my3billing-confirmation.com Open in urlscan Pro
198.54.119.112  Malicious Activity! Public Scan

URL: https://my3billing-confirmation.com/log.php
Submission: On October 28 via api from QA

Summary

This website contacted 11 IPs in 5 countries across 9 domains to perform 32 HTTP transactions. The main IP is 198.54.119.112, located in Los Angeles, United States and belongs to NAMECHEAP-NET, US. The main domain is my3billing-confirmation.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 26th 2020. Valid for: a year.
This is the only time my3billing-confirmation.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Three UK (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
3 198.54.119.112 22612 (NAMECHEAP...)
1 173.199.53.25 16815 (GOTO-PRIM...)
8 151.101.194.133 54113 (FASTLY)
1 173.199.53.61 16815 (GOTO-PRIM...)
2 23.50.63.18 20940 (AKAMAI-ASN1)
7 2a02:26f0:eb:... 20940 (AKAMAI-ASN1)
5 23.8.10.130 20940 (AKAMAI-ASN1)
1 34.242.246.49 16509 (AMAZON-02)
1 3 34.248.119.134 16509 (AMAZON-02)
1 15.237.136.106 16509 (AMAZON-02)
1 1 66.117.28.86 15224 (OMNITURE)
1 52.169.7.127 8075 (MICROSOFT...)
32 11
Domain Requested by
7 assets.adobedtm.com my3billing-confirmation.com
assets.adobedtm.com
5 new.three.co.uk my3billing-confirmation.com
4 three-udc.digital.medallia.eu my3billing-confirmation.com
4 three-resources.digital.medallia.eu my3billing-confirmation.com
three-resources.digital.medallia.eu
3 dpm.demdex.net 1 redirects my3billing-confirmation.com
3 my3billing-confirmation.com my3billing-confirmation.com
2 ydn243.3gateway.net my3billing-confirmation.com
ydn243.3gateway.net
1 ydn243.dynatrace-managed.com ydn243.3gateway.net
1 cm.everesttech.net 1 redirects
1 smetrics.three.co.uk ydn243.3gateway.net
1 three.demdex.net my3billing-confirmation.com
1 cbi.boldchat.com my3billing-confirmation.com
1 vmss.boldchat.com my3billing-confirmation.com
32 13
Subject Issuer Validity Valid
my3billing-confirmation.com
Sectigo RSA Domain Validation Secure Server CA
2020-10-26 -
2021-10-26
a year crt.sh
*.boldchat.com
GlobalSign Organization Validation CA - SHA256 - G2
2019-02-05 -
2021-04-03
2 years crt.sh
*.digital.medallia.eu
SSL.com RSA SSL subCA
2019-03-30 -
2021-06-27
2 years crt.sh
ydn243.3gateway.net
Entrust Certification Authority - L1K
2019-12-30 -
2020-12-30
a year crt.sh
assets.adobedtm.com
DigiCert SHA2 High Assurance Server CA
2019-10-22 -
2021-10-01
2 years crt.sh
three.co.uk
Entrust Certification Authority - L1M
2020-02-26 -
2021-07-20
a year crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2018-01-09 -
2021-02-12
3 years crt.sh
smetrics.three.co.uk
DigiCert SHA2 High Assurance Server CA
2019-11-19 -
2021-02-16
a year crt.sh
ydn243.dynatrace-managed.com
Let's Encrypt Authority X3
2020-09-12 -
2020-12-11
3 months crt.sh

This page contains 2 frames:

Primary Page: https://my3billing-confirmation.com/log.php
Frame ID: BC8D37A58D9CD25013BF158409622AC4
Requests: 31 HTTP requests in this frame

Frame: https://three.demdex.net/dest5.html?d_nsid=0
Frame ID: D9BA5E8B0BFA3EF19FAA3798EAE62D64
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • script /\/etc.clientlibs\//i

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • script /\/etc.clientlibs\//i

Overall confidence: 100%
Detected patterns
  • script /angular.*\.js/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • script /\/\/assets.adobedtm.com\//i

Page Statistics

32
Requests

100 %
HTTPS

8 %
IPv6

9
Domains

13
Subdomains

11
IPs

5
Countries

380 kB
Transfer

1601 kB
Size

14
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13
  • https://dpm.demdex.net/id?d_visid_ver=4.6.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=382A0C0F53DB50420A490D45%40AdobeOrg&d_nsid=0&ts=1603855906982 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=4.6.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=382A0C0F53DB50420A490D45%40AdobeOrg&d_nsid=0&ts=1603855906982
Request Chain 26
  • https://cm.everesttech.net/cm/dd?d_uuid=35400064363968132413264979393966462637 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5jmIwAAB-N8UlL0

32 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request log.php
my3billing-confirmation.com/
232 KB
30 KB
Document
General
Full URL
https://my3billing-confirmation.com/log.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.119.112 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server269-1.web-hosting.com
Software
Apache / PHP/7.2.34
Resource Hash
8010f642b8afbe9272b3aa7245835a803b66fe56828b52456148729783705951

Request headers

:method
GET
:authority
my3billing-confirmation.com
:scheme
https
:path
/log.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Wed, 28 Oct 2020 03:31:42 GMT
server
Apache
x-powered-by
PHP/7.2.34
vary
Accept-Encoding
content-encoding
gzip
content-length
30312
content-type
text/html; charset=UTF-8
vms.js
vmss.boldchat.com/aid/5021647476238876565/bc.vms4/
52 KB
18 KB
Script
General
Full URL
https://vmss.boldchat.com/aid/5021647476238876565/bc.vms4/vms.js
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
173.199.53.25 , United States, ASN16815 (GOTO-PRIMARY-AS, US),
Reverse DNS
b-app14-09.boldchat.com
Software
BoldChat/8001 /
Resource Hash
5827672e86a62ea986af6eb26247abe6e00e499e8734c3a0d9403ba749c17330
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 28 Oct 2020 03:31:43 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
BoldChat/8001
ETag
"B0F5DDAB513C388A653BF6CAA0729A8D"
P3P
CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM", policyref="http://my.boldchat.com/w3c/p3p.xml"
Cache-Control
max-age=7200, public
Content-Type
text/javascript;charset=UTF-8
Content-Length
17948
cool-2.1.15.min.js
three-resources.digital.medallia.eu/resources/onsite/js/
14 KB
5 KB
Script
General
Full URL
https://three-resources.digital.medallia.eu/resources/onsite/js/cool-2.1.15.min.js
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
0OTdpKixh0SS794XSYeUvg7VD7EDv2Rr
content-encoding
gzip
etag
"80dd5e3be5152c5c72d552c6a26ef6ff"
age
46
via
1.1 varnish
x-cache
HIT
status
200
content-length
5197
x-amz-id-2
KNeVXfvSi3ghwuxkieg8IJuV1zCjvWUY3FDvUeVbmfKPIR6muWoOk0bjZLmMQV45eNE8B6g+FLY=
x-served-by
cache-hhn4038-HHN
last-modified
Sun, 13 Sep 2020 16:38:29 GMT
server
AmazonS3
x-timer
S1603855903.275776,VS0,VE0
date
Wed, 28 Oct 2020 03:31:43 GMT
vary
Accept-Encoding
x-amz-request-id
CC66D5FF4A5EF5C5
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
2
bc.cbhs
cbi.boldchat.com/aid/5021647476238876565/
118 B
388 B
Script
General
Full URL
https://cbi.boldchat.com/aid/5021647476238876565/bc.cbhs?rdid=719453589954395961
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
173.199.53.61 , United States, ASN16815 (GOTO-PRIMARY-AS, US),
Reverse DNS
b-app14-21.boldchat.com
Software
BoldChat/8001 /
Resource Hash
b303134cf6c5a56c05073935cc175954b14f0fffd9d63fbedb6890fb987f1b0a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 28 Oct 2020 03:31:43 GMT
X-Content-Type-Options
nosniff
Server
BoldChat/8001
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-cache,no-store
Content-Length
118
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ruxitagent_ICA2SVfgjqrux_10183200114120852.js
ydn243.3gateway.net/jstag/managed/
169 KB
64 KB
Script
General
Full URL
https://ydn243.3gateway.net/jstag/managed/ruxitagent_ICA2SVfgjqrux_10183200114120852.js
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.50.63.18 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a23-50-63-18.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
dfd57fb164307c86633399fde02350f5d6b10096a8430aa0090ba5a79136fad9

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 28 Oct 2020 03:31:46 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
*
X-Akamai-Staging
EdgeSuite
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
64767
Expires
Wed, 28 Oct 2020 03:31:46 GMT
angular.js
my3billing-confirmation.com/etc.clientlibs/threerebus/clientlibs/
0
0
Script
General
Full URL
https://my3billing-confirmation.com/etc.clientlibs/threerebus/clientlibs/angular.js
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.119.112 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server269-1.web-hosting.com
Software
Apache /
Resource Hash

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
404
date
Wed, 28 Oct 2020 03:31:43 GMT
server
Apache
content-length
315
content-type
text/html; charset=iso-8859-1
launch-8d996b41f31a.min.js
assets.adobedtm.com/acccca982240/2e0aad325f9f/
138 KB
42 KB
Script
General
Full URL
https://assets.adobedtm.com/acccca982240/2e0aad325f9f/launch-8d996b41f31a.min.js
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:390::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
256f575215a524b9f1513465add684ed806e5b04973ef27477470c0af2f57ecb

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 28 Oct 2020 03:31:43 GMT
content-encoding
gzip
last-modified
Mon, 03 Aug 2020 22:32:04 GMT
server
AkamaiNetStorage
status
200
etag
"75a76a7b114eddf0445cffeb25ea92b8:1596493924.818123"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://my3billing-confirmation.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
42812
expires
Wed, 28 Oct 2020 04:31:43 GMT
common-libs.css
new.three.co.uk/etc.clientlibs/threerebus/clientlibs/
319 KB
54 KB
Stylesheet
General
Full URL
https://new.three.co.uk/etc.clientlibs/threerebus/clientlibs/common-libs.css
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.10.130 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a23-8-10-130.deploy.static.akamaitechnologies.com
Software
Rebus /
Resource Hash
01940fcf6e7c4bf34c49d5c980c4b89800344721311f709dc814888cb4f60da8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
53953
X-XSS-Protection
1; mode=block
Last-Modified
Mon, 03 Aug 2020 13:05:05 GMT
Server
Rebus
X-Frame-Options
ALLOW-FROM https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
Date
Wed, 28 Oct 2020 03:31:43 GMT
Vary
Accept-Encoding
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
text/css;charset=utf-8
Access-Control-Allow-Origin
https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
Cache-Control
private, no-cache, no-store, must-revalidate
ETag
"4fd09-5abf8c9892240-gzip"
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding
login-msisdn.js
new.three.co.uk/etc.clientlibs/threerebus/components/content/login-msisdn/
9 KB
3 KB
Script
General
Full URL
https://new.three.co.uk/etc.clientlibs/threerebus/components/content/login-msisdn/login-msisdn.js
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.10.130 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a23-8-10-130.deploy.static.akamaitechnologies.com
Software
Rebus /
Resource Hash
4a293ea11d05b62f4bc6ce22be832dee8db03ac0143b08e04a24097bc0e329e3
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
2136
X-XSS-Protection
1; mode=block
Last-Modified
Mon, 03 Aug 2020 13:05:06 GMT
Server
Rebus
X-Frame-Options
ALLOW-FROM https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
Date
Wed, 28 Oct 2020 03:31:43 GMT
Vary
Accept-Encoding
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
Cache-Control
private, no-cache, no-store, must-revalidate
ETag
"250d-5abf8c9986480-gzip"
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding
embed.js
three-resources.digital.medallia.eu/we/369443/onsite/
2 KB
895 B
Script
General
Full URL
https://three-resources.digital.medallia.eu/we/369443/onsite/embed.js
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4d7b72809f2a7e644c396de734bd7247c3ff5b7b3642ee2a5d9de573a5ccb034

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
e1yFdtMz5e6DX0rXXmie8aO4YH4RJuav
content-encoding
gzip
etag
"785deab112c272e694e0edb729851716"
age
0
via
1.1 varnish
x-cache
HIT
status
200
content-length
673
x-amz-id-2
3yPmJC1cLu0TRwcnf48IwXYOlxOFExeHPnw6h8p+8SWpa4Af6uW257dETD59j0z49T/KBwkYYqQ=
x-served-by
cache-hhn4038-HHN
last-modified
Wed, 14 Oct 2020 09:47:30 GMT
server
AmazonS3
x-timer
S1603855903.343121,VS0,VE478
date
Wed, 28 Oct 2020 03:31:43 GMT
vary
Accept-Encoding
x-amz-request-id
F75728207B691F31
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1
common-ext.js
new.three.co.uk/etc.clientlibs/threerebus/clientlibs/
10 KB
4 KB
Script
General
Full URL
https://new.three.co.uk/etc.clientlibs/threerebus/clientlibs/common-ext.js
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.10.130 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a23-8-10-130.deploy.static.akamaitechnologies.com
Software
Rebus /
Resource Hash
d5bb4df101a2aa9811bff16f5520fe3fff48c151bb576a0fdc332cb3859204d8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
2948
X-XSS-Protection
1; mode=block
Last-Modified
Mon, 03 Aug 2020 13:05:05 GMT
Server
Rebus
X-Frame-Options
ALLOW-FROM https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
Date
Wed, 28 Oct 2020 03:31:43 GMT
Vary
Accept-Encoding
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
Cache-Control
private, no-cache, no-store, must-revalidate
ETag
"2996-5abf8c9892240-gzip"
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding
generic1596534425261.js
three-resources.digital.medallia.eu/we/369443/onsite/
273 KB
60 KB
Script
General
Full URL
https://three-resources.digital.medallia.eu/we/369443/onsite/generic1596534425261.js
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5dae295a3cfab9fde8b6481eb39c766abed3c4b8ee6013a4bbb7420c138043f0

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
azlfi9_wUlexaXVHr9foYxdklB6nbJhQ
content-encoding
gzip
etag
"0324bd2cfd3b431e876c1561387755e5"
age
0
via
1.1 varnish
x-cache
HIT
status
200
content-length
61358
x-amz-id-2
6N0ymHJug5tFRqXP7nasyobfQExeR+AmeTUYe1PWYmbWf47OFPtLJRdOp1SmjJVZm2X5QT3mzJI=
x-served-by
cache-hhn4038-HHN
last-modified
Tue, 04 Aug 2020 09:47:06 GMT
server
AmazonS3
x-timer
S1603855903.343164,VS0,VE430
date
Wed, 28 Oct 2020 03:31:43 GMT
vary
Accept-Encoding
x-amz-request-id
BM3SEG6WFYDM2J8M
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1
angular.js
my3billing-confirmation.com/etc.clientlibs/threerebus/clientlibs/
0
0
Script
General
Full URL
https://my3billing-confirmation.com/etc.clientlibs/threerebus/clientlibs/angular.js
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.119.112 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server269-1.web-hosting.com
Software
Apache /
Resource Hash

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
404
date
Wed, 28 Oct 2020 03:31:46 GMT
server
Apache
content-length
315
content-type
text/html; charset=iso-8859-1
dest5.html
three.demdex.net/ Frame D9BA
0
0
Document
General
Full URL
https://three.demdex.net/dest5.html?d_nsid=0
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.246.49 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-242-246-49.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
three.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://my3billing-confirmation.com/log.php
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://my3billing-confirmation.com/log.php

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Thu, 15 Oct 2020 15:24:40 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
/berpOGIQk4=
Content-Length
2785
Connection
keep-alive
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=4.6.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=382A0C0F53DB50420A490D45%40AdobeOrg&d_nsid=0&ts=1603855906982
  • https://dpm.demdex.net/id/rd?d_visid_ver=4.6.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=382A0C0F53DB50420A490D45%40AdobeOrg&d_nsid=0&ts=1603855906982
364 B
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=4.6.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=382A0C0F53DB50420A490D45%40AdobeOrg&d_nsid=0&ts=1603855906982
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.248.119.134 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-248-119-134.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
8453538e34eb369f3f5b802d3c830f88ed923f17d1bcb760536f9783e2c29c35
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v084-0c0ba0f5b.edge-irl1.demdex.com 5.78.2.20201014153347 2ms (+0ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
yfuCvI80T+s=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://my3billing-confirmation.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
302
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Allow-Origin
https://my3billing-confirmation.com
X-TID
WZG4T3pwQPw=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=4.6.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=382A0C0F53DB50420A490D45%40AdobeOrg&d_nsid=0&ts=1603855906982
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
EXc1a8f6828bba4894a4cf032801a1cbdd-libraryCode_source.min.js
assets.adobedtm.com/acccca982240/2e0aad325f9f/cf9fde6a4e4e/
42 KB
16 KB
Script
General
Full URL
https://assets.adobedtm.com/acccca982240/2e0aad325f9f/cf9fde6a4e4e/EXc1a8f6828bba4894a4cf032801a1cbdd-libraryCode_source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/acccca982240/2e0aad325f9f/launch-8d996b41f31a.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:390::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
fa4f873179c7c6aabf00dba5d4402f2dda5ec3a21c3770802dcca0c7fe79ae29

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 28 Oct 2020 03:31:46 GMT
content-encoding
gzip
last-modified
Mon, 03 Aug 2020 22:32:05 GMT
server
AkamaiNetStorage
status
200
etag
"e8dc1de8aaf2a41a6a36421b911dbd13:1596493925.748245"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://my3billing-confirmation.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
15848
expires
Wed, 28 Oct 2020 04:31:46 GMT
bigcurve.png
new.three.co.uk/content/dam/three-rebus/
4 KB
5 KB
Image
General
Full URL
https://new.three.co.uk/content/dam/three-rebus/bigcurve.png
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.10.130 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a23-8-10-130.deploy.static.akamaitechnologies.com
Software
Rebus /
Resource Hash
6aad606c2cd6490508b374dd4a3300acbdeac4f2ad2375515e2799796e410d71
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=63072000; includeSubdomains;
X-Content-Type-Options
nosniff
Content-Disposition
attachment
Connection
keep-alive
Content-Length
3783
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 03 Jul 2020 07:01:37 GMT
Server
Rebus
Date
Wed, 28 Oct 2020 03:31:47 GMT
X-Frame-Options
ALLOW-FROM https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
Cache-Control
private, no-cache, no-store, must-revalidate
ETag
"ec7-5a9841898d640"
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding
X-Akamai-Path-Stats
[1:380:620],[1:339:4294966957]
smallcurve.png
new.three.co.uk/content/dam/three-rebus/
2 KB
3 KB
Image
General
Full URL
https://new.three.co.uk/content/dam/three-rebus/smallcurve.png
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.10.130 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a23-8-10-130.deploy.static.akamaitechnologies.com
Software
Rebus /
Resource Hash
72ff60e109c168320712f1ae0afee637560f1d828bc74822c817e56f083e9059
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
X-Xss-Protection 1; mode=block

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=63072000; includeSubdomains;
X-Content-Type-Options
nosniff
Content-Disposition
attachment
Connection
keep-alive
Content-Length
2119
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 03 Jul 2020 07:01:37 GMT
Server
Rebus
Date
Wed, 28 Oct 2020 03:31:47 GMT
X-Frame-Options
ALLOW-FROM https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
https://pp.ephapay.net,https://pp.eshapay.net,https://new.three.co.uk,https://three.co.uk,https://three-prod-65.adobecqms.net,https://author-three-prod-65.adobecqms.net,https://author1.prod65.three.adobecqms.net,https://three.marketing.adobe.com
Cache-Control
private, no-cache, no-store, must-revalidate
ETag
"847-5a9841898d640"
Accept-Ranges
bytes
Access-Control-Allow-Headers
X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding
X-Akamai-Path-Stats
[1:318:6682]
__cool.gif
three-udc.digital.medallia.eu/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/
0
133 B
Image
General
Full URL
https://three-udc.digital.medallia.eu/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjEuMTUiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTYwMzg1NTkwNzAyNyIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDEsInVzZXJfaWQiOiAiMTc1NmQ0MmY4ZDE2NzktMDI3NjlmNmM4NzA1OTgtMWIzOTYyNTYtMWQ0YzAwLTE3NTZkNDJmOGQyYjdmIiwiZW52aXJvbWVudCI6ICJwcm9kRXVJcmxhbmQiLCJhY2NvdW50SWQiOiA1NjEzNywidXJsIjogImh0dHBzOi8vbXkzYmlsbGluZy1jb25maXJtYXRpb24uY29tL2xvZy5waHAiLCJ3ZWJzaXRlSWQiOiAzNjk0NDMsImZlZWRiYWNrX3V1aWQiOiBudWxsLCJmb3JtSWQiOiBudWxsLCJmb3JtVHJpZ2dlclR5cGUiOiBudWxsLCJrYW1weWxlX2RhdGEiOiB7Im1kaWdpdGFsX2FsdGVybmF0aXZlX3V1aWQiOiAiYmJhNC0wZDVhLWMwOTAtNGE0Mi04N2MwLTlhZjItMzljZC1iZjI2IiwiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjI0NTYtN2M2ZS05NWZiLTFjZjYtYTg5NS05YzczLTkzYzUtYWRjMCIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjAzODU1OTA3MDE2Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDYxOCwia2FtcHlsZV92ZXJzaW9uIjogIjIuMzMuMiIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuMzMuMiIsImhpc3RvcnlfbGVuZ3RoIjogMiwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTYwMzg1NTkwNzAxOSwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2V9Cl19
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.2.11.v20150529) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-me
prod-instance-gatewayservice-blue-40z9
date
Wed, 28 Oct 2020 03:31:47 GMT
via
1.1 google, 1.1 varnish
age
0
x-cache
MISS
status
200
content-length
0
x-application-context
application:9090
x-served-by
cache-hhn4038-HHN
server
Jetty(9.2.11.v20150529)
x-timer
S1603855907.068183,VS0,VE94
access-control-max-age
1800
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
image/gif; charset=UTF-8
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, Origin, Content-Type, Accept
x-cache-hits
0
__cool.gif
three-udc.digital.medallia.eu/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/
0
348 B
Image
General
Full URL
https://three-udc.digital.medallia.eu/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjEuMTUiLCJldmVudF9uYW1lIjogIm5lYnVsYV9pbml0X3VzZXJfaWRlbnRpZmllciIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNjAzODU1OTA3MDI4IiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMSwidXNlcl9pZCI6ICIxNzU2ZDQyZjhkMTY3OS0wMjc2OWY2Yzg3MDU5OC0xYjM5NjI1Ni0xZDRjMDAtMTc1NmQ0MmY4ZDJiN2YiLCJlbnZpcm9tZW50IjogInByb2RFdUlybGFuZCIsImFjY291bnRJZCI6IDU2MTM3LCJ1cmwiOiAiaHR0cHM6Ly9teTNiaWxsaW5nLWNvbmZpcm1hdGlvbi5jb20vbG9nLnBocCIsIndlYnNpdGVJZCI6IDM2OTQ0MywiZmVlZGJhY2tfdXVpZCI6IG51bGwsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsibWRpZ2l0YWxfYWx0ZXJuYXRpdmVfdXVpZCI6ICJiYmE0LTBkNWEtYzA5MC00YTQyLTg3YzAtOWFmMi0zOWNkLWJmMjYiLCJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiMjQ1Ni03YzZlLTk1ZmItMWNmNi1hODk1LTljNzMtOTNjNS1hZGMwIiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE2MDM4NTU5MDcwMTYiLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogNjE4LCJrYW1weWxlX3ZlcnNpb24iOiAiMi4zMy4yIiwib25zaXRlX3ZlcnNpb24iOiAiMi4zMy4yIiwiaGlzdG9yeV9sZW5ndGgiOiAyLCJldmVudF9sb2NhbF90aW1lc3RhbXAiOiAxNjAzODU1OTA3MDIxLCJwb3NpdGlvbiI6IG51bGwsImlzVXNlcklkZW50aWZpZWQiOiBmYWxzZX0KXX0=
Requested by
Host: my3billing-confirmation.com
URL: https://my3billing-confirmation.com/log.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.2.11.v20150529) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-me
prod-instance-gatewayservice-blue-q6wg
date
Wed, 28 Oct 2020 03:31:47 GMT
via
1.1 google, 1.1 varnish
age
0
x-cache
MISS
status
200
content-length
0
x-application-context
application:9090
x-served-by
cache-hhn4038-HHN
server
Jetty(9.2.11.v20150529)
x-timer
S1603855907.068210,VS0,VE93
access-control-max-age
1800
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
image/gif; charset=UTF-8
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, Origin, Content-Type, Accept
x-cache-hits
0
RCd754052954404a6a86ca2f35878d8df4-source.min.js
assets.adobedtm.com/acccca982240/2e0aad325f9f/cf9fde6a4e4e/
8 KB
2 KB
Script
General
Full URL
https://assets.adobedtm.com/acccca982240/2e0aad325f9f/cf9fde6a4e4e/RCd754052954404a6a86ca2f35878d8df4-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/acccca982240/2e0aad325f9f/launch-8d996b41f31a.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:390::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
ef330c5545b5f5284edc84de67129356e7e4abfebdb922a4e3186850c195e72b

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 28 Oct 2020 03:31:47 GMT
content-encoding
gzip
last-modified
Mon, 03 Aug 2020 22:32:05 GMT
server
AkamaiNetStorage
status
200
etag
"e8dc1de8aaf2a41a6a36421b911dbd13:1596493925.748245"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://my3billing-confirmation.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
1276
expires
Wed, 28 Oct 2020 04:31:47 GMT
RC7af658fbe1574fe8a87a874241d1e0ef-source.min.js
assets.adobedtm.com/acccca982240/2e0aad325f9f/cf9fde6a4e4e/
9 KB
1 KB
Script
General
Full URL
https://assets.adobedtm.com/acccca982240/2e0aad325f9f/cf9fde6a4e4e/RC7af658fbe1574fe8a87a874241d1e0ef-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/acccca982240/2e0aad325f9f/launch-8d996b41f31a.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:390::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
30263136cfdb38125e686f1a2b5e6c679aef95a3501641188954a0c270737264

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 28 Oct 2020 03:31:47 GMT
content-encoding
gzip
last-modified
Mon, 03 Aug 2020 22:32:05 GMT
server
AkamaiNetStorage
status
200
etag
"e8dc1de8aaf2a41a6a36421b911dbd13:1596493925.748245"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://my3billing-confirmation.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
1213
expires
Wed, 28 Oct 2020 04:31:47 GMT
RC6ee51615be614930a6f24c5de33aae65-source.min.js
assets.adobedtm.com/acccca982240/2e0aad325f9f/cf9fde6a4e4e/
13 KB
1 KB
Script
General
Full URL
https://assets.adobedtm.com/acccca982240/2e0aad325f9f/cf9fde6a4e4e/RC6ee51615be614930a6f24c5de33aae65-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/acccca982240/2e0aad325f9f/launch-8d996b41f31a.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:390::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
247acb56c4e089c1f73fadba9b4d5c69bbe16a80fc4b1a7541d46e736e56f54d

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 28 Oct 2020 03:31:47 GMT
content-encoding
gzip
last-modified
Mon, 03 Aug 2020 22:32:05 GMT
server
AkamaiNetStorage
status
200
etag
"e8dc1de8aaf2a41a6a36421b911dbd13:1596493925.748245"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://my3billing-confirmation.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
1196
expires
Wed, 28 Oct 2020 04:31:47 GMT
RC86a15296833945d39ff091385ef9b546-source.min.js
assets.adobedtm.com/acccca982240/2e0aad325f9f/cf9fde6a4e4e/
15 KB
2 KB
Script
General
Full URL
https://assets.adobedtm.com/acccca982240/2e0aad325f9f/cf9fde6a4e4e/RC86a15296833945d39ff091385ef9b546-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/acccca982240/2e0aad325f9f/launch-8d996b41f31a.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:390::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
c4921fbdacfd977226de3a15015f0d821a20dec83343ea5fbf7fee109992d971

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 28 Oct 2020 03:31:47 GMT
content-encoding
gzip
last-modified
Mon, 03 Aug 2020 22:32:05 GMT
server
AkamaiNetStorage
status
200
etag
"e8dc1de8aaf2a41a6a36421b911dbd13:1596493925.748245"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://my3billing-confirmation.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
1969
expires
Wed, 28 Oct 2020 04:31:47 GMT
RCe344ff814a3b4f9f97cef16997b3fd12-source.min.js
assets.adobedtm.com/acccca982240/2e0aad325f9f/cf9fde6a4e4e/
15 KB
2 KB
Script
General
Full URL
https://assets.adobedtm.com/acccca982240/2e0aad325f9f/cf9fde6a4e4e/RCe344ff814a3b4f9f97cef16997b3fd12-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/acccca982240/2e0aad325f9f/launch-8d996b41f31a.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:390::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
cf6052aaf9bc72cb4d6e2887a1974826b13c5a314147e469e862675b94fa2ea7

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 28 Oct 2020 03:31:47 GMT
content-encoding
gzip
last-modified
Mon, 03 Aug 2020 22:32:05 GMT
server
AkamaiNetStorage
status
200
etag
"e8dc1de8aaf2a41a6a36421b911dbd13:1596493925.748245"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://my3billing-confirmation.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
1640
expires
Wed, 28 Oct 2020 04:31:47 GMT
generic1602668849507.js
three-resources.digital.medallia.eu/we/369443/onsite/
273 KB
60 KB
Script
General
Full URL
https://three-resources.digital.medallia.eu/we/369443/onsite/generic1602668849507.js
Requested by
Host: three-resources.digital.medallia.eu
URL: https://three-resources.digital.medallia.eu/we/369443/onsite/embed.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3dc07ada47073a28bb5b401747f071cd07e631ba816a8992cdd8dcadfc78bb85

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
qmNHnGW1e2E3OBHxv7qUodSwDTfYgXqo
content-encoding
gzip
etag
"dfaccebc0d8adcbca84d1d8bd6c6f90f"
age
0
via
1.1 varnish
x-cache
HIT
status
200
content-length
61423
x-amz-id-2
rc2glWzkGDqp3STUBxsaSHs1R7dkn+KiCWuJCGGqb7RkPvrQ4lr/5hOD9gvL/5Il8tt/+KjXYzU=
x-served-by
cache-hhn4038-HHN
last-modified
Wed, 14 Oct 2020 09:47:30 GMT
server
AmazonS3
x-timer
S1603855907.244247,VS0,VE444
date
Wed, 28 Oct 2020 03:31:47 GMT
vary
Accept-Encoding
x-amz-request-id
6W1P6RFY7M6KBKCP
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1
id
smetrics.three.co.uk/
48 B
517 B
XHR
General
Full URL
https://smetrics.three.co.uk/id?d_visid_ver=4.6.0&d_fieldgroup=A&mcorgid=382A0C0F53DB50420A490D45%40AdobeOrg&mid=35429121131473794843262255016593056264&ts=1603855907283
Requested by
Host: ydn243.3gateway.net
URL: https://ydn243.3gateway.net/jstag/managed/ruxitagent_ICA2SVfgjqrux_10183200114120852.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.237.136.106 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-136-106.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
037d60baf2cc5f90507943f1cb5758fcd69e884db2ef9f6cc400f3e5d11e867f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

status
200
date
Wed, 28 Oct 2020 03:31:47 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-f7bfdfcfd-gv44j
vary
Origin
x-c
master-1404.I1e61f9.M0-468
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://my3billing-confirmation.com
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-javascript;charset=utf-8
content-length
48
x-xss-protection
1; mode=block
ibs:dpid=411&dpuuid=X5jmIwAAB-N8UlL0
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=35400064363968132413264979393966462637
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5jmIwAAB-N8UlL0
42 B
915 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5jmIwAAB-N8UlL0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.248.119.134 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-248-119-134.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v084-05e870d90.edge-irl1.demdex.com 5.78.2.20201014153347 0ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-TID
7+aFRBV5SEQ=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date
Wed, 28 Oct 2020 03:31:46 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5jmIwAAB-N8UlL0
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
__cool.gif
three-udc.digital.medallia.eu/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/
0
93 B
Image
General
Full URL
https://three-udc.digital.medallia.eu/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjEuMTUiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTYwMzg1NTkwNzczMSIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDEsInVzZXJfaWQiOiAiMTc1NmQ0MmY4ZDE2NzktMDI3NjlmNmM4NzA1OTgtMWIzOTYyNTYtMWQ0YzAwLTE3NTZkNDJmOGQyYjdmIiwiZW52aXJvbWVudCI6ICJwcm9kRXVJcmxhbmQiLCJhY2NvdW50SWQiOiA1NjEzNywidXJsIjogImh0dHBzOi8vbXkzYmlsbGluZy1jb25maXJtYXRpb24uY29tL2xvZy5waHAiLCJ3ZWJzaXRlSWQiOiAzNjk0NDMsImZlZWRiYWNrX3V1aWQiOiBudWxsLCJmb3JtSWQiOiBudWxsLCJmb3JtVHJpZ2dlclR5cGUiOiBudWxsLCJrYW1weWxlX2RhdGEiOiB7Im1kaWdpdGFsX2FsdGVybmF0aXZlX3V1aWQiOiAiYmJhNC0wZDVhLWMwOTAtNGE0Mi04N2MwLTlhZjItMzljZC1iZjI2IiwiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjI0NTYtN2M2ZS05NWZiLTFjZjYtYTg5NS05YzczLTkzYzUtYWRjMCIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjAzODU1OTA3NzI4Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDk5MSwia2FtcHlsZV92ZXJzaW9uIjogIjIuMzQuMCIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuMzQuMCIsImhpc3RvcnlfbGVuZ3RoIjogMiwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTYwMzg1NTkwNzczMSwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2V9Cl19
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.2.11.v20150529) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-me
prod-instance-gatewayservice-blue-knv9
date
Wed, 28 Oct 2020 03:31:47 GMT
via
1.1 google, 1.1 varnish
age
0
x-cache
MISS
status
200
content-length
0
x-application-context
application:9090
x-served-by
cache-hhn4038-HHN
server
Jetty(9.2.11.v20150529)
x-timer
S1603855908.756484,VS0,VE93
access-control-max-age
1800
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
image/gif; charset=UTF-8
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, Origin, Content-Type, Accept
x-cache-hits
0
__cool.gif
three-udc.digital.medallia.eu/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/
0
345 B
Image
General
Full URL
https://three-udc.digital.medallia.eu/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjEuMTUiLCJldmVudF9uYW1lIjogIm5lYnVsYV9pbml0X3VzZXJfaWRlbnRpZmllciIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNjAzODU1OTA3NzM0IiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMSwidXNlcl9pZCI6ICIxNzU2ZDQyZjhkMTY3OS0wMjc2OWY2Yzg3MDU5OC0xYjM5NjI1Ni0xZDRjMDAtMTc1NmQ0MmY4ZDJiN2YiLCJlbnZpcm9tZW50IjogInByb2RFdUlybGFuZCIsImFjY291bnRJZCI6IDU2MTM3LCJ1cmwiOiAiaHR0cHM6Ly9teTNiaWxsaW5nLWNvbmZpcm1hdGlvbi5jb20vbG9nLnBocCIsIndlYnNpdGVJZCI6IDM2OTQ0MywiZmVlZGJhY2tfdXVpZCI6IG51bGwsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsibWRpZ2l0YWxfYWx0ZXJuYXRpdmVfdXVpZCI6ICJiYmE0LTBkNWEtYzA5MC00YTQyLTg3YzAtOWFmMi0zOWNkLWJmMjYiLCJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiMjQ1Ni03YzZlLTk1ZmItMWNmNi1hODk1LTljNzMtOTNjNS1hZGMwIiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE2MDM4NTU5MDc3MjgiLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogOTkxLCJrYW1weWxlX3ZlcnNpb24iOiAiMi4zNC4wIiwib25zaXRlX3ZlcnNpb24iOiAiMi4zNC4wIiwiaGlzdG9yeV9sZW5ndGgiOiAyLCJldmVudF9sb2NhbF90aW1lc3RhbXAiOiAxNjAzODU1OTA3NzM0LCJwb3NpdGlvbiI6IG51bGwsImlzVXNlcklkZW50aWZpZWQiOiBmYWxzZX0KXX0=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.2.11.v20150529) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-me
prod-instance-gatewayservice-blue-4n0d
date
Wed, 28 Oct 2020 03:31:47 GMT
via
1.1 google, 1.1 varnish
age
0
x-cache
MISS
status
200
content-length
0
x-application-context
application:9090
x-served-by
cache-hhn4038-HHN
server
Jetty(9.2.11.v20150529)
x-timer
S1603855908.756478,VS0,VE93
access-control-max-age
1800
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
image/gif; charset=UTF-8
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
X-Requested-With, Origin, Content-Type, Accept
x-cache-hits
0
7769d5cf-5b9b-4a61-a4b5-3ea28784f993
ydn243.3gateway.net/bf/
778 B
1 KB
XHR
General
Full URL
https://ydn243.3gateway.net/bf/7769d5cf-5b9b-4a61-a4b5-3ea28784f993?dtCookie=-11%24PVKMOKPK9I5OMSPKCO1NBAJH2SDRORM7;dtLatC=200;referer=https%3A%2F%2Fmy3billing-confirmation.com%2Flog.php;visitID=TSTWPWXKJXDURUYTIPETTJUWBZNWXTNC;app=8f769d29e3086f78;end=1
Requested by
Host: ydn243.3gateway.net
URL: https://ydn243.3gateway.net/jstag/managed/ruxitagent_ICA2SVfgjqrux_10183200114120852.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.50.63.18 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
a23-50-63-18.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fd51ec1d14701bd2713bf7b507a877a4379705d54b979b688016a59639fe03c6

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 28 Oct 2020 03:31:51 GMT
Content-Type
text/plain;charset=utf-8
Access-Control-Allow-Origin
https://my3billing-confirmation.com
X-Akamai-Staging
EdgeSuite
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
778
Expires
Wed, 28 Oct 2020 03:31:51 GMT
7769d5cf-5b9b-4a61-a4b5-3ea28784f993
ydn243.dynatrace-managed.com/bf/
778 B
986 B
XHR
General
Full URL
https://ydn243.dynatrace-managed.com:9999/bf/7769d5cf-5b9b-4a61-a4b5-3ea28784f993?dtCookie=6%24PVKMOKPK9I5OMSPKCO1NBAJH2SDRORM7%7C8f769d29e3086f78%7C1;dtLatC=883;referer=https%3A%2F%2Fmy3billing-confirmation.com%2Flog.php;visitID=TSTWPWXKJXDURUYTIPETTJUWBZNWXTNC;app=8f769d29e3086f78;end=1
Requested by
Host: ydn243.3gateway.net
URL: https://ydn243.3gateway.net/jstag/managed/ruxitagent_ICA2SVfgjqrux_10183200114120852.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.169.7.127 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
c0b215c70a2d65c1cd8e02b1ec306832ab4af535ccea4df43026fd7564d6201e

Request headers

Referer
https://my3billing-confirmation.com/log.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin
https://my3billing-confirmation.com
Date
Wed, 28 Oct 2020 03:31:51 GMT
Cache-Control
no-cache
Content-Length
778
Content-Type
text/plain;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Three UK (Telecommunication)

88 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| bt_showChatHTML boolean| bt_chatAvailable object| _bcvmc object| bc object| _bcvmw object| _bcvmf object| _bcvmb object| _bcvmt boolean| bcLoaded object| _bcvm object| pageViewer object| _bcvma object| _bcct object| dT_ object| dtrum string| _logoutURL string| _anoUrl string| _naAg string| _c2p boolean| _oBEnb string| _dLURL string| _cpPrm function| loader function| showErrorBlock string| coreRegistrationUrl string| coreDomainURL string| coreLoginURL function| DataLayer function| updateDataLayer function| getLS undefined| pn undefined| pnParts function| toCamelCase function| postAnalyticsData function| postErrorAnalytics undefined| custID undefined| tempPageName undefined| appPromo undefined| crdCont undefined| vlcCont undefined| login undefined| berrB object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in object| KAMPYLE_EMBED string| KAMPYLE_REVISION object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| MDIGITAL_OnPrem object| KAMPYLE_COOLADATA object| KAMPYLE_COMMON object| KAMPYLE_THERMO_TEALEAF_FUNC object| KAMPYLE_ADOBE_ANALYTICS object| KAMPYLE_CLICKTALE_FUNC object| KAMPYLE_SESSIONCAM object| KAMPYLE_SCREEN_CAPTURE object| KAMPYLE_ONSITE_SDK undefined| KAMPYLE_POLYFILLS object| KAMPYLE_INTEGRATION object| cooladata function| s_getLoadTime function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq string| s_account string| domainName object| s number| s_loadT number| s_objectID number| s_giq

14 Cookies

Domain/Path Name / Value
.demdex.net/ Name: demdex
Value: 35400064363968132413264979393966462637
my3billing-confirmation.com/ Name: dtPC
Value: -11$55906630_23h39vTSTWPWXKJXDURUYTIPETTJUWBZNWXTNC
my3billing-confirmation.com/ Name: kampyleSessionPageCounter
Value: 1
my3billing-confirmation.com/ Name: kampyleUserSessionsCount
Value: 1
my3billing-confirmation.com/ Name: dtSa
Value: -
my3billing-confirmation.com/ Name: kampyle_userid
Value: 2456-7c6e-95fb-1cf6-a895-9c73-93c5-adc0
.my3billing-confirmation.com/ Name: AMCV_382A0C0F53DB50420A490D45%40AdobeOrg
Value: -408604571%7CMCIDTS%7C18564%7CvVersion%7C4.6.0
.my3billing-confirmation.com/ Name: cd_user_id
Value: 1756d42f8d1679-02769f6c870598-1b396256-1d4c00-1756d42f8d2b7f
my3billing-confirmation.com/ Name: rxvt
Value: 1603857707227|1603855906634
my3billing-confirmation.com/ Name: mdigital_alternative_uuid
Value: bba4-0d5a-c090-4a42-87c0-9af2-39cd-bf26
my3billing-confirmation.com/ Name: kampyleUserSession
Value: 1603855907016
my3billing-confirmation.com/ Name: dtCookie
Value: -11$PVKMOKPK9I5OMSPKCO1NBAJH2SDRORM7
my3billing-confirmation.com/ Name: dtLatC
Value: 200
my3billing-confirmation.com/ Name: rxVisitor
Value: 1603855906633HGGU9FED1VJI6S83NMERQLQC68JUHMP3

3 Console Messages

Source Level URL
Text
console-api error URL: https://three-resources.digital.medallia.eu/resources/onsite/js/cool-2.1.15.min.js(Line 13)
Message:
Cooladata error: 'cooladata' object not initialized. Ensure you are using the latest version of the Cooladata JS Library along with the snippet we provide.
console-api log URL: https://new.three.co.uk/etc.clientlibs/threerebus/clientlibs/common-ext.js(Line 173)
Message:
Invalid parameters[objName;key;value]
console-api log URL: https://three-resources.digital.medallia.eu/resources/onsite/js/cool-2.1.15.min.js(Line 13)
Message:
You must name your new library: init(token, config, name)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
cbi.boldchat.com
cm.everesttech.net
dpm.demdex.net
my3billing-confirmation.com
new.three.co.uk
smetrics.three.co.uk
three-resources.digital.medallia.eu
three-udc.digital.medallia.eu
three.demdex.net
vmss.boldchat.com
ydn243.3gateway.net
ydn243.dynatrace-managed.com
15.237.136.106
151.101.194.133
173.199.53.25
173.199.53.61
198.54.119.112
23.50.63.18
23.8.10.130
2a02:26f0:eb:390::1e80
34.242.246.49
34.248.119.134
52.169.7.127
66.117.28.86
01940fcf6e7c4bf34c49d5c980c4b89800344721311f709dc814888cb4f60da8
037d60baf2cc5f90507943f1cb5758fcd69e884db2ef9f6cc400f3e5d11e867f
247acb56c4e089c1f73fadba9b4d5c69bbe16a80fc4b1a7541d46e736e56f54d
256f575215a524b9f1513465add684ed806e5b04973ef27477470c0af2f57ecb
30263136cfdb38125e686f1a2b5e6c679aef95a3501641188954a0c270737264
3dc07ada47073a28bb5b401747f071cd07e631ba816a8992cdd8dcadfc78bb85
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
4a293ea11d05b62f4bc6ce22be832dee8db03ac0143b08e04a24097bc0e329e3
4d7b72809f2a7e644c396de734bd7247c3ff5b7b3642ee2a5d9de573a5ccb034
5827672e86a62ea986af6eb26247abe6e00e499e8734c3a0d9403ba749c17330
5dae295a3cfab9fde8b6481eb39c766abed3c4b8ee6013a4bbb7420c138043f0
6aad606c2cd6490508b374dd4a3300acbdeac4f2ad2375515e2799796e410d71
72ff60e109c168320712f1ae0afee637560f1d828bc74822c817e56f083e9059
8010f642b8afbe9272b3aa7245835a803b66fe56828b52456148729783705951
8453538e34eb369f3f5b802d3c830f88ed923f17d1bcb760536f9783e2c29c35
b303134cf6c5a56c05073935cc175954b14f0fffd9d63fbedb6890fb987f1b0a
c0b215c70a2d65c1cd8e02b1ec306832ab4af535ccea4df43026fd7564d6201e
c4921fbdacfd977226de3a15015f0d821a20dec83343ea5fbf7fee109992d971
cf6052aaf9bc72cb4d6e2887a1974826b13c5a314147e469e862675b94fa2ea7
d5bb4df101a2aa9811bff16f5520fe3fff48c151bb576a0fdc332cb3859204d8
dfd57fb164307c86633399fde02350f5d6b10096a8430aa0090ba5a79136fad9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef330c5545b5f5284edc84de67129356e7e4abfebdb922a4e3186850c195e72b
fa4f873179c7c6aabf00dba5d4402f2dda5ec3a21c3770802dcca0c7fe79ae29
fd51ec1d14701bd2713bf7b507a877a4379705d54b979b688016a59639fe03c6