thehackernews.com Open in urlscan Pro
172.67.70.21 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
Submission: On October 15 via api (October 15th 2021, 2:59:22 pm UTC) from US — Scanned from DE

Summary HTTP 92 Redirects Links 34 Behaviour Indicators

Summary

This website contacted 22 IPs in 4 countries across 16 domains to perform 92 HTTP transactions. The main IP is 172.67.70.21, located in United States and belongs to CLOUDFLARENET, US. The main domain is thehackernews.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 1st 2021. Valid for: a year.

This is the only time thehackernews.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
13	172.67.70.21 172.67.70.21	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2.18.232.109 2.18.232.109	16625 (AKAMAI-AS) (AKAMAI-AS)
8	204.154.111.145 204.154.111.145	36062 (DOUBLE-VE...) (DOUBLE-VERIFY)
3	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
2	142.250.185.198 142.250.185.198	15169 (GOOGLE) (GOOGLE)
9	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
4	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
2	13.32.121.100 13.32.121.100	16509 (AMAZON-02) (AMAZON-02)
3	142.250.186.33 142.250.186.33	15169 (GOOGLE) (GOOGLE)
2	172.217.16.134 172.217.16.134	15169 (GOOGLE) (GOOGLE)
1 3	18.200.165.55 18.200.165.55	16509 (AMAZON-02) (AMAZON-02)
2	18.192.155.173 18.192.155.173	16509 (AMAZON-02) (AMAZON-02)
6	213.254.244.16 213.254.244.16	3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
1	104.16.18.94 104.16.18.94	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	142.250.186.142 142.250.186.142	15169 (GOOGLE) (GOOGLE)
1	74.125.206.156 74.125.206.156	15169 (GOOGLE) (GOOGLE)
1	142.250.186.36 142.250.186.36	15169 (GOOGLE) (GOOGLE)
1	142.250.186.131 142.250.186.131	15169 (GOOGLE) (GOOGLE)
1	142.250.185.138 142.250.185.138	15169 (GOOGLE) (GOOGLE)
4	142.250.184.195 142.250.184.195	15169 (GOOGLE) (GOOGLE)
10	52.222.214.37 52.222.214.37	16509 (AMAZON-02) (AMAZON-02)
92	22

13 172.67.70.21 (United States)

ASN13335 (CLOUDFLARENET, US)

thehackernews.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2.18.232.109 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-109.deploy.static.akamaitechnologies.com

cdn.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn3.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 204.154.111.145 (United States)

ASN36062 (DOUBLE-VERIFY, US)
PTR: nycp-hlb32.doubleverify.com

rtb0.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tps620.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tps615.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.16.130 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f130.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.121.100 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-100.fra60.r.cloudfront.net

choices.truste.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.33 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.134 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f134.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.200.165.55 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-200-165-55.eu-west-1.compute.amazonaws.com

att.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.192.155.173 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-192-155-173.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 213.254.244.16 (United States)

ASN3257 (GTT-BACKBONE GTT, US)

tps.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tps20247.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tps20236.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.18.94 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.186.142 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.206.156 (United States)

ASN15169 (GOOGLE, US)
PTR: wk-in-f156.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.36 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.131 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.138 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.184.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 52.222.214.37 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-37.fra56.r.cloudfront.net

choices.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	doubleverify.com cdn.doubleverify.com cdn3.doubleverify.com rtb0.doubleverify.com tps620.doubleverify.com tps.doubleverify.com tps615.doubleverify.com tps20247.doubleverify.com tps20236.doubleverify.com	230 KB
13	thehackernews.com thehackernews.com	236 KB
11	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	210 KB
10	trustarc.com choices.trustarc.com	32 KB
8	doubleclick.net ad.doubleclick.net googleads4.g.doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net	49 KB
5	google.com fundingchoicesmessages.google.com www.google.com	78 KB
4	gstatic.com fonts.gstatic.com	243 KB
3	demdex.net 1 redirects att.demdex.net	3 KB
3	googletagservices.com www.googletagservices.com	57 KB
2	google-analytics.com www.google-analytics.com	20 KB
2	agkn.com d.agkn.com	1 KB
2	2mdn.net s0.2mdn.net	192 KB
2	truste.com choices.truste.com	18 KB
1	googleapis.com fonts.googleapis.com	4 KB
1	google.de www.google.de	522 B
1	cloudflare.com cdnjs.cloudflare.com	28 KB
92	16

	Domain	Requested by
13	thehackernews.com	thehackernews.com
10	choices.trustarc.com	choices.truste.com choices.trustarc.com
9	cdn.doubleverify.com	thehackernews.com cdn.doubleverify.com ad.doubleclick.net
8	pagead2.googlesyndication.com	ad.doubleclick.net tpc.googlesyndication.com thehackernews.com pagead2.googlesyndication.com www.googletagservices.com
4	fonts.gstatic.com	fonts.googleapis.com
4	fundingchoicesmessages.google.com	pagead2.googlesyndication.com
4	googleads4.g.doubleclick.net	ad.doubleclick.net
3	tps615.doubleverify.com	cdn.doubleverify.com
3	att.demdex.net	1 redirects thehackernews.com
3	tpc.googlesyndication.com	ad.doubleclick.net tpc.googlesyndication.com
3	www.googletagservices.com	cdn.doubleverify.com www.googletagservices.com ad.doubleclick.net
3	tps620.doubleverify.com	cdn.doubleverify.com
2	tps20236.doubleverify.com	cdn.doubleverify.com
2	tps20247.doubleverify.com	cdn.doubleverify.com
2	www.google-analytics.com	thehackernews.com www.google-analytics.com
2	tps.doubleverify.com	cdn.doubleverify.com
2	d.agkn.com	thehackernews.com
2	s0.2mdn.net	thehackernews.com
2	choices.truste.com	ad.doubleclick.net
2	ad.doubleclick.net	www.googletagservices.com
2	rtb0.doubleverify.com	cdn.doubleverify.com
2	cdn3.doubleverify.com	cdn.doubleverify.com
1	fonts.googleapis.com
1	www.google.de
1	www.google.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	googleads.g.doubleclick.net	pagead2.googlesyndication.com
1	cdnjs.cloudflare.com	thehackernews.com
92	28

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
feeds.feedburner.com
deals.thehackernews.com
thehackernews.tradepub.com
www.instagram.com
t.me
go.thn.li
securityintelligence.com
hubs.la
www.reddit.com
news.ycombinator.com
api.whatsapp.com
telegram.me
adclick.g.doubleclick.net

Subject Issuer	Validity	Valid
thehackernews.com Cloudflare Inc ECC CA-3	`2021-06-01` - `2022-05-31`	a year	crt.sh
*.doubleverify.com DigiCert SHA2 Secure Server CA	`2021-01-10` - `2022-01-17`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.truste.com Amazon	`2021-02-16` - `2022-03-17`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
*.agkn.com RapidSSL RSA CA 2018	`2020-07-25` - `2022-09-18`	2 years	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
www.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
www.google.de GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.trustarc.com Go Daddy Secure Certificate Authority - G2	`2020-05-21` - `2022-07-17`	2 years	crt.sh

This page contains 12 frames:

Primary Page: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
Frame ID: 9760129B877A7771E7DCF4127269F627
Requests: 76 HTTP requests in this frame

Frame: https://cdn3.doubleverify.com/bst2tv3.html
Frame ID: E58F7E6FB8CBB8EA3FC408FF1BCFDB66
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-match6.js
Frame ID: 81D76FD87FE891CA069CDA38382482F5
Requests: 1 HTTP requests in this frame

Frame: https://cdn3.doubleverify.com/bst2tv3.html
Frame ID: 906DF706B5286B3A66D9E3DFAC0694F1
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-match6.js
Frame ID: 3797FBBF3007C1D79CE30FBF9B6776BA
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements1800.js
Frame ID: B39B5A9417F6FA0EA873C45271A476FB
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 9E433396B42635559F24EE2ED62FFACF
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: BBC8E7A90ADD8737E5340D4FEBD4F56E
Requests: 3 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements1800.js
Frame ID: 651B4FAF07EF2BC003C7C90431225E08
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211013/r20190131/zrt_lookup.html
Frame ID: 0D499EB6930C78F90D40DC2454624A69
Requests: 1 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 523DFAE641396F69CC16F4E6789119DC
Requests: 2 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 358F692AC07E00A75CED44EC642D45E9
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Attackers Behind Trickbot Expanding Malware Distribution Channels

Detected technologies

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

92
Requests

100 %
HTTPS

0 %
IPv6

16
Domains

28
Subdomains

22
IPs

4
Countries

1408 kB
Transfer

3394 kB
Size

9
Cookies

34 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/thehackernews
Title: 

Search URL Search Domain Scan URL

URL: https://twitter.com/thehackersnews
Title: 

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/thehackernews/
Title: 

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/thehackernews?sub_confirmation=1
Title: 

Search URL Search Domain Scan URL

URL: https://feeds.feedburner.com/TheHackersNews
Title: 

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/
Title:  Offers

Search URL Search Domain Scan URL

URL: https://thehackernews.tradepub.com/
Title: Free eBooks

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/free
Title: Freebies

Search URL Search Domain Scan URL

URL: https://www.instagram.com/thehackernews/
Title: 

Search URL Search Domain Scan URL

URL: https://t.me/joinchat/AAAAADwuDObFWF60CiR-HQ
Title:  Telegram Channel

Search URL Search Domain Scan URL

URL: https://go.thn.li/crowdsec-728

Search URL Search Domain Scan URL

URL: https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/
Title: said

Search URL Search Domain Scan URL

URL: https://go.thn.li/rewind-1

Search URL Search Domain Scan URL

URL: https://hubs.la/H0Z4Hwl0

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html
Title: 

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html&text=Attackers%20Behind%20Trickbot%20Expanding%20Malware%20Distribution%20Channels&via=TheHackersNews
Title: 

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html
Title: 

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html
Title: Share on Reddit

Search URL Search Domain Scan URL

URL: https://news.ycombinator.com/submitlink?u=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html&t=Attackers%20Behind%20Trickbot%20Expanding%20Malware%20Distribution%20Channels
Title: Share on Hacker News

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Attackers%20Behind%20Trickbot%20Expanding%20Malware%20Distribution%20Channels%20%E2%80%94%20https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html
Title: Share on WhatsApp

Search URL Search Domain Scan URL

URL: https://telegram.me/share/url?url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html&text=Attackers%20Behind%20Trickbot%20Expanding%20Malware%20Distribution%20Channels
Title: Share on Telegram

Search URL Search Domain Scan URL

URL: https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjstydG47hFH6qrTsztWiRucfEz6Myj1KY92DF3hKMGwAslTyIw3fxPwJp68WzZw7yKm5lwNDMV60W8FY-7esaOOUVDlaivsgN2dFimNjjio4WzK7jADJHNUjsohfRBTRHBpJLhw4&sig=Cg0ArKJSzNYwg34cj2Bc&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=https://d.agkn.com/pixel/2389/%3Fche%3D2828877779%26col%3D24935727,5936378,292581945,486197547,144332637%26l0%3Dhttp://att.demdex.net/event%3Fd_event%3Dclick%26d_src%3D127123%26d_adsrc%3D6141273%26d_campaign%3D24935727%26d_placement%3D292581945%26d_site%3D5936378%26d_creative%3D144332637%26d_adgroup%3D486197547%26d_rd%3Dhttps://cybersecurity.att.com/resource-center/white-papers/cybersecurity-insights-report-tenth-edition%253Futm_medium%253DAdvertising%2526utm_source%253Dthn%2526utm_campaign%253DSOC-eBook%2526source%253DEBBrHNAVT00AvtDyO%2526type%253Ddisplay%2526LNS%253DTP_OT_MLT_DSP_0720%2526gcm_uid%253D0%2526dclid%253D%2525edclid!

Search URL Search Domain Scan URL

URL: https://go.thn.li/sec-code-1

Search URL Search Domain Scan URL

URL: https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjstS5e5vwsfZSNTBLv1lVT_NGpnP-CbjX9vhIlJ_m_IqzDdvsqc_LMCpjmfJnCMP5_zvvGnsr0aZepcliCHK7XD2GgkNcke4h_N1pIAQ576M62Uvoo05vUH5Nd18oAYrljVFU4In6kWFl0MQ4nlwZNl6n7PY4tLTK7HaUfT18sGnfIpMyDgSysQOpKpobFyzhWY2VW44hQfkVxWsT50&sig=Cg0ArKJSzEQobTkbbXYb&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=https://d.agkn.com/pixel/2389/%3Fche%3D2432224411%26col%3D24935727,5936378,292704445,485910716,143061732%26l0%3Dhttp://att.demdex.net/event%3Fd_event%3Dclick%26d_src%3D127123%26d_adsrc%3D6141273%26d_campaign%3D24935727%26d_placement%3D292704445%26d_site%3D5936378%26d_creative%3D143061732%26d_adgroup%3D485910716%26d_rd%3Dhttps://cybersecurity.att.com/resource-center/ebook/how-to-build-a-security-operations-center%253Futm_medium%253DAdvertising%2526utm_source%253Dthn%2526utm_campaign%253DSOC-eBook%2526source%253DEBBrHNAVT00AvtDyO%2526type%253Ddisplay%2526LNS%253DTP_OT_MLT_DSP_0720%2526gcm_uid%253D0%2526dclid%253D%2525edclid!

Search URL Search Domain Scan URL

URL: https://go.thn.li/native-1
Title: Reduce Recurring VulnerabilitiesWatch the video to find out how Alice the AppSec Manager turned her consistent bad days around with help from Secure Code Warrior.

Search URL Search Domain Scan URL

URL: https://go.thn.li/scw-native-1
Title: Compete. Win prizes. Become the ultimate Warrior.Join the Devlympics 2021 and compete internationally to be crowned the Ultimate Secure Code Warrior and win big.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/the-2019-ethical-hacker-masterclass-bundle
Title: <img alt='Learn Ethical Hacking Online' class='deal-link' src='https://thehackernews.com/images/-6bFLF28Wvxc/XHaUg588fBI/AAAAAAAAAGU/USPKfrcXaLgzaOBfKGb92v-0T12CIaK9wCLcBGAs/s260-e100/learn-hacking-training.jpg'/> Ethical Hacking - Practical Training 10 courses + 1,236 lessons on latest techniques, forensics, malware analysis, network security and programming.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/lifetime-access-to-stackskills-unlimited
Title: <img alt='Unlimited Secure VPN Service' class='deal-link' src='https://thehackernews.com/images/-NnUk1eJVmVk/XHggwOYT51I/AAAAAAAAzbg/_5sUNHfsdiYDo-si4rya7tVT4pSZI0qSACLcBGAs/s260-e100/unlimited-vpn.jpg'/> 1000+ Premium Online Courses With course certification, Q/A webinars and lifetime access.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/the-cybersecurity-expert-certification-training-bundle
Title: <img alt='Best Hacking Books' class='deal-link' src='https://thehackernews.com/images/-4fAuruXOrkE/XDW4dE5zVMI/AAAAAAAAy9A/K13EeHK67NM69FUaCYDYtunHofUHjtt4wCLcBGAs/s260-e100/hacking-cybersecurity-books.jpg'/> Cybersecurity Certification Training CISA, CISM, CISSP, PMI-RMP, and COBIT 5 certifications.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/sales/the-complete-2020-comptia-certification-training-bundle
Title: <img alt='Cisco Certification Courses' class='deal-link' src='https://thehackernews.com/images/-2nVCe__qYkc/WxVG9s8C7CI/AAAAAAAAw6Q/fFsdOSE-DEYDqqf3z9KWus0oBWdbzAkAgCLcBGAs/s260-e100/cisco-it-networking-certification.png'/> CompTIA IT Certification Training Lifetime access to 14 expert-led courses.

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/citizengoods-exclusives
Title: Exclusives

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/hacking
Title: Hacking

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/shop-by-specialization-developer
Title: Development

Search URL Search Domain Scan URL

URL: https://deals.thehackernews.com/collections/shop-by-interest-android
Title: Android

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=144332637&d_placement=292581945&d_campaign=24935727&d_site=5936378 HTTP 302
https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=144332637&d_placement=292581945&d_campaign=24935727&d_site=5936378

92 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request attackers-behind-trickbot-expanding.html Show response
thehackernews.com/2021/10/ 132 KB
57 KB 109ms
70ms Document
text/html 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / WordPress VIP

Resource Hash

569ca629876e6854d4b35d1ffa31c3353a33102d6ca110f56ab994aef145314b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: thehackernews.com
:scheme: https
:path: /2021/10/attackers-behind-trickbot-expanding.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Fri, 15 Oct 2021 14:59:11 GMT
content-type: text/html; charset=UTF-8
cf-ray: 69e9e8e9cedfee6d-CDG
age: 2
cache-control: public, s-maxage=604800, max-age=0
expires: Fri, 15 Oct 2021 14:59:09 GMT
last-modified: Fri, 15 Oct 2021 14:41:27 GMT
link: </css/roboto.css>; as=style; rel=preload
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
cf-cache-status: HIT
content-security-policy: upgrade-insecure-requests
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-forwarded-for: 216.131.111.174
x-frame-options: DENY
x-powered-by: WordPress VIP
x-xss-protection: 1; mode=block
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=02rOmcjxTNszEZ4PWfo6WCwbfi4eIW2eQjjgK7mhgYPhA4zSoaGoG4cVReKgCLO25ZxYfaIKFYAG2TdOJBtS%2Fx7uvagodoJErR1vaX6HLzygzRlGG3INvUyeX%2B2S2GpqAb9N"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-h2-pushed: </css/roboto.css>

GET
H2 200 roboto.css
thehackernews.com/css/ 77 KB
57 KB 14ms
0ms Stylesheet
text/css 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thehackernews.com/css/roboto.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d8ab8467b889847c12c542bee765afc54acbaff1cc91ce3197ab4f2be8f08ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:11 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jCPKNJhOw3tEVCncGb3Hbm%2BE4dLOuigFsvaonpQ35CqEZoW%2FkfNz8YTx3w6drGQruZfLh5MuxAqWzTobBu64cxmsgcXfMMoidpVcncS6eI2zWHfSuiAq9d9bFtYlXRGZT%2Foe"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=2592000, immutable, s-maxage=8640000
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-ray: 69e9e8ea1f22ee6d-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c6a9d65e5bd6eb2447ea57e398e1d30f3c6e2d022ecf195933d161ffed964690

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 404 AVvXsEi4KfWJYe3ZX8lbyZ4NnmxDXKAQg1dvf4KDGQgCthZ0Zgk8X3-MXq_fuCGwfGVDr8VamuDs-FaaV4wwsXVRCW_N2bnL0m73nUnN2F1kX6OXlMnZsvpnMvlz49IteYvjPL7LWxWzQ0VK_fkf1jm6WdwM0c1xF3zYip9oMjxqnU3eMrahA92GM1f4YV5-
thehackernews.com/new-images/img/a/ 64 KB
64 KB 64ms
63ms Image
text/html 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/a/AVvXsEi4KfWJYe3ZX8lbyZ4NnmxDXKAQg1dvf4KDGQgCthZ0Zgk8X3-MXq_fuCGwfGVDr8VamuDs-FaaV4wwsXVRCW_N2bnL0m73nUnN2F1kX6OXlMnZsvpnMvlz49IteYvjPL7LWxWzQ0VK_fkf1jm6WdwM0c1xF3zYip9oMjxqnU3eMrahA92GM1f4YV5-

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d74dfc70e9bcdd126d17ae6fb54f387a8f9200d3bdd7b17e1dd6ca4b2e13da6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /new-images/img/a/AVvXsEi4KfWJYe3ZX8lbyZ4NnmxDXKAQg1dvf4KDGQgCthZ0Zgk8X3-MXq_fuCGwfGVDr8VamuDs-FaaV4wwsXVRCW_N2bnL0m73nUnN2F1kX6OXlMnZsvpnMvlz49IteYvjPL7LWxWzQ0VK_fkf1jm6WdwM0c1xF3zYip9oMjxqnU3eMrahA92GM1f4YV5-
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thehackernews.com
referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:11 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1008
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c03sDw%2FSzDXRihsdBxK3YP81v6jKva9oUNBBrY7kllD%2FQnutbEyQA4MRDsvmXu0srH3zLTR9WPoF9zI1J2VYDAe0%2Fw02TQ41W4XbnPSz%2B%2BDnNaAf5Wvxk1l106jCisoXRN8c"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cache-control: no-cache, no-store, max-age=0, must-revalidate
cf-ray: 69e9e8ea5f8eee6d-CDG
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ 2 KB
2 KB 44ms
7ms Script
application/javascript 2.18.232.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292581945%26sid%3D5936378%26dvregion%3D2%26unit%3D300x250
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-109.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 42977b3f1bf3b11d34a40c50c095d65b3ba8631ef4ebb37b950ccd9c401d2181

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Last-Modified: Mon, 09 Aug 2021 12:31:26 GMT
Server: Microsoft-IIS/10.0
ETag: "60d09d781a8dd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1338

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ 2 KB
2 KB 43ms
7ms Script
application/javascript 2.18.232.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292704445%26sid%3D5936378%26dvregion%3D2%26unit%3D728x90
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-109.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 42977b3f1bf3b11d34a40c50c095d65b3ba8631ef4ebb37b950ccd9c401d2181

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Last-Modified: Mon, 09 Aug 2021 12:31:26 GMT
Server: Microsoft-IIS/10.0
ETag: "60d09d781a8dd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1338

GET
DATA 200
OK truncated
/ 16 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e01ddff81ef43d93f47545eb333edda3130c28ec9b62ed8a71100f1cbfd94887

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 103 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 688a1e2444a1171a4cfbc8674c62d53bc663bf35a7825eb3563851e79694411c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 rocket-loader.min.js Show response
thehackernews.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 27ms
27ms Script
application/javascript 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thehackernews.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

:path: /cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thehackernews.com
referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
last-modified: Wed, 13 Oct 2021 10:17:24 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"6166b234-302c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SJgyCAfZd6nge%2FmlwPzI1hskteGO2WZ3%2FAj73YdyEKuHLN8lROZ55fn5QbHUx0kWn6LAJLV23xt%2FM7GRATnlsCriPNJ5fwFFwcHlL8hyPkJ7Dc6Rr%2FOZPJ0k9poNLpgy%2FIeD"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800 public
cf-ray: 69e9e8ea6b9d40b1-CDG
expires: Sun, 17 Oct 2021 14:59:11 GMT

GET
DATA 200
OK truncated
/ 442 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6795c5c8b9b0aeb87d6663ccd7a71fb9d2f2817fe9b5c2e67bce0d5a5e1309a1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a71328300f380217ae0abf7f805052a10a0c196cb241eb97adf9b905e4a48c8a

Request headers

Referer
Origin: https://thehackernews.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: application/font-woff

GET
H/1.1 200
OK dvbs_src_internal99.js Show response
cdn.doubleverify.com/ 61 KB
19 KB 13ms
13ms Script
application/javascript 2.18.232.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292581945%26sid%3D5936378%26dvregion%3D2%26unit%3D300x250
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-109.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 158edd2a7562d2b16eadda8fb990eb8d20e53837dd1abdfd2c890fcc0980ede0

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Last-Modified: Mon, 09 Aug 2021 12:31:43 GMT
Server: Microsoft-IIS/10.0
ETag: "802192821a8dd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19248

GET
H/1.1 200
OK bst2tv3.html Show response
cdn3.doubleverify.com/ Frame E58F 1 KB
1 KB 40ms
7ms Document
text/html 2.18.232.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn3.doubleverify.com/bst2tv3.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-109.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 86be5d6a3d661fd3d5d72f254a347dec5c66cad569117f51dad297acba02f558

Request headers

Host: cdn3.doubleverify.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://thehackernews.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/

Response headers

Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Tue, 02 Sep 2014 17:01:36 GMT
Accept-Ranges: bytes
ETag: "01818ecfc6cf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
Content-Length: 806
Cache-Control: max-age=67928
Date: Fri, 15 Oct 2021 14:59:11 GMT
Connection: keep-alive

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ 1 KB
915 B 415ms
101ms Script
text/javascript 204.154.111.145
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_762762527538&jsTagObjCallback=__tagObject_callback_762762527538&num=6&ctx=&cmp=&plc=&sid=&advid=&adsrv=&unit=&isdvvid=&uid=762762527538&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&brid=3&brver=93&bridua=3&dup=null&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=0&htmlmsging=1&m1=13&noc=4&fcifrms=1&brh=2&fwc=0&flt=1&fec=382&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau2EE24%3C6CD%5C369%3A%3F5%5CEC%3A4%3C3%40E%5C6IA2%3F5%3A%3F8%5D9E%3E%3D&dvp_exetime=11.70&callbackName=__verify_callback_762762527538
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.111.145 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-hlb32.doubleverify.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 7ef464bb2ed71125549a5e667ffd1515fdaf18aa3753eb5ff6227e8780001ef4

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Pragma: no-cache
X-DV-Response: 0
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Date: Fri, 15 Oct 2021 14:59:10 GMT
Expires: 10/14/2021 2:59:11 PM

GET
H/1.1 200
OK dv-match6.js Show response
cdn.doubleverify.com/ Frame 81D7 4 KB
2 KB 7ms
7ms Script
application/javascript 2.18.232.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-match6.js
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-109.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d03755898b05a3d69377bf7da16ccb307e789a0f569b4dbbcb7b29bdecf967c5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Last-Modified: Sun, 11 Mar 2018 04:45:12 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "03c84bdf3b8d31:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=9267
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1935

POST
H/1.1 200
OK bsevent.gif
tps620.doubleverify.com/ 807 B
1 KB 305ms
97ms Ping
image/gif 204.154.111.145
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps620.doubleverify.com/bsevent.gif?impid=a471daed7dde4e50b54e6fe7a924537f&dvp_or2=1&cbust=1634309951583178
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.111.145 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-hlb32.doubleverify.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: https://thehackernews.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 860
Expires: 10/14/2021 2:59:11 PM

POST
H/1.1 200
OK bsevent.gif
tps620.doubleverify.com/ 807 B
1 KB 310ms
98ms Ping
image/gif 204.154.111.145
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps620.doubleverify.com/bsevent.gif?impid=a471daed7dde4e50b54e6fe7a924537f&vfdur=416&cbust=1634309951585338
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.111.145 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-hlb32.doubleverify.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: https://thehackernews.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 860
Expires: 10/14/2021 2:59:11 PM

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ 9 KB
5 KB 76ms
24ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

b2db7373b4a646a326952fa386be6fde1ce4c93f101258d840c91e42af13d47d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Fri, 15 Oct 2021 14:42:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1021
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4403
x-xss-protection: 0
last-modified: Fri, 01 Oct 2021 16:41:12 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Fri, 15 Oct 2021 15:42:10 GMT

GET
H3 200 impl_v80.js Show response
www.googletagservices.com/dcm/ 37 KB
15 KB 60ms
25ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v80.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

7a3e1fa68b2ed9b3c641299d3129d7439377b2f2f21a4f13d17435967ecb00a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Fri, 15 Oct 2021 10:40:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15500
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15821
x-xss-protection: 0
last-modified: Tue, 28 Sep 2021 14:32:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 15 Oct 2022 10:40:51 GMT

GET
H2 200 B24935727.292581945;dc_ver=80.232;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=473486474;ord=d1riu7;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%2... Show response
ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/ 44 KB
22 KB 109ms
58ms Script
text/javascript 142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292581945;dc_ver=80.232;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=473486474;ord=d1riu7;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html$0;xdt=0;crlt=uIyEWF3br-;sttr=74;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v80.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

29f191aeff57288020d5ffe78aebb0d5311be2a93a968f5e58d5a483ce0eddc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21851
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ 123 KB
37 KB 57ms
57ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292581945;dc_ver=80.232;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=473486474;ord=d1riu7;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html$0;xdt=0;crlt=uIyEWF3br-;sttr=74;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

41d9de265e720a301cbd9c525fa7089a677e0b099b422579a401516212b5add3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37919
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634125446224599"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 15 Oct 2021 14:59:11 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/elements/html/ 8 KB
4 KB 75ms
21ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:58:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 29 Oct 2021 14:58:33 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ 0
545 B 91ms
48ms Ping
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstydG47hFH6qrTsztWiRucfEz6Myj1KY92DF3hKMGwAslTyIw3fxPwJp68WzZw7yKm5lwNDMV60W8FY-7esaOOUVDlaivsgN2dFimNjjio4WzK7jADJHNUjsohfRBTRHBpJLhw4&sig=Cg0ArKJSzGgel9vJ4El_EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20211013.91773&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Fri, 15 Oct 2021 14:59:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 ca Show response
choices.truste.com/ 28 KB
9 KB 38ms
8ms Script
text/javascript 13.32.121.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.truste.com/ca?pid=att01&aid=att_hs&cid=24935727_144332637_292581945&js=st0
Requested by: Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292581945;dc_ver=80.232;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=473486474;ord=d1riu7;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html$0;xdt=0;crlt=uIyEWF3br-;sttr=74;prcl=s
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-100.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 5d96c79bb952836fbd7238c7d4dbeb0d9cf590fe1def425df03e1aa749053774

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Oct 2021 15:29:25 GMT
content-encoding: gzip
server: nginx
age: 84586
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 d7433132a7c6595c9aab2dc2272e7061.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA60-P1
x-amz-cf-id: wGoeixpwr9owLaPCA48NSXUch1PKuScfiL_Ash0re4vWzrJnVBPOmg==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ 8 KB
4 KB 10ms
10ms Script
application/javascript 2.18.232.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=607671&cmp=24935727&sid=5936378&plc=292581945&advid=6141273&adsrv=1&btreg=486197547&btadsrv=doubleclick&crt=144332637&tagtype=display&dvtagver=6.1.src&auevent=__AP1_np_dv_xkij9a5o6haPA__
Requested by: Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292581945;dc_ver=80.232;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=473486474;ord=d1riu7;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html$0;xdt=0;crlt=uIyEWF3br-;sttr=74;prcl=s
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-109.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 5dd139490465c0d5b42eb905451078a5ee84b5c220d6af5b143af49247a8ecf5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Last-Modified: Thu, 07 Oct 2021 17:50:16 GMT
Server: Microsoft-IIS/10.0
ETag: "0bc2dc9a3bbd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3288

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ 41 KB
15 KB 71ms
21ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 09:47:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18701
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 15 Oct 2022 09:47:30 GMT

GET
H2 200 I_ABU_AVT_3_STB_MOB_300x250_S_N_EN_NA_ABS_AVT_TenthEdition_NA_NA_01-08_01_MF.jpg
s0.2mdn.net/6141273/ 131 KB
131 KB 80ms
16ms Image
image/jpeg 172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/6141273/I_ABU_AVT_3_STB_MOB_300x250_S_N_EN_NA_ABS_AVT_TenthEdition_NA_NA_01-08_01_MF.jpg

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f134.1e100.net

Software

sffe /

Resource Hash

c2842ab20cc17cb61e32799c8cff642f37a20a933b12f678628b4666c0311f78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 11:47:30 GMT
x-content-type-options: nosniff
age: 11501
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133793
x-xss-protection: 0
last-modified: Fri, 08 Jan 2021 23:43:35 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Oct 2021 11:47:30 GMT

GET
H/1.1

200
OK

firstevent
att.demdex.net/
Redirect Chain

https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=144332637&d_placement=292581945&d_campaign=24935727&d_site=5936378
https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=144332637&d_placement=292581945&d_campaign=24935727&d_site=5936378

42 B
945 B

38ms
38ms

Image
image/gif

18.200.165.55
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=144332637&d_placement=292581945&d_campaign=24935727&d_site=5936378

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.200.165.55 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-200-165-55.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v019-0a5c96436.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: PeX7PJ1uSWA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v019-0c18f40d5.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: C6WNWPeaRmA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=144332637&d_placement=292581945&d_campaign=24935727&d_site=5936378
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK /
d.agkn.com/pixel/2387/ 43 B
658 B 46ms
7ms Image
image/gif 18.192.155.173
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.agkn.com/pixel/2387/?ct=DE&st=&city=5672&dma=0&zp=&bw=3&che=2828877779&col=24935727,5936378,292581945,486197547,144332637
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.192.155.173 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-192-155-173.eu-central-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:11 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK bst2tv3.html Show response
cdn3.doubleverify.com/ Frame 906D 1 KB
1 KB 8ms
7ms Document
text/html 2.18.232.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn3.doubleverify.com/bst2tv3.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-109.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 86be5d6a3d661fd3d5d72f254a347dec5c66cad569117f51dad297acba02f558

Request headers

Host: cdn3.doubleverify.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://thehackernews.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/

Response headers

Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Tue, 02 Sep 2014 17:01:36 GMT
Accept-Ranges: bytes
ETag: "01818ecfc6cf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
Content-Length: 806
Cache-Control: max-age=67928
Date: Fri, 15 Oct 2021 14:59:11 GMT
Connection: keep-alive

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ 1 KB
916 B 124ms
123ms Script
text/javascript 204.154.111.145
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_591518162449&jsTagObjCallback=__tagObject_callback_591518162449&num=6&ctx=&cmp=&plc=&sid=&advid=&adsrv=&unit=&isdvvid=&uid=591518162449&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&brid=3&brver=93&bridua=3&dup=null&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=0&htmlmsging=1&m1=13&noc=4&fcifrms=3&brh=2&fwc=0&flt=1&fec=465&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau2EE24%3C6CD%5C369%3A%3F5%5CEC%3A4%3C3%40E%5C6IA2%3F5%3A%3F8%5D9E%3E%3D&dvp_exetime=11.70&callbackName=__verify_callback_591518162449
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.111.145 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-hlb32.doubleverify.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: ecb5d2271e02f61aad061b3f72035075adc40cdeed19f9ab678e97eab0a2720a

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Pragma: no-cache
X-DV-Response: 0
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Date: Fri, 15 Oct 2021 14:59:11 GMT
Expires: 10/14/2021 2:59:11 PM

GET
H/1.1 200
OK dv-match6.js Show response
cdn.doubleverify.com/ Frame 3797 4 KB
2 KB 24ms
24ms Script
application/javascript 2.18.232.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-match6.js
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-109.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d03755898b05a3d69377bf7da16ccb307e789a0f569b4dbbcb7b29bdecf967c5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Last-Modified: Sun, 11 Mar 2018 04:45:12 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "03c84bdf3b8d31:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=9267
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1935

GET
H/1.1 200
OK dv-measurements1800.js Show response
cdn.doubleverify.com/ Frame B39B 495 KB
90 KB 9ms
9ms Script
application/javascript 2.18.232.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements1800.js
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-109.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 3c2c5e8ce71da5f920b37260c35faad806880a17d60b6b93e35e1200763a6733

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Last-Modified: Wed, 06 Oct 2021 09:46:20 GMT
Server: Microsoft-IIS/10.0
ETag: "0fef5397bad71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 91601

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame B39B 4 KB
2 KB 76ms
14ms Script
text/javascript 213.254.244.16
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&ttmms=69&ttfrms=19&brid=3&brver=93.0.4577.63&bridua=3&bds=1&tstype=1&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau2EE24%3C6CD%5C369%3A%3F5%5CEC%3A4%3C3%40E%5C6IA2%3F5%3A%3F8%5D9E%3E%3D&srcurlD=0&aUrlD=0&ssl=https:&dfs=924&ddur=11&uid=1634309951999614&jsCallback=dvCallback_1634309951999898&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F93.0.4577.63%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=1800&tgjsver=1800&lvvn=28&m1=13&refD=0&referrer=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html&fwc=0&flt=1&fec=468&fcifrms=5&brh=2&sdf=2&dvp_epl=139&noc=4&ctx=607671&cmp=24935727&sid=5936378&plc=292581945&crt=144332637&btreg=486197547&btadsrv=doubleclick&adsrv=1&advid=6141273&tagtype=display&errorURL=https://tps.doubleverify.com/visit.jpg&auevent=__AP1_np_dv_xkij9a5o6haPA__&mib=0&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=6390812687.875724&dvp_tukv=758358980934.8315&dvp_uuid=79652858952.57112&dvp_tuid=1316236574217
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1800.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.16 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: 3ff61841d03d50bf345aa409884f99ed32dd546dbee0e6f2e027bbad47d6acf8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 10/14/2021 2:59:12 PM

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9E43 22 KB
8 KB 60ms
25ms Document
text/html 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thehackernews.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 15 Oct 2021 09:47:30 GMT
expires: Sat, 15 Oct 2022 09:47:30 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 18702
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK bsevent.gif
tps615.doubleverify.com/ 807 B
1 KB 293ms
95ms Ping
image/gif 204.154.111.145
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps615.doubleverify.com/bsevent.gif?impid=acb8f4d665784838a69ed5ddef716aff&dvp_or2=1&cbust=1634309952031336
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.111.145 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-hlb32.doubleverify.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: https://thehackernews.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 860
Expires: 10/14/2021 2:59:11 PM

POST
H/1.1 200
OK bsevent.gif
tps615.doubleverify.com/ 807 B
1 KB 294ms
95ms Ping
image/gif 204.154.111.145
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps615.doubleverify.com/bsevent.gif?impid=acb8f4d665784838a69ed5ddef716aff&vfdur=416&cbust=1634309952032619
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.111.145 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-hlb32.doubleverify.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: https://thehackernews.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 860
Expires: 10/14/2021 2:59:11 PM

GET
H3 200 B24935727.292704445;dc_ver=80.232;dc_eid=40004000;sz=728x90;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=2493880096;ord=bgpjjt;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnul... Show response
ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/ 44 KB
21 KB 92ms
58ms Script
text/javascript 142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292704445;dc_ver=80.232;dc_eid=40004000;sz=728x90;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=2493880096;ord=bgpjjt;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html$0;xdt=0;crlt=uIyEWF3br-;sttr=3;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v80.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

306db32cc48f2b579f015b6996f9ec64be00187b08c0c1bd261cd4be5edb2064

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21968
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ 0
23 B 78ms
56ms Ping
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 CtfsWAsRe2m3N424Qc1nuWYtSGM1BvOIuby86xg17sc.js Show response
pagead2.googlesyndication.com/bg/ Frame 9E43 35 KB
13 KB 56ms
26ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CtfsWAsRe2m3N424Qc1nuWYtSGM1BvOIuby86xg17sc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

sffe /

Resource Hash

0ad7ec580b117b69b7378db841cd67b9662d48633506f388b9bcbceb1835eec7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 11:58:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10821
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13341
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sat, 15 Oct 2022 11:58:51 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ 0
23 B 54ms
54ms Ping
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstOk1D_S_LpP1Smz0rrpp9M0J4SbzpvWNHDO4YMLQZ8lfM0IJV8POd9FUruHOuTsyNXhAgtmSVC1igwxqVxRkjkvvCfxiuAqSzt2O2SrflGd56J2DculuHhwChpAkwaGHKXXfdvi1J5zyswhO-GpEWi9zppG7305qBS6eF4gO3Od0wNaC55&sig=Cg0ArKJSzO7jgwXnvn9TEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20211013.79384&adurl=

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292704445;dc_ver=80.232;dc_eid=40004000;sz=728x90;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=2493880096;ord=bgpjjt;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html$0;xdt=0;crlt=uIyEWF3br-;sttr=3;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 ca Show response
choices.truste.com/ 28 KB
9 KB 106ms
105ms Script
text/javascript 13.32.121.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.truste.com/ca?pid=att01&aid=att_hs&cid=24935727_143061732_292704445&js=st0
Requested by: Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292704445;dc_ver=80.232;dc_eid=40004000;sz=728x90;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=2493880096;ord=bgpjjt;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html$0;xdt=0;crlt=uIyEWF3br-;sttr=3;prcl=s
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-100.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: e42766569e9bc18ecc8ff5f29cac4fe86b34cd6b1ed58008fcaf2b73ff4c73a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:12 GMT
content-encoding: gzip
server: nginx
x-amz-cf-pop: FRA60-P1
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 d7433132a7c6595c9aab2dc2272e7061.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-id: F7YjRUwEsQXDz6Hn33QUbEX9I2LbdUvhAlqNPP89QIA8fftfCXahqA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ 8 KB
4 KB 8ms
8ms Script
application/javascript 2.18.232.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=607671&cmp=24935727&sid=5936378&plc=292704445&advid=6141273&adsrv=1&btreg=485910716&btadsrv=doubleclick&crt=143061732&tagtype=display&dvtagver=6.1.src&auevent=__AP1_np_dv_xkij9a5o6haPA__
Requested by: Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292704445;dc_ver=80.232;dc_eid=40004000;sz=728x90;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=2493880096;ord=bgpjjt;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html$0;xdt=0;crlt=uIyEWF3br-;sttr=3;prcl=s
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-109.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 5dd139490465c0d5b42eb905451078a5ee84b5c220d6af5b143af49247a8ecf5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 15 Oct 2021 14:59:12 GMT
Content-Encoding: gzip
Last-Modified: Thu, 07 Oct 2021 17:50:16 GMT
Server: Microsoft-IIS/10.0
ETag: "0bc2dc9a3bbd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3288

GET
H3 200 I_ABU_AVT_3_STB_DTP_728x90_S_N_EN_NA_ABS_AVT_ForresterWave_NA_NA_01-01_01_MF.jpg
s0.2mdn.net/6141273/ 61 KB
61 KB 43ms
19ms Image
image/jpeg 172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/6141273/I_ABU_AVT_3_STB_DTP_728x90_S_N_EN_NA_ABS_AVT_ForresterWave_NA_NA_01-01_01_MF.jpg

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f134.1e100.net

Software

sffe /

Resource Hash

c5d699fefdbb1353ad990ad49626c5f022090b3c956cea7d9c823c68905b948b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 12:35:18 GMT
x-content-type-options: nosniff
age: 8634
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62003
x-xss-protection: 0
last-modified: Mon, 14 Dec 2020 21:55:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Oct 2021 12:35:18 GMT

GET
H/1.1 200
OK /
d.agkn.com/pixel/2387/ 43 B
658 B 8ms
8ms Image
image/gif 18.192.155.173
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.agkn.com/pixel/2387/?ct=DE&st=&city=5672&dma=0&zp=&bw=3&che=2432224411&col=24935727,5936378,292704445,485910716,143061732
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.192.155.173 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-192-155-173.eu-central-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:11 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK event
att.demdex.net/ 42 B
945 B 41ms
41ms Image
image/gif 18.200.165.55
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=143061732&d_placement=292704445&d_campaign=24935727&d_site=5936378

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.200.165.55 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-200-165-55.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v019-0493d6859.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: k2iNPP/mSBI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame BBC8 22 KB
8 KB 25ms
25ms Document
text/html 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thehackernews.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 15 Oct 2021 09:47:30 GMT
expires: Sat, 15 Oct 2022 09:47:30 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 18702
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ 194 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f88754ecdaeedbf69845f3cb4015909beff31f92b173185c075ff8ab40ae3d02

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 rewind-3-728.png
thehackernews.com/images/-_qK1yHVo__w/YVHUUsSpIGI/AAAAAAAA4aY/cbPcuH6NoWs085FCBPnEubY4Xg4ehW0nwCLcBGAsYHQ/s728-e100/ 4 KB
5 KB 46ms
45ms Image
image/webp 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-_qK1yHVo__w/YVHUUsSpIGI/AAAAAAAA4aY/cbPcuH6NoWs085FCBPnEubY4Xg4ehW0nwCLcBGAsYHQ/s728-e100/rewind-3-728.png

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b9cf28fcde7a50b452741975b147e372a045579fa98fc2e8703ba0aa8c6d304

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:path: /images/-_qK1yHVo__w/YVHUUsSpIGI/AAAAAAAA4aY/cbPcuH6NoWs085FCBPnEubY4Xg4ehW0nwCLcBGAsYHQ/s728-e100/rewind-3-728.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thehackernews.com
referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 203525
cf-polished: origFmt=png, origSize=5816
content-disposition: inline; filename="rewind-3-728.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4560
x-xss-protection: 0
expires: Fri, 21 Jan 2022 06:27:07 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "ve1a8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jpF3WDLWED9Ob6%2BJWhgUU7l0k96hVu2tecZgJejxXHBWbnlDTLKxJU21THGKtvBan4ADTjcpHkapeFgy8roWAtCJLTmD61E3Ml%2Fv3IlgVZgekIdW4ZPTJV4UG%2Fl4aZohLw3w"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
vary: Accept, Accept-Encoding
cache-control: public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges: bytes
cf-ray: 69e9e8f12a2140b1-CDG
access-control-expose-headers: Content-Length

GET
H3 200 AVvXsEj9Bd2VdAXWvbASf8YmWxr5iArtahL17_NleXHz62PXrscVcuyhLoDB7s3THH7T3H2cNZseMCfhLHRI9u5ESRDFZknnkYq6qqLc5c9bPFMM7KFlt0MGfj_ufHze0jtqtN8jGQiQUtNiSL3Kgq8Vsdc1lkrooiJsHq3ucrJQr03nO_OVN3I2C0POzJAs=w72-...
thehackernews.com/new-images/img/a/ 2 KB
3 KB 41ms
40ms Image
image/jpeg 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/a/AVvXsEj9Bd2VdAXWvbASf8YmWxr5iArtahL17_NleXHz62PXrscVcuyhLoDB7s3THH7T3H2cNZseMCfhLHRI9u5ESRDFZknnkYq6qqLc5c9bPFMM7KFlt0MGfj_ufHze0jtqtN8jGQiQUtNiSL3Kgq8Vsdc1lkrooiJsHq3ucrJQr03nO_OVN3I2C0POzJAs=w72-h72-p-k-no-nu

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41fa0b4476b2b0d598a402544ddbd340e0adf974ca4578d5ef0611c464866532

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:path: /new-images/img/a/AVvXsEj9Bd2VdAXWvbASf8YmWxr5iArtahL17_NleXHz62PXrscVcuyhLoDB7s3THH7T3H2cNZseMCfhLHRI9u5ESRDFZknnkYq6qqLc5c9bPFMM7KFlt0MGfj_ufHze0jtqtN8jGQiQUtNiSL3Kgq8Vsdc1lkrooiJsHq3ucrJQr03nO_OVN3I2C0POzJAs=w72-h72-p-k-no-nu
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thehackernews.com
referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 203671
cf-polished: origSize=2231, status=webp_bigger
content-disposition: inline;filename="iphone-hack.jpg"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 2222
x-xss-protection: 0
expires: Thu, 14 Oct 2021 06:24:41 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v1025"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f%2FHy1xi4hcC02I8m8pTylidpCxkeab%2BpoxlNR4ryzwcJZ3k1naRDJs19Lo%2FVGHvoLiwk5y%2FuYQWs8iIdhKmBICaBKcTHdKsQ2R5ZRANn5SircUIn3EIf6JPtffLsz5%2BrEUAP"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
vary: Accept-Encoding
cache-control: public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges: bytes
cf-ray: 69e9e8f12a2440b1-CDG
access-control-expose-headers: Content-Length

GET
H3 200 AVvXsEjpS0YPSnhzLfSL9Jdi2DupcJJqAjphhWzoP9_fp_xtPC8-pChF6NHiFf2yseIsIK4RPOzJU2HVLhEjrorjtEGyIdtZu62aWNuJgjnxL8wUynqwh5mfitCBOoYcUhmX4R8QpL9YrbFCn0HxDj7Jy5niDIgNRhN0vbF3NGFMqSgUUlm85nkuubS8bZka=w72-...
thehackernews.com/new-images/img/a/ 3 KB
4 KB 46ms
46ms Image
image/webp 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/a/AVvXsEjpS0YPSnhzLfSL9Jdi2DupcJJqAjphhWzoP9_fp_xtPC8-pChF6NHiFf2yseIsIK4RPOzJU2HVLhEjrorjtEGyIdtZu62aWNuJgjnxL8wUynqwh5mfitCBOoYcUhmX4R8QpL9YrbFCn0HxDj7Jy5niDIgNRhN0vbF3NGFMqSgUUlm85nkuubS8bZka=w72-h72-p-k-no-nu

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df33ff37d048a34e2b43aedb6bcd56eb53306fdfd42d04715b7005f25d4a6546

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:path: /new-images/img/a/AVvXsEjpS0YPSnhzLfSL9Jdi2DupcJJqAjphhWzoP9_fp_xtPC8-pChF6NHiFf2yseIsIK4RPOzJU2HVLhEjrorjtEGyIdtZu62aWNuJgjnxL8wUynqwh5mfitCBOoYcUhmX4R8QpL9YrbFCn0HxDj7Jy5niDIgNRhN0vbF3NGFMqSgUUlm85nkuubS8bZka=w72-h72-p-k-no-nu
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thehackernews.com
referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 169544
cf-polished: origFmt=jpeg, origSize=3303
content-disposition: inline;filename="microsoft-windows-security-updates.jpg"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3222
x-xss-protection: 0
expires: Thu, 14 Oct 2021 15:53:28 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v1035"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YDeaYNodLWACDqEpL2gWANOCu8S77cbXRcTFNufeoiQF070jSl9exNzcWMIyE%2BQg1BCJ7cBJsXOcngRMNvgjl8Dtym61CFoPtkoLI18ngbqtPnkd9NlukuWEh9aiwzW7xfl7"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept, Accept-Encoding
cache-control: public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges: bytes
cf-ray: 69e9e8f12a2640b1-CDG
access-control-expose-headers: Content-Length

GET
H/1.1 200
OK dv-measurements1800.js Show response
cdn.doubleverify.com/ Frame 651B 495 KB
90 KB 8ms
8ms Script
application/javascript 2.18.232.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements1800.js
Requested by: Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-109.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 3c2c5e8ce71da5f920b37260c35faad806880a17d60b6b93e35e1200763a6733

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 15 Oct 2021 14:59:12 GMT
Content-Encoding: gzip
Last-Modified: Wed, 06 Oct 2021 09:46:20 GMT
Server: Microsoft-IIS/10.0
ETag: "0fef5397bad71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 91601

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ 0
23 B 52ms
52ms Ping
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 651B 3 KB
2 KB 11ms
11ms Script
text/javascript 213.254.244.16
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&ttmms=60&ttfrms=5&brid=3&brver=93.0.4577.63&bridua=3&bds=1&tstype=1&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau2EE24%3C6CD%5C369%3A%3F5%5CEC%3A4%3C3%40E%5C6IA2%3F5%3A%3F8%5D9E%3E%3D&srcurlD=0&aUrlD=0&ssl=https:&dfs=924&ddur=11&uid=1634309952244214&jsCallback=dvCallback_1634309952244379&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F93.0.4577.63%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=1800&tgjsver=1800&lvvn=28&m1=13&refD=0&referrer=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html&fwc=0&flt=1&fec=654&fcifrms=8&brh=2&sdf=2&dvp_epl=139&noc=4&ctx=607671&cmp=24935727&sid=5936378&plc=292704445&crt=143061732&btreg=485910716&btadsrv=doubleclick&adsrv=1&advid=6141273&tagtype=display&errorURL=https://tps.doubleverify.com/visit.jpg&auevent=__AP1_np_dv_xkij9a5o6haPA__&mib=0&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_tcnt=2&dvp_sukv=6390812687.875724&dvp_tukv=4124521.86946547&dvp_uuid=1010969014.9328936&dvp_tuid=498206714772
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1800.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.16 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: ee94ada369c3e2f738cb1a9b572b19c1279c586fa129ef3a98f7d4674b262b40

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:11 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 10/14/2021 2:59:12 PM

GET
H3 200 CtfsWAsRe2m3N424Qc1nuWYtSGM1BvOIuby86xg17sc.js Show response
pagead2.googlesyndication.com/bg/ Frame BBC8 35 KB
13 KB 26ms
26ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CtfsWAsRe2m3N424Qc1nuWYtSGM1BvOIuby86xg17sc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

sffe /

Resource Hash

0ad7ec580b117b69b7378db841cd67b9662d48633506f388b9bcbceb1835eec7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 11:58:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10821
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13341
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sat, 15 Oct 2022 11:58:51 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/ 87 KB
28 KB 42ms
19ms Script
application/javascript 104.16.18.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2571456
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 27964
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-15d95"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sILt6jUsVTFEVn94gubsv2TShr6yUqmoec0Vlc9uIbCL5Qu%2FonU9y%2FSxp%2Bjx0TyFnRUBTLn6v60saImsITcC5SJLIh9gwBTN2bf2iKE%2BqSizeGerlfuMVP4Nwgi7yf1lemyZzvNN"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69e9e8f1ffef2151-DUS
expires: Wed, 05 Oct 2022 14:59:12 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 84ms
28ms Script
text/javascript 142.250.186.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Oct 2021 16:38:54 GMT
server: Golfe2
age: 3486
date: Fri, 15 Oct 2021 14:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Fri, 15 Oct 2021 16:01:06 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 145 KB
50 KB 53ms
52ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: thehackernews.com
URL: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

4e65db6125725a54b3f190286f651177703c7f0d6cb8bfc6b91f0f654c46366e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51494
x-xss-protection: 0
server: cafe
etag: 13690261112050369754
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 15 Oct 2021 14:59:12 GMT

GET
H3 200 AVvXsEhSQim3JMdQinIlegZ7B7OU0xOmyTQsS8iLuRDsKWCowIA8nIkTbYyuia34h1-5uOa5vAaFq2KyW3VlTA8x6jC7rBfZJATUsbVVy1i5MWceWC52np-9hBEi-W04l50nISPxLH0Qk9nqlvU-lqy4t9eBPCxR0h42k0Jw2seplZ5dTFpHB0EmM1No6qFm=w72-...
thehackernews.com/new-images/img/a/ 3 KB
4 KB 33ms
32ms Image
image/webp 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/a/AVvXsEhSQim3JMdQinIlegZ7B7OU0xOmyTQsS8iLuRDsKWCowIA8nIkTbYyuia34h1-5uOa5vAaFq2KyW3VlTA8x6jC7rBfZJATUsbVVy1i5MWceWC52np-9hBEi-W04l50nISPxLH0Qk9nqlvU-lqy4t9eBPCxR0h42k0Jw2seplZ5dTFpHB0EmM1No6qFm=w72-h72-p-k-no-nu

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

392fd7aeffe659ba3db9577f105b36cf6e0437eae66b33ddea79bc3a9113a23c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:path: /new-images/img/a/AVvXsEhSQim3JMdQinIlegZ7B7OU0xOmyTQsS8iLuRDsKWCowIA8nIkTbYyuia34h1-5uOa5vAaFq2KyW3VlTA8x6jC7rBfZJATUsbVVy1i5MWceWC52np-9hBEi-W04l50nISPxLH0Qk9nqlvU-lqy4t9eBPCxR0h42k0Jw2seplZ5dTFpHB0EmM1No6qFm=w72-h72-p-k-no-nu
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thehackernews.com
referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 203671
cf-polished: origFmt=jpeg, origSize=4552
content-disposition: inline;filename="C12.jpg"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3560
x-xss-protection: 0
expires: Thu, 14 Oct 2021 06:24:41 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v101f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6KtLYQHKtLlxocB1oruceMYrVW0rRKm%2F%2BdynKDZApKAXLPtTb%2FhXkQuDIbEjlLPDxRLPAPar49V24Csk9q5bKxvoRQOKV8tREUBG%2Fud5SwMNZiFxRiTascRm9LrpyCqSs80S"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept, Accept-Encoding
cache-control: public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges: bytes
cf-ray: 69e9e8f29cf940b1-CDG
access-control-expose-headers: Content-Length

GET
H3 200 AVvXsEhVq8eFEJlLfCAurWB0R-OMAlpHQ-g7bnUU0RONAzYVPQbRR0iRvdBpHyUIA85Zegy_thFHhYnT2_hrMVZG6wc5JV6fKP-TodE1yerKFgpwclMJkfN6SbxCPA1xxOKTsq25wxF9OpSVu_bbUYwIWs6fow4lfp1bX4TlJN5-divTrS_nimaZgEhJhBKh=w72-...
thehackernews.com/new-images/img/a/ 2 KB
3 KB 50ms
49ms Image
image/webp 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/a/AVvXsEhVq8eFEJlLfCAurWB0R-OMAlpHQ-g7bnUU0RONAzYVPQbRR0iRvdBpHyUIA85Zegy_thFHhYnT2_hrMVZG6wc5JV6fKP-TodE1yerKFgpwclMJkfN6SbxCPA1xxOKTsq25wxF9OpSVu_bbUYwIWs6fow4lfp1bX4TlJN5-divTrS_nimaZgEhJhBKh=w72-h72-p-k-no-nu

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

68135aeadfe30c169b9ec8f3f626352241458592bac4bef69419fe295e24a97e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:path: /new-images/img/a/AVvXsEhVq8eFEJlLfCAurWB0R-OMAlpHQ-g7bnUU0RONAzYVPQbRR0iRvdBpHyUIA85Zegy_thFHhYnT2_hrMVZG6wc5JV6fKP-TodE1yerKFgpwclMJkfN6SbxCPA1xxOKTsq25wxF9OpSVu_bbUYwIWs6fow4lfp1bX4TlJN5-divTrS_nimaZgEhJhBKh=w72-h72-p-k-no-nu
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thehackernews.com
referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 138798
cf-polished: origFmt=jpeg, origSize=3400
content-disposition: inline;filename="ddos.jpg"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 2550
x-xss-protection: 0
expires: Fri, 15 Oct 2021 00:25:54 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v102f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oCW2zKzAkmJMTdpSeNaYSxBt%2BF1Va4RCCx8EZAz9bu2FhYI3bJVKzcRtwHhelKTBlJ2w75nGd8qRqR8sEW%2FPpwtsOB4ruq8%2BnkazgGJLHZq9BO7SJMGfVMGjnmZ9dUTvoNfS"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept, Accept-Encoding
cache-control: public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges: bytes
cf-ray: 69e9e8f29cfb40b1-CDG
access-control-expose-headers: Content-Length

GET
H3 200 AVvXsEhSGQD7HHHPbcRb57Akn_alHHSNDt0MpZCbwm0wiqHdqdcwFVmN_wK0jBEzdOwM6yLRg2D3j4OLbLh4wlCqrh5OISQrly0aacUfe96GkJ7cesICeHo0nAIrfMu2U-IJZ8CiB_Ek0t2q2RCfxvUo0LWdmRI_YEQPIrFx0rHzwJ-C3DuMS5Q24GaiSvE2=w72-...
thehackernews.com/new-images/img/a/ 4 KB
5 KB 50ms
50ms Image
image/jpeg 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/a/AVvXsEhSGQD7HHHPbcRb57Akn_alHHSNDt0MpZCbwm0wiqHdqdcwFVmN_wK0jBEzdOwM6yLRg2D3j4OLbLh4wlCqrh5OISQrly0aacUfe96GkJ7cesICeHo0nAIrfMu2U-IJZ8CiB_Ek0t2q2RCfxvUo0LWdmRI_YEQPIrFx0rHzwJ-C3DuMS5Q24GaiSvE2=w72-h72-p-k-no-nu

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

124bcce71ea3b85d251f29c495f55a11fb53a8392dbec5e324ab5a48ab187f2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:path: /new-images/img/a/AVvXsEhSGQD7HHHPbcRb57Akn_alHHSNDt0MpZCbwm0wiqHdqdcwFVmN_wK0jBEzdOwM6yLRg2D3j4OLbLh4wlCqrh5OISQrly0aacUfe96GkJ7cesICeHo0nAIrfMu2U-IJZ8CiB_Ek0t2q2RCfxvUo0LWdmRI_YEQPIrFx0rHzwJ-C3DuMS5Q24GaiSvE2=w72-h72-p-k-no-nu
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thehackernews.com
referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 52538
cf-polished: status=not_needed
content-disposition: inline;filename="github.jpg"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3901
x-xss-protection: 0
expires: Sat, 16 Oct 2021 00:23:34 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v1031"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VIggI2tVCC%2Byy759ycI%2BbfInhGQUkFmaRl7mDA5JFUlRAn4z%2FpLJwu0iLIyimHsi7dU0K%2FGc0l3LTtUz1SL6h3QMfmqyftYjjYDMiRNk%2BfZsMDB2%2BlQc89Rj8hp1eE0zoyNp"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
vary: Accept-Encoding
cache-control: public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges: bytes
cf-ray: 69e9e8f29cfc40b1-CDG
access-control-expose-headers: Content-Length

GET
H3 200 AVvXsEjEiFxeHmhQyeLbx0d5Zwd-o1DL6FXrHNxyPgdkp3Dl5X4tIWd_26EVdXDQPAq4RZC9U-CwpA2M9NXL33RWfd_7ySXLukOYN8VJrRRYZdZVH0dzJlqNIw7cfAjrFLUIsdCKUXjUDHk7Lk-a4N7r9-0NM_-lXX3drP7AZp6SpYCJ_F18zQxbs6x-aNVs=w72-...
thehackernews.com/new-images/img/a/ 4 KB
5 KB 48ms
48ms Image
image/webp 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/new-images/img/a/AVvXsEjEiFxeHmhQyeLbx0d5Zwd-o1DL6FXrHNxyPgdkp3Dl5X4tIWd_26EVdXDQPAq4RZC9U-CwpA2M9NXL33RWfd_7ySXLukOYN8VJrRRYZdZVH0dzJlqNIw7cfAjrFLUIsdCKUXjUDHk7Lk-a4N7r9-0NM_-lXX3drP7AZp6SpYCJ_F18zQxbs6x-aNVs=w72-h72-p-k-no-nu

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d1ee9435ef3e1a423d6275349528a14717ae8569c33676dff70cf84a2093d611

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:path: /new-images/img/a/AVvXsEjEiFxeHmhQyeLbx0d5Zwd-o1DL6FXrHNxyPgdkp3Dl5X4tIWd_26EVdXDQPAq4RZC9U-CwpA2M9NXL33RWfd_7ySXLukOYN8VJrRRYZdZVH0dzJlqNIw7cfAjrFLUIsdCKUXjUDHk7Lk-a4N7r9-0NM_-lXX3drP7AZp6SpYCJ_F18zQxbs6x-aNVs=w72-h72-p-k-no-nu
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thehackernews.com
referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6308
cf-polished: origFmt=jpeg, origSize=4005
content-disposition: inline;filename="google.jpg"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3944
x-xss-protection: 0
expires: Sat, 16 Oct 2021 13:14:04 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "v104d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wJ%2FEG4xKJO6u%2BOqcoeFwML7q4ZE0xwPQ0aFwRFEA22uJgE3kTVmREiQrQ95JDeJa1Rdj1J5LHV2I%2BLuPzjJf7s%2F5WQsQOc88FTWfcvO5DQIQtJ3HgmgxXH8wKp5bq15tqWkb"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept, Accept-Encoding
cache-control: public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges: bytes
cf-ray: 69e9e8f29cfe40b1-CDG
access-control-expose-headers: Content-Length

GET
H3 200 sec-code.png
thehackernews.com/images/-deh3HUWoqgA/YVXKPqaJZxI/AAAAAAAA4as/8vaF_u8-E9ArXKvXJ8sbs5tGl2E6-ve_ACLcBGAsYHQ/s300-e100/ 19 KB
20 KB 33ms
33ms Image
image/webp 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-deh3HUWoqgA/YVXKPqaJZxI/AAAAAAAA4as/8vaF_u8-E9ArXKvXJ8sbs5tGl2E6-ve_ACLcBGAsYHQ/s300-e100/sec-code.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc73f3960948db94fe82140646ec386e0d1e42d16bcdb28e12986df021ef2e7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:path: /images/-deh3HUWoqgA/YVXKPqaJZxI/AAAAAAAA4as/8vaF_u8-E9ArXKvXJ8sbs5tGl2E6-ve_ACLcBGAsYHQ/s300-e100/sec-code.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thehackernews.com
referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 203597
cf-polished: origFmt=png, origSize=22243
content-disposition: inline; filename="sec-code.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 19874
x-xss-protection: 0
expires: Fri, 21 Jan 2022 06:25:55 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "ve1ac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xphk4Endngyq9AnVT7vnjLL9uLazURipXR%2FzJoReE8N%2Btr2yRA5qxZxyvwn8fxm%2FiBz65iWifeliLBSPDVaXsL24frR7uP%2FDnwPtDNDFN3PH4sKzoD3Li%2BZ8JNVoGu9oxtJz"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
vary: Accept, Accept-Encoding
cache-control: public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges: bytes
cf-ray: 69e9e8f29cff40b1-CDG
access-control-expose-headers: Content-Length

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 61ms
30ms XHR
text/plain 142.250.186.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=581347677&t=pageview&_s=1&dl=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html&dp=%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html&ul=en-us&de=UTF-8&dt=Attackers%20Behind%20Trickbot%20Expanding%20Malware%20Distribution%20Channels&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAAABAAAAAC~&jid=1313172455&gjid=1991079732&cid=497744687.1634309952&tid=UA-27389293-1&_gid=293218390.1634309952&_r=1&cd1=2.0&z=498489365

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110120101/ 273 KB
98 KB 52ms
52ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110120101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7983783048239650&plah=thehackernews.com&bust=31063146

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

14f225dd8ec3c78829d13f30d7d66e280c98a79d9f48ed7df8c0fdb5acf93759

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99992
x-xss-protection: 0
server: cafe
etag: 9288989589447927817
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 15 Oct 2021 14:59:12 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211013/r20190131/ Frame 0D49 10 KB
5 KB 21ms
21ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211013/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

8f297a42c731c5e6412ef47dff5d7697e142a28abe98d34b515951d40e5e9f7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20211013/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thehackernews.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmm4qMc2HqYyOvJIr75aXLSGbJhdKAD04rEHjZpmUgpavbOC4Aq2jxMTjf5wvs
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Thu, 14 Oct 2021 21:27:24 GMT
expires: Thu, 28 Oct 2021 21:27:24 GMT
content-type: text/html; charset=UTF-8
etag: 9069739545958607985
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4691
x-xss-protection: 0
age: 63108
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9E43 0
20 B 62ms
62ms Image
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BiKbeP5dpYaPeMdSz3gPf9LWoBgAAAAA4AeAEAg&bg=!-_il-LzNAAao6lBpqOo7ACkAdvg8Wr7n8mQzqPMmhJve7e1gCuYaIatNQp5BUOD70krybWaQw-JyXQIAAADIUgAAABBoAQeZAr9vcX7YoavJUqjYfqEQ0q3im4Tt_on6hYyA5ybqAEp2LOojIhfhLK3bsiR2kf8i8QdO_G-3SKywnRHQph5_M4maqhaV9yNpmBjILjsYP_RcdUzTTPUlHxpZaXzPsdryAkNHE9u8ApwwMhovjOP2dNw34K3InLTwbwDkyHIJw0fc5Exc-bLRG-yaH1Ab3qcbTiD3mh6rBE5pIHw7jAouBeSHxBeUbFVdJanInV8EXECqWcrVccHfKhlEe2KFcLagchHfEG3d9Mr21y6zGF_fPx5wCnhD06CdO4hgAz_JjfIeaQfFPWkDptsMv4g4pPSG-fEYVQjKGt6TWx3dvCOvUCK1LV-P4qoQ_m8F91P_sDoVs7pKYYKcntTP2461rrBhDuNmXutPZ6DIPhYLfyIBHs4TVPaidUDhyGf2YmLBNXFnlEcG2eKEJ1az6l5rNIuAIYb9u7m_TDXsPlrnk_3sBawOZo5PNPKqIrA7K4iUZYpIZqjlUcT6gf3K_xrEiG2r_wBoUXR-_dUQmYGYpi2eH0e_ut3Fqoxyh_wE9VsA6EbFdmzYnFhi9YWi8iwPBxLgbzB863IbQjUUIdnZAIJJOsrDLQz7rlFYj0l07sEyu8Ak3MFKgQvQO2EoGRnMZsJfvEs9HGcy3NW0QmCIdXgHwnpqQqctHF9LApTtRISaBflkCoAwLee50fc4-gEDyx_Gse6fRMo3OYUlMeBpX34CGa765-ifZJemjVCUGOMbmC-nQfSxbvD7FRXE0swx3Y5k55JhMyUm9C3uCtZDwbSvHimvCiTVgMkCluWZnqfpppLUkmngApAWXvaxVMXw0gQbS7liahDRD_AHZkqn83TtU2AHOHWMyve5UuajSJezT0FbWmKjieCAzL5KRIYWbVzuX44cxTPX4ev0s_lEPPOhBw4iUWsBH1aXhbuGlgQoXcvZ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
414 B 73ms
24ms XHR
text/plain 74.125.206.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-27389293-1&cid=497744687.1634309952&jid=1313172455&gjid=1991079732&_gid=293218390.1634309952&_u=YEBAAAAAAAAAAC~&z=2072807302

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.206.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wk-in-f156.1e100.net

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 15 Oct 2021 14:59:12 GMT
content-type: text/plain
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ca-pub-7983783048239650 Show response
fundingchoicesmessages.google.com/i/ 69 KB
26 KB 96ms
46ms Script
application/javascript 142.250.186.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-7983783048239650?ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110120101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7983783048239650&plah=thehackernews.com&bust=31063146

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f14.1e100.net

Software

ESF /

Resource Hash

dee078bec7e621a7201cdcfe07f4397737559b7a005dbfa331c5f7b09f9e5967

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-0Uh2HF27rX0lnWkrisQvOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'nonce-0Uh2HF27rX0lnWkrisQvOA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorServingWebSwitchboardHttp"
x-frame-options: SAMEORIGIN
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
report-to: {"group":"ContributorServingWebSwitchboardHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorServingWebSwitchboardHttp/external"}]}
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-0Uh2HF27rX0lnWkrisQvOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'nonce-0Uh2HF27rX0lnWkrisQvOA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
522 B 100ms
48ms Image
image/gif 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-27389293-1&cid=497744687.1634309952&jid=1313172455&_u=YEBAAAAAAAAAAC~&z=169823502

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
522 B 107ms
49ms Image
image/gif 142.250.186.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-27389293-1&cid=497744687.1634309952&jid=1313172455&_u=YEBAAAAAAAAAAC~&z=169823502

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 channel-728-b.png
thehackernews.com/images/-MWpdqxEQbIE/YWRg-YjZ3mI/AAAAAAAA4ck/omdUbfQA6zU03oApk0aAJTlIu1AL7IOuACLcBGAsYHQ/s728-e100/ 4 KB
5 KB 45ms
45ms Image
image/webp 172.67.70.21
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thehackernews.com/images/-MWpdqxEQbIE/YWRg-YjZ3mI/AAAAAAAA4ck/omdUbfQA6zU03oApk0aAJTlIu1AL7IOuACLcBGAsYHQ/s728-e100/channel-728-b.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.70.21 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1019c9617184945576b755309af3c4e3dd1f180a2906c979790e9a2dbc4cdb09

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:path: /images/-MWpdqxEQbIE/YWRg-YjZ3mI/AAAAAAAA4ck/omdUbfQA6zU03oApk0aAJTlIu1AL7IOuACLcBGAsYHQ/s728-e100/channel-728-b.png
pragma: no-cache
cookie: _ga=GA1.2.497744687.1634309952; _gid=GA1.2.293218390.1634309952; _gat=1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thehackernews.com
referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/2021/10/attackers-behind-trickbot-expanding.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 203524
cf-polished: origFmt=png, origSize=5284
content-disposition: inline; filename="channel-728-b.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3942
x-xss-protection: 0
expires: Fri, 21 Jan 2022 06:27:08 GMT
cf-bgj: imgq:100,h2pri
server: cloudflare
etag: "ve1cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tt8WKcj%2BQQzQu5Y8osoNhOmrKl49e9l3gvzCiky5I04Oy%2B6IvVVrDtb9uf6lPSOYLZwASVWYhnMkMlMK9q2pWrnSSWT9H16xkhoppRE2aD%2BUMPWsOILiLACRQ13dXNoYKuIO"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
vary: Accept, Accept-Encoding
cache-control: public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges: bytes
cf-ray: 69e9e8f3cf3f40b1-CDG
access-control-expose-headers: Content-Length

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BBC8 0
20 B 61ms
61ms Image
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bn7JDQJdpYf_RBYSu3gOPzoOgCwAAAAA4AeAEAg&bg=!oaKloubNAAao6lBpqOo7ACkAdvg8WubsKZ7HCQRHkIRj11Jrha9k1b2uNeTQT8TJar_fJvHhFh6WjwIAAAEDUgAAAAxoAQeZAt-Fo-0igdiAoXfV-KxwUWjwYgBllcIYLyx3k6dZ3AFzsB3OM0dNn7cW-OujKhpxVTRGuwTCuOg4jYzvQ8BqAoyC7vd6E1uO2b_ZKM7O_OHiZmvviNkkcilpFKBZWraxmXVOurW03QFlpoChAtnmrFMLEhlAZ6POsRtK0QIpaB2PxY6VNnFAbkMDokAVvWFgFhxen-h1Thgz3OaoQKntwCNyYVaDqU63NC__uMHAytKcRR6-xxxg1p7ML5OWU1_qFVHVCVQV9J50F8IIgD9k180bkAGqGlJq2Btn3DuF9t9PBbmAiZ6ggr47vgUPLLLbXvXHhVGfQ9xlFL75qMfbhS_22epLcUbXl8cSJnTGtoVJnFOHvwuJKosbVqNVhfoMepeQS0-aKxKjVU4yY_YUwTdkA5QGXjYl_nAB9V4M-ijtn7OOd9TWXmMSFRlyswfxTipH4q07aF3yPa6clevL0vX4jayUi8XUSKaO1aKzwuw01dIRqNhiclidIlkDeuVLivjSw8Z5fwxA48GdHc6XTyBxiBSebQXvnCR41rYb1cgv7fJgR_BXaqdGU2MUpyBjFv2p307LIzBxAHzSea3BDLWuf83KeCaeoHQHVR4JffcQ568LYrzVF0Phq6GBdynOHNe3wogjUExGRi6_Zu9b3Hrdn9FYmzH9BE7-3HQ4vBtHFqYJ3oRhhH4VQs0pUfHUu2zE-MfDCp0Vb06hZmMUA1BozuM6nLz6mUzqTD92Mb35LI3A9WIcyA5P5kJuq7ud-JoY_yweRJjNM6CAWLWbgC9lU0u4t-HKvu5GBi7RHYdy0Tdck46OjRcd-TSKiR5UrTgeGDb9iw2AHTzOJ_iGG9rOqNruwqwlx2O5hkM5uWoL3xvxe9o0bl_4zEU7xlkT9AGhpN6Gkhk0B9W2MB5H5pEIoirP9NnSgrohTbGY7vWH2C-JY_pZhLZuK24ovroc0f3xKdqO_hoYteFmbRV5hKU

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxXaFYiELUFhvJvgNwGrIZScd6U9RkdC5IdlHISQm116VWj4h5NXAtez_PncsbtPltC4vNeX3hDi53WE5zGNeRU= Show response
fundingchoicesmessages.google.com/el/ 0
26 B 85ms
43ms XHR
text/html 142.250.186.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXaFYiELUFhvJvgNwGrIZScd6U9RkdC5IdlHISQm116VWj4h5NXAtez_PncsbtPltC4vNeX3hDi53WE5zGNeRU=?pvid=7A43FAF9-240C-4A3A-8210-DF9CB63F699E&anonid=F026911C-DDFF-491A-B733-0CA940C4334D

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingLoaderClientJs.de.U9e3J6ealG8.es5.O/d=1/rs=AJlcJMzrE_Ed83Uw3ddGvYEl2nZrgTlaug/m=loader_js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-hhxaH5Y7gQXd5qIAJgw4Uw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-hhxaH5Y7gQXd5qIAJgw4Uw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-hhxaH5Y7gQXd5qIAJgw4Uw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-hhxaH5Y7gQXd5qIAJgw4Uw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUo-xPXBapAYYsRNLXxlSzQw_DIs94k04k8ut9gU_oZpfe_4y3fF6xNKk33icT8Mh3nuN_pKQo9dUJA7x-ymJk= Show response
fundingchoicesmessages.google.com/f/ 250 KB
52 KB 119ms
77ms Script
application/javascript 142.250.186.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUo-xPXBapAYYsRNLXxlSzQw_DIs94k04k8ut9gU_oZpfe_4y3fF6xNKk33icT8Mh3nuN_pKQo9dUJA7x-ymJk=?fccs=W251bGwsW1tdLFtdXSxudWxsLG51bGwsbnVsbCxudWxsLFsxNjM0MzA5OTUyLDcyMjAwMDAwMF0sIjdBNDNGQUY5LTI0MEMtNEEzQS04MjEwLURGOUNCNjNGNjk5RSIsIkYwMjY5MTFDLURERkYtNDkxQS1CNzMzLTBDQTk0MEM0MzM0RCIsbnVsbCxbbnVsbCxbN10sbnVsbCxudWxsLG51bGwsbnVsbCxmYWxzZV0sImh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vMjAyMS8xMC9hdHRhY2tlcnMtYmVoaW5kLXRyaWNrYm90LWV4cGFuZGluZy5odG1sIl0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingLoaderClientJs.de.U9e3J6ealG8.es5.O/d=1/rs=AJlcJMzrE_Ed83Uw3ddGvYEl2nZrgTlaug/m=loader_js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f14.1e100.net

Software

ESF /

Resource Hash

18a7e1499389c1cb03839abfbd4ef0848e8dabb283e03e52bc8523e5fd7cf3a3

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-AtpKfsv6emEep8D1pF9zGw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-AtpKfsv6emEep8D1pF9zGw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options: SAMEORIGIN
report-to: {"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-AtpKfsv6emEep8D1pF9zGw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-AtpKfsv6emEep8D1pF9zGw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ 54 KB
4 KB 94ms
36ms Stylesheet
text/css 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorIabTcfV2ClientJs.de.UgKzXHtqkKM.es5.O/d=1/rs=AJlcJMzjnjKEVBnf1RtFwm7K1DYlZXZhbQ/m=iabtcfv2wallscript

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f10.1e100.net

Software

ESF /

Resource Hash

81178b436b493a97e10943f162ee6f7b8023043e7f069f7b7a11b4ef66c5c2c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 15 Oct 2021 14:59:12 GMT
server: ESF
date: Fri, 15 Oct 2021 14:59:12 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Fri, 15 Oct 2021 14:59:12 GMT

POST
H3 204 AGSKWxVc8G1q08bI9jj3KcPKgO4p2cao3x9ZF7Urv_pPv_8o9ZfYJSCkBJbmaIsQlbBAcpb68VS8bYNsCQzxLCz45in1BkHn7J1w1ru45poC90CPyEI53du0Bne8KWsH4jYQhHT3BKFRGJPdYWEiX69o6Y90syKFy_OWe67brPK5zvZjP4WnQggqe6donLnu Show response
fundingchoicesmessages.google.com/el/ 0
26 B 38ms
38ms XHR
text/html 142.250.186.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVc8G1q08bI9jj3KcPKgO4p2cao3x9ZF7Urv_pPv_8o9ZfYJSCkBJbmaIsQlbBAcpb68VS8bYNsCQzxLCz45in1BkHn7J1w1ru45poC90CPyEI53du0Bne8KWsH4jYQhHT3BKFRGJPdYWEiX69o6Y90syKFy_OWe67brPK5zvZjP4WnQggqe6donLnu?dmid=b4d69e468ccb418e

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-+IGR3Ya4Vtffh7gsBlw3OA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-+IGR3Ya4Vtffh7gsBlw3OA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 15 Oct 2021 14:59:12 GMT
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://thehackernews.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-+IGR3Ya4Vtffh7gsBlw3OA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-+IGR3Ya4Vtffh7gsBlw3OA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v109/ 111 KB
111 KB 148ms
94ms Font
font/woff2 142.250.184.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/materialicons/v109/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f3.1e100.net

Software

sffe /

Resource Hash

ed6818649489f3c542a92f2e189696e69f304ca0f4e9a85dfa340e669c6f3304

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://thehackernews.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 00:19:55 GMT
x-content-type-options: nosniff
age: 311958
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113660
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 00:04:22 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 12 Oct 2022 00:19:55 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v26/ 44 KB
44 KB 116ms
73ms Font
font/woff2 142.250.184.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v26/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f3.1e100.net

Software

sffe /

Resource Hash

538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://thehackernews.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 17:03:52 GMT
x-content-type-options: nosniff
age: 78921
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44760
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 16:50:17 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 14 Oct 2022 17:03:52 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v26/ 44 KB
44 KB 96ms
54ms Font
font/woff2 142.250.184.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v26/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f3.1e100.net

Software

sffe /

Resource Hash

538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://thehackernews.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 17:03:52 GMT
x-content-type-options: nosniff
age: 78921
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44760
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 16:50:17 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 14 Oct 2022 17:03:52 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v26/ 44 KB
44 KB 66ms
24ms Font
font/woff2 142.250.184.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v26/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f3.1e100.net

Software

sffe /

Resource Hash

538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://thehackernews.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 17:03:52 GMT
x-content-type-options: nosniff
age: 78921
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44760
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 16:50:17 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 14 Oct 2022 17:03:52 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ 6 KB
3 KB 128ms
100ms Script
text/javascript 52.222.214.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=att_hs&pid=att01&cid=24935727_144332637_292581945&js=st_1pm&sz=300x250&c=te-0176
Requested by: Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=att01&aid=att_hs&cid=24935727_143061732_292704445&js=st0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-37.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: c9a70eb4ec60a1868b0e9af8057a36cc56e6051c3e7f9a72aca1010fcacbbafd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:13 GMT
content-encoding: gzip
server: nginx
x-amz-cf-pop: FRA56-P3
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 081c7bef6b5d3c12829ac4c99182ccea.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 2291
x-amz-cf-id: BVkNan8UiwzZzQhnf0CnkrSQASJ3ntLjfEjs-IQc9isOipQz_u-k9Q==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ 38 KB
12 KB 135ms
108ms Script
text/javascript 52.222.214.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=att_hs&pid=att01&cid=24935727_144332637_292581945&js=st_2
Requested by: Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=att01&aid=att_hs&cid=24935727_143061732_292704445&js=st0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-37.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:13 GMT
content-encoding: gzip
server: nginx
x-amz-cf-pop: FRA56-P3
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 081c7bef6b5d3c12829ac4c99182ccea.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-id: d0p0k2hI5F7GaAJbI0Cfg-zEp-4F91FSQBmJ9VT-6ZgoGv_f_KZzHA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 cap
choices.trustarc.com/ 43 B
383 B 135ms
108ms Image
image/gif 52.222.214.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/cap?aid=att_hs&pid=att01&cid=24935727_144332637_292581945&w=300&h=250&c=573b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-37.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:13 GMT
via: 1.1 081c7bef6b5d3c12829ac4c99182ccea.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P3
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: qEqaCwxHNWm08Pjtb1miTocNCQqThlNxbkkycAP1SSWFqZngYLoVGQ==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ 6 KB
3 KB 131ms
105ms Script
text/javascript 52.222.214.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=att_hs&pid=att01&cid=24935727_143061732_292704445&js=st_1pm&sz=728x90&c=te-4767
Requested by: Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=att01&aid=att_hs&cid=24935727_143061732_292704445&js=st0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-37.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: a64765252c3366c713bb3d831f2fde6e24a9a771da5b6fa85acf622a7725be78

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:13 GMT
content-encoding: gzip
server: nginx
x-amz-cf-pop: FRA56-P3
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 081c7bef6b5d3c12829ac4c99182ccea.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 2313
x-amz-cf-id: Xov_SGfyWTVOZ3agNJck4tnucTcKk0C3dSVLn6Ye5-6_hsb9M9pwtQ==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ 38 KB
12 KB 128ms
102ms Script
text/javascript 52.222.214.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=att_hs&pid=att01&cid=24935727_143061732_292704445&js=st_2
Requested by: Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=att01&aid=att_hs&cid=24935727_143061732_292704445&js=st0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-37.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:13 GMT
content-encoding: gzip
server: nginx
x-amz-cf-pop: FRA56-P3
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 081c7bef6b5d3c12829ac4c99182ccea.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-id: kpY6nArdpKndRFs5Hk7QYaFpITypusyTYKgaZ5_aajY8SPpjBNHVqg==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 cap
choices.trustarc.com/ 43 B
382 B 130ms
104ms Image
image/gif 52.222.214.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/cap?aid=att_hs&pid=att01&cid=24935727_143061732_292704445&w=728&h=90&c=b67b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-37.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:13 GMT
via: 1.1 081c7bef6b5d3c12829ac4c99182ccea.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P3
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: HuQzyyN9fW4XCrYimHw27NMtDjUf17EEdymQZ1gtY_dwStClsv8RyA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ 42 B
64 B 88ms
56ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvSf_gfRB_IKJixzhBfNifBfJK2WTPGzf_qCrLRXxZIh6TV0nJ9Eeanl4dHovy-LiOKo366fkoiHv0Tzyo7N0k&sig=Cg0ArKJSzHn48Ho_P5kJEAE&id=lidar2&mcvt=1000&p=423,1031,673,1331&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211013&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=32&adk=473486474&rs=6&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1634309950953&rpt=1083&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Oct 2021 14:59:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 523D 287 B
626 B 7ms
7ms Image
image/png 52.222.214.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-37.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: public
date: Mon, 20 Sep 2021 06:27:51 GMT
via: 1.1 081c7bef6b5d3c12829ac4c99182ccea.cloudfront.net (CloudFront)
server: nginx
age: 2190682
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P3
timing-allow-origin: *
content-length: 287
x-amz-cf-id: hmD0ep3ogly9vmsgLgG44DaqcUyWoXqT3gscOKmiFXb8Bqosymkjmw==
expires: Wed, 20 Oct 2021 06:27:50 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 523D 739 B
1 KB 8ms
7ms Image
image/png 52.222.214.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-full-tr.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-37.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: public
date: Thu, 14 Oct 2021 13:35:20 GMT
via: 1.1 081c7bef6b5d3c12829ac4c99182ccea.cloudfront.net (CloudFront)
server: nginx
age: 91433
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P3
timing-allow-origin: *
content-length: 739
x-amz-cf-id: luwn4ubFSgy1QGvQHsmeoCNijGAokXSEFz96s9EOo01qyecVhNrR4A==
expires: Sat, 13 Nov 2021 13:35:21 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 358F 287 B
626 B 7ms
7ms Image
image/png 52.222.214.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by: Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=att_hs&pid=att01&cid=24935727_144332637_292581945&js=st_2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-37.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: public
date: Mon, 20 Sep 2021 06:27:51 GMT
via: 1.1 081c7bef6b5d3c12829ac4c99182ccea.cloudfront.net (CloudFront)
server: nginx
age: 2190682
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P3
timing-allow-origin: *
content-length: 287
x-amz-cf-id: _DCoRpalQZot187rXceDLkupH6rmpmtP12ax71p4kU5jyNSUwpeNiA==
expires: Wed, 20 Oct 2021 06:27:50 GMT

GET
H2 200 get
choices.trustarc.com/ Frame 358F 739 B
1 KB 7ms
7ms Image
image/png 52.222.214.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by: Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=att_hs&pid=att01&cid=24935727_144332637_292581945&js=st_2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-37.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: public
date: Thu, 14 Oct 2021 13:35:20 GMT
via: 1.1 081c7bef6b5d3c12829ac4c99182ccea.cloudfront.net (CloudFront)
server: nginx
age: 91433
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P3
timing-allow-origin: *
content-length: 739
x-amz-cf-id: 9gIRYtEj-XwBnX9C-iAZuUsBxvKsdKFOgeqdPO7PcHIaqWSv-U8tKg==
expires: Sat, 13 Nov 2021 13:35:21 GMT

POST
H/1.1 200
OK bsevent.gif
tps620.doubleverify.com/ 807 B
1 KB 106ms
105ms Ping
image/gif 204.154.111.145
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps620.doubleverify.com/bsevent.gif?impid=a471daed7dde4e50b54e6fe7a924537f&pltfrm=Linux%20x86_64&cbust=1634309953586423
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.111.145 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-hlb32.doubleverify.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:12 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: https://thehackernews.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 860
Expires: 10/14/2021 2:59:13 PM

POST
H/1.1 200
OK bsevent.gif
tps615.doubleverify.com/ 807 B
1 KB 95ms
95ms Ping
image/gif 204.154.111.145
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps615.doubleverify.com/bsevent.gif?impid=acb8f4d665784838a69ed5ddef716aff&pltfrm=Linux%20x86_64&cbust=1634309954039813
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.111.145 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-hlb32.doubleverify.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:13 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: https://thehackernews.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 860
Expires: 10/14/2021 2:59:13 PM

POST
H/1.1 200
OK event.png
tps20247.doubleverify.com/ Frame B39B 67 B
418 B 66ms
18ms Ping
image/png 213.254.244.16
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20247.doubleverify.com/event.png?impid=fa6cddda35fc4f5fac953ecb00c2ddf3&gdpr=&gdpr_consent=&dvp_twib=1&vdur=77&eoid=8&msrjs=1800&pltfrm=Linux%20x86_64&sdf=2&vit=2&isvelg=1&tltms=11&tetms=11&msltms=18&vltms=77&sei=289&vetms=5&engms=1&engisel=1&ttfurm=2100&cbust=1634309954082845
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1800.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.16 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:13 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://thehackernews.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 10/14/2021 2:59:14 PM

POST
H/1.1 200
OK event.png
tps20236.doubleverify.com/ Frame 651B 67 B
418 B 42ms
9ms Ping
image/png 213.254.244.16
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20236.doubleverify.com/event.png?impid=a0e2c3e3726f40a093c7082a9554c2a3&gdpr=&gdpr_consent=&dvp_twib=1&vdur=12&eoid=8&msrjs=1800&pltfrm=Linux%20x86_64&sdf=2&vit=2&isvelg=1&tltms=11&tetms=7&msltms=11&vltms=12&sei=289&vetms=22&engms=1&engisel=1&ttfurm=2039&cbust=1634309954279551
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1800.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.16 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:13 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://thehackernews.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 10/14/2021 2:59:14 PM

POST
H/1.1 200
OK event.png
tps20247.doubleverify.com/ Frame B39B 67 B
418 B 8ms
8ms Ping
image/png 213.254.244.16
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20247.doubleverify.com/event.png?impid=fa6cddda35fc4f5fac953ecb00c2ddf3&gdpr=&gdpr_consent=&msrcanlm=202&msrcannum=7&eoid=10&ismms=29&isumms=28&isvelg=1&nvr=6&elmtp=6&isbxdms=2128&b11=2277&adhgt=250&adwdth=300&norwdth=300&norhgt=250&engisel=1&vsos=4&dvp_vsosnmr=16&dvp_mvpw=device-width&dvp_mvpis=1&lftb=2277&sftb=2277&msrdp=10&naral=192&vct=1&vphgt=1200&vpwdth=1600&scrhgt=1200&scrwdth=1600&strp=100&advisonl=true&isiabvms=948&isuiabvms=948&ispmxpms=948&engalms=27&engscrlms=31&dvp_hdnAd=0&dvp_pageEng=true&dvp_dpr=1&cbust=1634309955082342
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1800.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.16 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:14 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://thehackernews.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 10/14/2021 2:59:15 PM

POST
H/1.1 200
OK event.png
tps20236.doubleverify.com/ Frame 651B 67 B
418 B 8ms
7ms Ping
image/png 213.254.244.16
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://tps20236.doubleverify.com/event.png?impid=a0e2c3e3726f40a093c7082a9554c2a3&gdpr=&gdpr_consent=&msrcanlm=202&msrcannum=8&eoid=10&ismms=10&isumms=10&isvelg=1&nvr=2&elmtp=6&isbxdms=2110&b0=2294&adhgt=90&adwdth=728&norwdth=728&norhgt=90&engisel=1&dvp_vsosnmr=1&dvp_mvpw=device-width&dvp_mvpis=1&lftb=2294&sftb=2294&msrdp=6&naral=192&vct=1&vphgt=1200&vpwdth=1600&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&engalms=10&engscrlms=13&dvp_hdnAd=0&dvp_pageEng=true&dvp_dpr=1&cbust=1634309955279873
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1800.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.16 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer: https://thehackernews.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Fri, 15 Oct 2021 14:59:14 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: image/png
Access-Control-Allow-Origin: https://thehackernews.com
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 98
Expires: 10/14/2021 2:59:15 PM

Verdicts & Comments Add Verdict or Comment

147 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.agkn.com/	1970-01-20 06:44:05	Name: ab Value: 0001%3A4hddVZYkwqTPO1ixOXur2gHwgd6FrvRz
.demdex.net/	1970-01-20 02:17:41	Name: demdex Value: 33614688914669094971137507680184282806
.att.demdex.net/	1970-01-20 02:17:41	Name: att Value: 33614688914669094971137507680184282806
.doubleclick.net/	1970-01-20 07:20:05	Name: IDE Value: AHWqTUmm4qMc2HqYyOvJIr75aXLSGbJhdKAD04rEHjZpmUgpavbOC4Aq2jxMTjf5wvs
.agkn.com/	1970-01-20 06:44:05	Name: u Value: C\|0EAgo_FO_KPxTwAAAAAABAQAtAQfm-AQAAQAHAAAAAAF8fS___x4AAAAAAFqU-gAAAAARclC9AAAAAAiG8uQAAAAAHPZovAA
.thehackernews.com/	1970-01-20 15:29:41	Name: _ga Value: GA1.2.497744687.1634309952
.thehackernews.com/	1970-01-19 21:59:56	Name: _gid Value: GA1.2.293218390.1634309952
.thehackernews.com/	1970-01-19 21:58:30	Name: _gat Value: 1
.thehackernews.com/	1970-01-19 21:59:13	Name: FCCDCF Value: [null,null,["[[],[],[],[],null,null,true]",1634309952711]]

21 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292581945%26sid%3D5936378%26dvregion%3D2%26unit%3D300x250(Line 3) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.doubleverify.com/dvbs_src_internal99.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292581945%26sid%3D5936378%26dvregion%3D2%26unit%3D300x250(Line 3) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.doubleverify.com/dvbs_src_internal99.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 306) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_762762527538&jsTagObjCallback=__tagObject_callback_762762527538&num=6&ctx=&cmp=&plc=&sid=&advid=&adsrv=&unit=&isdvvid=&uid=762762527538&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&brid=3&brver=93&bridua=3&dup=null&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=0&htmlmsging=1&m1=13&noc=4&fcifrms=1&brh=2&fwc=0&flt=1&fec=382&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau2EE24%3C6CD%5C369%3A%3F5%5CEC%3A4%3C3%40E%5C6IA2%3F5%3A%3F8%5D9E%3E%3D&dvp_exetime=11.70&callbackName=__verify_callback_762762527538, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 306) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_762762527538&jsTagObjCallback=__tagObject_callback_762762527538&num=6&ctx=&cmp=&plc=&sid=&advid=&adsrv=&unit=&isdvvid=&uid=762762527538&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&brid=3&brver=93&bridua=3&dup=null&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=0&htmlmsging=1&m1=13&noc=4&fcifrms=1&brh=2&fwc=0&flt=1&fec=382&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau2EE24%3C6CD%5C369%3A%3F5%5CEC%3A4%3C3%40E%5C6IA2%3F5%3A%3F8%5D9E%3E%3D&dvp_exetime=11.70&callbackName=__verify_callback_762762527538, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://thehackernews.com/new-images/img/a/AVvXsEi4KfWJYe3ZX8lbyZ4NnmxDXKAQg1dvf4KDGQgCthZ0Zgk8X3-MXq_fuCGwfGVDr8VamuDs-FaaV4wwsXVRCW_N2bnL0m73nUnN2F1kX6OXlMnZsvpnMvlz49IteYvjPL7LWxWzQ0VK_fkf1jm6WdwM0c1xF3zYip9oMjxqnU3eMrahA92GM1f4YV5- Message: Failed to load resource: the server responded with a status of 404 ()
javascript	warning	URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 829) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/dcmads.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 829) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/dcmads.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.googletagservices.com/dcm/dcmads.js(Line 15) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/impl_v80.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.googletagservices.com/dcm/dcmads.js(Line 15) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/impl_v80.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.googletagservices.com/dcm/impl_v80.js(Line 31) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292581945;dc_ver=80.232;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=473486474;ord=d1riu7;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html$0;xdt=0;crlt=uIyEWF3br-;sttr=74;prcl=s, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.googletagservices.com/dcm/impl_v80.js(Line 31) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292581945;dc_ver=80.232;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=473486474;ord=d1riu7;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html$0;xdt=0;crlt=uIyEWF3br-;sttr=74;prcl=s, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292704445%26sid%3D5936378%26dvregion%3D2%26unit%3D728x90(Line 3) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.doubleverify.com/dvbs_src_internal99.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292704445%26sid%3D5936378%26dvregion%3D2%26unit%3D728x90(Line 3) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.doubleverify.com/dvbs_src_internal99.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 306) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_591518162449&jsTagObjCallback=__tagObject_callback_591518162449&num=6&ctx=&cmp=&plc=&sid=&advid=&adsrv=&unit=&isdvvid=&uid=591518162449&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&brid=3&brver=93&bridua=3&dup=null&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=0&htmlmsging=1&m1=13&noc=4&fcifrms=3&brh=2&fwc=0&flt=1&fec=465&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau2EE24%3C6CD%5C369%3A%3F5%5CEC%3A4%3C3%40E%5C6IA2%3F5%3A%3F8%5D9E%3E%3D&dvp_exetime=11.70&callbackName=__verify_callback_591518162449, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 306) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_591518162449&jsTagObjCallback=__tagObject_callback_591518162449&num=6&ctx=&cmp=&plc=&sid=&advid=&adsrv=&unit=&isdvvid=&uid=591518162449&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&brid=3&brver=93&bridua=3&dup=null&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=0&htmlmsging=1&m1=13&noc=4&fcifrms=3&brh=2&fwc=0&flt=1&fec=465&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau2EE24%3C6CD%5C369%3A%3F5%5CEC%3A4%3C3%40E%5C6IA2%3F5%3A%3F8%5D9E%3E%3D&dvp_exetime=11.70&callbackName=__verify_callback_591518162449, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 829) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/dcmads.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 829) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/dcmads.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.googletagservices.com/dcm/dcmads.js(Line 15) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/impl_v80.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.googletagservices.com/dcm/dcmads.js(Line 15) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/impl_v80.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.googletagservices.com/dcm/impl_v80.js(Line 31) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292704445;dc_ver=80.232;dc_eid=40004000;sz=728x90;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=2493880096;ord=bgpjjt;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html$0;xdt=0;crlt=uIyEWF3br-;sttr=3;prcl=s, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.googletagservices.com/dcm/impl_v80.js(Line 31) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292704445;dc_ver=80.232;dc_eid=40004000;sz=728x90;u_sd=1;nel=1;u=__AP1_np_dv_xkij9a5o6haPA__;dc_adk=2493880096;ord=bgpjjt;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fattackers-behind-trickbot-expanding.html$0;xdt=0;crlt=uIyEWF3br-;sttr=3;prcl=s, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
att.demdex.net
cdn.doubleverify.com
cdn3.doubleverify.com
cdnjs.cloudflare.com
choices.trustarc.com
choices.truste.com
d.agkn.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
pagead2.googlesyndication.com
rtb0.doubleverify.com
s0.2mdn.net
stats.g.doubleclick.net
thehackernews.com
tpc.googlesyndication.com
tps.doubleverify.com
tps20236.doubleverify.com
tps20247.doubleverify.com
tps615.doubleverify.com
tps620.doubleverify.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
104.16.18.94
13.32.121.100
142.250.184.195
142.250.185.130
142.250.185.138
142.250.185.198
142.250.186.131
142.250.186.142
142.250.186.162
142.250.186.33
142.250.186.36
172.217.16.130
172.217.16.134
172.67.70.21
18.192.155.173
18.200.165.55
2.18.232.109
204.154.111.145
213.254.244.16
52.222.214.37
74.125.206.156
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e
0ad7ec580b117b69b7378db841cd67b9662d48633506f388b9bcbceb1835eec7
1019c9617184945576b755309af3c4e3dd1f180a2906c979790e9a2dbc4cdb09
124bcce71ea3b85d251f29c495f55a11fb53a8392dbec5e324ab5a48ab187f2c
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
14f225dd8ec3c78829d13f30d7d66e280c98a79d9f48ed7df8c0fdb5acf93759
158edd2a7562d2b16eadda8fb990eb8d20e53837dd1abdfd2c890fcc0980ede0
18a7e1499389c1cb03839abfbd4ef0848e8dabb283e03e52bc8523e5fd7cf3a3
1b9cf28fcde7a50b452741975b147e372a045579fa98fc2e8703ba0aa8c6d304
29f191aeff57288020d5ffe78aebb0d5311be2a93a968f5e58d5a483ce0eddc2
2d74dfc70e9bcdd126d17ae6fb54f387a8f9200d3bdd7b17e1dd6ca4b2e13da6
306db32cc48f2b579f015b6996f9ec64be00187b08c0c1bd261cd4be5edb2064
392fd7aeffe659ba3db9577f105b36cf6e0437eae66b33ddea79bc3a9113a23c
3c2c5e8ce71da5f920b37260c35faad806880a17d60b6b93e35e1200763a6733
3d8ab8467b889847c12c542bee765afc54acbaff1cc91ce3197ab4f2be8f08ff
3ff61841d03d50bf345aa409884f99ed32dd546dbee0e6f2e027bbad47d6acf8
41d9de265e720a301cbd9c525fa7089a677e0b099b422579a401516212b5add3
41fa0b4476b2b0d598a402544ddbd340e0adf974ca4578d5ef0611c464866532
42977b3f1bf3b11d34a40c50c095d65b3ba8631ef4ebb37b950ccd9c401d2181
4e65db6125725a54b3f190286f651177703c7f0d6cb8bfc6b91f0f654c46366e
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
538dd4ff6e384a44155168326ac40a6c20a93cd212b1fbf88ae7b0c44f9ab0bd
569ca629876e6854d4b35d1ffa31c3353a33102d6ca110f56ab994aef145314b
5d96c79bb952836fbd7238c7d4dbeb0d9cf590fe1def425df03e1aa749053774
5dd139490465c0d5b42eb905451078a5ee84b5c220d6af5b143af49247a8ecf5
6795c5c8b9b0aeb87d6663ccd7a71fb9d2f2817fe9b5c2e67bce0d5a5e1309a1
67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab
68135aeadfe30c169b9ec8f3f626352241458592bac4bef69419fe295e24a97e
688a1e2444a1171a4cfbc8674c62d53bc663bf35a7825eb3563851e79694411c
78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416
7a3e1fa68b2ed9b3c641299d3129d7439377b2f2f21a4f13d17435967ecb00a5
7ef464bb2ed71125549a5e667ffd1515fdaf18aa3753eb5ff6227e8780001ef4
81178b436b493a97e10943f162ee6f7b8023043e7f069f7b7a11b4ef66c5c2c4
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86be5d6a3d661fd3d5d72f254a347dec5c66cad569117f51dad297acba02f558
8f297a42c731c5e6412ef47dff5d7697e142a28abe98d34b515951d40e5e9f7d
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
a64765252c3366c713bb3d831f2fde6e24a9a771da5b6fa85acf622a7725be78
a71328300f380217ae0abf7f805052a10a0c196cb241eb97adf9b905e4a48c8a
b2db7373b4a646a326952fa386be6fde1ce4c93f101258d840c91e42af13d47d
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c2842ab20cc17cb61e32799c8cff642f37a20a933b12f678628b4666c0311f78
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
c5d699fefdbb1353ad990ad49626c5f022090b3c956cea7d9c823c68905b948b
c6a9d65e5bd6eb2447ea57e398e1d30f3c6e2d022ecf195933d161ffed964690
c9a70eb4ec60a1868b0e9af8057a36cc56e6051c3e7f9a72aca1010fcacbbafd
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d03755898b05a3d69377bf7da16ccb307e789a0f569b4dbbcb7b29bdecf967c5
d1ee9435ef3e1a423d6275349528a14717ae8569c33676dff70cf84a2093d611
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
dee078bec7e621a7201cdcfe07f4397737559b7a005dbfa331c5f7b09f9e5967
df33ff37d048a34e2b43aedb6bcd56eb53306fdfd42d04715b7005f25d4a6546
e01ddff81ef43d93f47545eb333edda3130c28ec9b62ed8a71100f1cbfd94887
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e42766569e9bc18ecc8ff5f29cac4fe86b34cd6b1ed58008fcaf2b73ff4c73a0
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a
ecb5d2271e02f61aad061b3f72035075adc40cdeed19f9ab678e97eab0a2720a
ed6818649489f3c542a92f2e189696e69f304ca0f4e9a85dfa340e669c6f3304
ee94ada369c3e2f738cb1a9b572b19c1279c586fa129ef3a98f7d4674b262b40
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f88754ecdaeedbf69845f3cb4015909beff31f92b173185c075ff8ab40ae3d02
fc73f3960948db94fe82140646ec386e0d1e42d16bcdb28e12986df021ef2e7d
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

thehackernews.com Open in urlscan Pro 172.67.70.21 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

92 Requests

100 %HTTPS

0 %IPv6

16 Domains

28 Subdomains

22 IPs

4 Countries

1408 kBTransfer

3394 kBSize

9 Cookies

34 Outgoing links

Redirected requests

92 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

thehackernews.com Open in urlscan Pro
172.67.70.21 Public Scan

Screenshot
Live screenshot

Full Image

92
Requests

100 %
HTTPS

0 %
IPv6

16
Domains

28
Subdomains

22
IPs

4
Countries

1408 kB
Transfer

3394 kB
Size

9
Cookies

92 HTTP transactions
7 data transactions