyxg51B7hncOfQi6t8xGLMGVCohZtXg_1QBz7aSoTH7UgmlfDctJxVSBB6zovNtVyZHMuKcU4fGMqenNaFVhfq1IX4vbDbXGIWNgLmWG90LFqYcCZvHlBuEC5hu9C2AsX6-ElS7mW8Y0Y-0icGppVZjQbW3M0miwT5tEyMEYr3jAGkJBmc4z4CLdY8yGsjH-_mPFZfako2e2-Tt1cotqISg5X27xuDAG7UyhDNsXH4wS3Ohe-gbO_SNSPz6WeiNUBeBX4yuRz7fpg8NpfdGYj7-QmlZJhomZIhwZqPR9Gpxt8mnymrJckwA0k3_qstG4HKAgW-GW5jgkVTysXHekyxwIsZ8sVOWFfFti1DwF7khvL-
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:27 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bi.js
app.brightinfo.com/Scripts/ 		260 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/BrightInfoVersion.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
168.62.202.120 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
c5d22156666a1a8d7c0b660324a007ae7c2a0a3a355a893b180f65d989bdee11

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:27 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
text/javascript; charset=utf-8
Cache-Control
private
Content-Length
76328
Expires
Fri, 04 Feb 2022 19:04:28 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame CAF3 		42 B
155 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssTM2G7nkUJQa8ZBwjEXqu5WujLPhsLwcE0-E6AXMCeZwaVg2R7bkbR70-OiuOwS-l0uMZJrcXOys37qlgXAZYlfZAyefdUBvpfTHZ8G9w&sig=Cg0ArKJSzGGxGL0C-LLOEAE&id=osdim&mcvt=1001&p=621,993,1221,1293&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20210201&bin=7&avms=nio&bs=1600,1200&mc=0.97&app=0&itpl=3&adk=3057893268&rs=4&met=mue&la=0&cr=0&osd=0&vs=4&r=v&uup=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:28 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		46 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
5961
date
Thu, 04 Feb 2021 17:25:07 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Thu, 04 Feb 2021 19:25:07 GMT
bia.aspx
bia.brightinfo.com/ 		19 B
409 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bia.brightinfo.com/bia.aspx?callback=jQuery20309810082940854936_1612465468671&type=biLoad&version=2&jsonString=%7B%22url%22%3A%22https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity%22%2C%22cts%22%3A1612465468694%2C%22cid%22%3A%22wiredbusinessmedia-14532-1%22%2C%22pu%22%3A%22https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity%22%2C%22ru%22%3A%22%22%2C%22type%22%3A%22biLoad%22%2C%22sid%22%3A%22cZ081SmIXJ6sqx9sHqPY%22%2C%22mobile%22%3A0%2C%22browser%22%3A%22chrome%22%2C%22accountId%22%3A%2214532%22%2C%22version%22%3A2%7D&_=1612465468672
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
137.135.51.188 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
0e688d02687c4c64094dd0a75f5189ea12b955acf8c91f7bd5ac4948f1429cb9

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:28 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
private
Content-Length
136
bi-animate.min.css
app.brightinfo.com/ui/ 		47 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://app.brightinfo.com/ui/bi-animate.min.css?bi_ver=132292759840000000&id=wiredbusinessmedia-14532-1&sid=cZ081SmIXJ6sqx9sHqPY
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
168.62.202.120 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
46cad46571cab06c5901e4e867aba4f0783dc88d3db626cfb73d58f00d130a16

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:28 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Mar 2020 14:53:24 GMT
Server
Microsoft-IIS/8.0
X-Powered-By
ASP.NET
ETag
"04a8a7890ffd51:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
4661
bi.min.css
app.brightinfo.com/ui/ 		47 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://app.brightinfo.com/ui/bi.min.css?bi_ver=132292759840000000&id=wiredbusinessmedia-14532-1&sid=cZ081SmIXJ6sqx9sHqPY
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
168.62.202.120 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
810956c722149065eabd5b5c4f62f98cb74cda6fb5e3695ab97958e53d6791ca

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:28 GMT
Content-Encoding
gzip
Last-Modified
Sat, 21 Mar 2020 14:53:24 GMT
Server
Microsoft-IIS/8.0
X-Powered-By
ASP.NET
ETag
"04a8a7890ffd51:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
7239
bi-custom.css
app.brightinfo.com/ui/custom/wiredbusinessmedia-14532-1/ 		548 KB
57 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://app.brightinfo.com/ui/custom/wiredbusinessmedia-14532-1/bi-custom.css?bi_ver=132292759840000000&id=wiredbusinessmedia-14532-1&sid=cZ081SmIXJ6sqx9sHqPY
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
168.62.202.120 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
5690a1bcc83d00312ef6260da791205a71d80bed7b35ca9701c7b29cfd62b3fe

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:28 GMT
Content-Encoding
gzip
Last-Modified
Mon, 25 Jan 2021 18:19:52 GMT
Server
Microsoft-IIS/8.0
X-Powered-By
ASP.NET
ETag
"0946bac46f3d61:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
58375
bi.aspx
app.brightinfo.com/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.brightinfo.com/bi.aspx?method=load&callback=jQuery20309810082940854936_1612465468673&id=wiredbusinessmedia-14532-1&sid=cZ081SmIXJ6sqx9sHqPY&u=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&r=&testModeKey=&biSettings=&fip=&fvs=&fcs=&fec=&fic=&force=&forceHide=false&sw=1600&sh=1200&w=1600&h=1200&utma=89563204.cZ081SmIXJ6sqx9sHqPY.1612465467.1612465467.1612465467.1&ga=&logId=&iframe=false&startTime=637480622678508200&_=1612465468674
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
168.62.202.120 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
c10d8a6a975b58afbc198cf709c0d14fbb4bf06734576477a56904153af90c3c

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:28 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control
private
Content-Type
text/javascript; charset=utf-8
Content-Length
2570
collect
www.google-analytics.com/j/ 		2 B
90 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&a=621782356&t=pageview&_s=1&dl=https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&ul=en-us&de=UTF-8&dt=Hijacked%20Perl.com%20Domain%20Hosted%20on%20IP%20Address%20Linked%20to%20Malicious%20Activity%20%7C%20SecurityWeek.Com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=89563204.2047901894.1612465467.1612465467.1612465467.1&_utmz=89563204.1612465467.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1612465469553&_u=KQBCAEABGAAAAC~&jid=651231975&gjid=681265337&cid=2047901894.1612465467&tid=UA-72146139-2&_gid=1444786549.1612465470&_r=1&_slc=1&cd2=1612465469551&cd3=Hidden&cd4=No%20recommended%20content&cd5=No%20Value&cd6=No%20Value&cd7=No%20Value&cd8=No%20Value&cd9=No%20Value&cd10=No%20Value&cd11=No%20Value&cd12=No%20Value&cd13=No%20Value&cd14=No%20Value&cd15=Default%20Content&z=1383483876
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 19:04:29 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.securityweek.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
bia.aspx
bia.brightinfo.com/ 		25 B
414 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bia.brightinfo.com/bia.aspx?callback=jQuery20309810082940854936_1612465468673&type=biVisit&version=2&jsonString=%7B%22url%22%3A%22https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity%22%2C%22cts%22%3A1612465469556%2C%22cid%22%3A%22wiredbusinessmedia-14532-1%22%2C%22pu%22%3A%22https%3A%2F%2Fwww.securityweek.com%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity%22%2C%22ru%22%3A%22%22%2C%22type%22%3A%22biVisit%22%2C%22mobile%22%3A0%2C%22browser%22%3A%22chrome%22%2C%22accountId%22%3A14532%2C%22gatedPromotion%22%3Afalse%2C%22seq%22%3A1%2C%22siteId%22%3A14522%2C%22vs%22%3A%22Hidden%22%2C%22cs%22%3A%22Default+Content%22%2C%22version%22%3A2%2C%22promoId%22%3A0%7D&_=1612465468675
Requested by
Host: app.brightinfo.com
URL: https://app.brightinfo.com/Scripts/bi.js?bi_ver=132292759840000000
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
137.135.51.188 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
ff6616b4a28c3407b10c28873184aabcca21c4b741b8bc190e21cccacf24d9c6

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 19:04:29 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
private
Content-Length
141
__utm.gif
ssl.google-analytics.com/ 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=2&utmn=132028560&utmhn=www.securityweek.com&utme=8(WidgetPanelLocation%2FTimestamp*isPromotedContent*BI_ID*SID*ViewSegmentName)9(regular%7C1612465469494*No%20recommended%20content*No%20Value*89563204.cZ081SmIXJ6sqx9sHqPY.1612465467.1*Hidden)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Hijacked%20Perl.com%20Domain%20Hosted%20on%20IP%20Address%20Linked%20to%20Malicious%20Activity%20%7C%20SecurityWeek.Com&utmhid=621782356&utmr=-&utmp=%2Fhijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity&utmht=1612465469521&utmac=UA-72146139-1&utmcc=__utma%3D89563204.2047901894.1612465467.1612465467.1612465467.1%3B%2B__utmz%3D89563204.1612465467.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qRAAAAAAIAQAAAAAAAAAAAAE~
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.securityweek.com/hijacked-perlcom-domain-hosted-ip-address-linked-malicious-activity
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 04 Feb 2021 06:16:51 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
46058
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
securityweek.disqus.com
URL
http://securityweek.disqus.com/embed.js
Domain
www.securityweek.com
URL
https://www.securityweek.com/ad.html

Verdicts & Comments Add Verdict or Comment

110 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| Eager object| CloudflareApps object| __cfQR object| Drupal object| jaaulde function| tb_show function| tb_showIframe function| tb_remove function| tb_position function| tb_parseQuery function| tb_getPageSize function| tb_setBrowserExtra function| tb_focusFirstFormElement string| disqus_shortname number| disqus_developer string| disqus_url string| disqus_title string| disqus_identifier function| disqus_config object| disqus_def_name object| disqus_def_email function| quicktabsClick object| Blueprint function| $ function| jQuery object| googletag string| biJsUrl object| _biq object| __core-js_shared__ object| Sslac object| IN object| __twttrll object| twttr object| __twttr object| ggeac object| google_js_reporting_queue object| gapi object| ___jsl object| _gaq boolean| __cfRLUnblockHandlers number| xWidth object| gadgets object| osapi object| iframer object| __gapi_jstiming__ object| shindig function| ToolbarApi object| iframes function| IframeBase function| Iframe function| IframeProxy function| IframeWindow object| _gat object| gaGlobal object| oauth2 function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter undefined| google_measure_js_timing object| googleToken object| googleIMState function| processGoogleToken number| __google_ad_urls_id number| google_unique_id object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| GoogleGcLKhOms object| google_image_requests string| bi_ver string| biSiteUrl string| biUtmaPrefix number| biStartTime function| jQueryBI object| _BI object| jQBrowser boolean| biLoaded string| biUrl string| GoogleAnalyticsObject function| _gabi object| SessionOptionsBI undefined| jQuery20309810082940854936_1612465468671 undefined| jQuery20309810082940854936_1612465468673 object| google_tag_data object| gaplugins object| _BI_ object| gaData

3 Cookies

Domain/Path Name / Value
.securityweek.com/ Name: SESSae1377f0cbe7278b70a9339b7853afbd
Value: f70c4c1599e7a8c8b9a3b2bf8e5dea9b
.securityweek.com/ Name: SESSc3f2c9572aa8f3f5ea6f60501affecb3
Value: ed2aff7fa06b75e0a40002d60e5baf65
.securityweek.com/ Name: __cfduid
Value: d9047922892475fdf5cbd06d333c193bd1612465465

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

25300d651079e96f05865a1cfcda291b.safeframe.googlesyndication.com
accounts.google.com
adservice.google.com
adservice.google.de
ajax.cloudflare.com
apis.google.com
app.brightinfo.com
bia.brightinfo.com
cse.google.com
pagead2.googlesyndication.com
platform.linkedin.com
platform.twitter.com
securepubads.g.doubleclick.net
securityweek.disqus.com
ssl.google-analytics.com
syndication.twitter.com
tpc.googlesyndication.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagservices.com
www.securityweek.com
securityweek.disqus.com
www.securityweek.com
104.244.42.8
137.135.51.188
168.62.202.120
172.217.18.98
2606:2800:233:66b5:799a:7cd3:f74d:7071
2606:2800:234:59:254c:406:2366:268c
2606:4700:20::6818:a103
2606:4700::6810:a823
2a00:1450:4001:801::200d
2a00:1450:4001:802::2008
2a00:1450:4001:808::200e
2a00:1450:4001:809::200e
2a00:1450:4001:80f::2002
2a00:1450:4001:812::2001
2a00:1450:4001:821::2008
2a00:1450:4001:828::2002
2a00:1450:4001:82a::2001
2a00:1450:4001:82b::2004
2a00:1450:4001:82b::200e
2a03:2880:f11c:8183:face:b00c:0:25de
03253e6108bcbd971960c840c954069278e642928fcfaf9bc4e002fff1d61a0d
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
05f4004f999652bf4c69b8b17fd4813363473fabcf89c056d3da5a6d8eac0555
08fa49f20076c343e2724c631a732d8cbd3bd0daf55f4a0f8311e07dc77be29c
0deae7d488b0316e0149f1dc2caec46821b2272127b61b4ffadf6f99a303ea16
0e688d02687c4c64094dd0a75f5189ea12b955acf8c91f7bd5ac4948f1429cb9
1098ef7fef25a8fd6eac7dbf1442047062c4d1400c601f8ff843742c61de640c
10f0e5158e45d76ba649af69ed465a28489483ac934b3e491773cb5e4c9704f0
11789957fc00eda3630397edd31ee6a5575a997ab4334d79b655b3830ab4caf4
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1dbe94f24870455b60be49be9b72675f862260aa374086a786e893f59cb080b0
200abde0c426b23abe8a9c501ab4e8e72c048cc0653203817cc9ff96cc6e394d
208dfab1fdcf1f4e57f80d6fd873265f0ff90c42c36cb25e38dff42695e383a4
21b195ce0d8efa07e31b863199d8a6802cb773e2417443e534ed8c113d8949a8
274c5c962cd8ec53ac23d6d07978901972efd7b33e2eb0d1a7222c61fb7f907d
28bcb4f0306800cf4c3706d53203e0d016f6493cbb70043b819bf5f4a48d4e0c
2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15
2f1298490f294128f086689a5654a8340ea9ec7c20c8e97f811590d5313edc9e
2f1eba35c5c38e67956012861717efdbc6d13c8de0d624213f66de83b8262ff3
3550e9fe8b646f7cec573b93d199eeeac7f3f577c1f82e2ba18e74d546d98fdc
3d77a9a71769ddc2a85524914671fb1d031132a8e37366440a4b6b01d7ad0025
3e4a85296d37106cff5d646be0fabf370fd83a9b133c3aaf41e6ffb73d108366
437542a358225b118f29d8d09db80177878af0ae9581353e3e701ec7416c67b8
46cad46571cab06c5901e4e867aba4f0783dc88d3db626cfb73d58f00d130a16
4986aea94d23482c38fb06749a6a5c5c6ab95db97aa3bcc9feaf7eda6cbf6626
4b4b65dc5e87ed8215fb3d74834cd100069e7eb8aaf903a4665e26079fb0777d
55851ffd45a0a3e9abd9c2ac844eba1efd50272a39360d0f3b396d26a7d0bfc8
5593d7d222d4086d4427b7c81fb081bf45884d8e1499e1ac1adafb017dc102f9
5690a1bcc83d00312ef6260da791205a71d80bed7b35ca9701c7b29cfd62b3fe
5ae75bcb392ec9110db2837a9134c1b414c373244ea62816c63cc5bb41a90cfe
5f3d36be68e6a795cf0d621b7d8b4beb4b9f9caea3f3682f2f8f59a846000893
61152d4b8363a8db7d72ece0ebb989ca0788d860b0c3cce645d16b63fa37e525
62b425148295a81e4162a87cb36eba754d16b295ec5b733140e2b82c7f77a731
65cc8600f521d4e99aa77e95337426f53ec86dd569e8db164bcda70d5c1da388
810956c722149065eabd5b5c4f62f98cb74cda6fb5e3695ab97958e53d6791ca
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8c9b185e1e937971dfedaafecf01bc14813a2ece31cc9af4a2097f9b3ecb061d
8df0ba2d8af3e602eaba8677fe2c57228955b28868c91c2850a4c3c1ad8c7f68
8f9048e36baefc5cac0974c3e49ffc683d667c5b2081f6cd8d20f5a301b124c2
8ffad58a307aa1ac6baff90296c8edc9db313f888876bc2ad453be4db8d01bf9
913e0bff2ebdfd8aa46e82e8282910638f68fdb9f56f447f1f6b259f3fe5e539
92997675d99730ec8f0dc897926ddca4e87b1a87e94b865e12e360b87753cd39
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a060b3f77ac5873b42822513a8d9c2439423dd9be07cf85d3e45f3dd8028d378
a787f22c2e2297b2acb943e47272ea96677842ee094cf0d80bfc70c55bbd1287
aa76185f417cf85d7029b35e3a6544d4495402e17f76a32633b5ba80a81faa26
ab74e69c44356590de92b4b7354dc5ae3887e20f3dd9d07cea55cedbdd441f95
ad853a72ac4fa4a7ea4700fb824906dbba6fd62e4f61e92449a5cba3f60ff1dc
afedf855d6d8ece53e013419b411dd4870baa7594fe221ab1e493d78be8eb957
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
bc575d419b988dc23317ce463b92b9bc58c28850a236ed8526828585526036aa
c10d8a6a975b58afbc198cf709c0d14fbb4bf06734576477a56904153af90c3c
c5d22156666a1a8d7c0b660324a007ae7c2a0a3a355a893b180f65d989bdee11
c7736f6538aca3fcafdd33667cdcbb4baaf13cb9217f11c95fd00f01d788c6f4
c8c3472f82c523707024b21c9c02755fb4fc9540558895e5ec10ceb1a7ac7977
d10a778caafc69e25249f7b7fa00a1bfaa240991b6c7cdedb7f562fff418eb21
d54294a6014df645a307b1ddcc2647e902b58333bc92a30d65ea1786d77457d2
d55e4cb97826944c4f826821ac2688b361d7cf0303b4640c2cb3eef6ee19b233
d5888d7675ebd29a725b082942b3e9393bf7528c119ddb249af00c870c670493
d700d6487ef4b0198e9a669c9ec89dd2d633302b7c82808b08f37ff9d38e98b8
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
e0a70c5d116d9c823c7d7958ecea2a7926315fac156e390bd7dc8a5fa088cdc3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e5340a761f7b704f687fd052d57a5e6b1a136f902e91705f30cce0e2eb043808
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb9d49a04efcc971667386f67fb420e20fd130339f1c994fc7359bc34771ef9
f1762ce2250a6a35a6fd892b054eec13df91cf939dca3e40ade35ae57d90b215
f8dd5483dc29044f06c3a45f8fd05d0f122a2b4315292df6da919775189351c9
ff6616b4a28c3407b10c28873184aabcca21c4b741b8bc190e21cccacf24d9c6