urlscan.io logo urlscan.io
SecurityTrails logo

heeriosd8.df.casf.jhsfqwe.cf Open in urlscan Pro
198.23.159.66  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://heeriosd8.df.casf.jhsfqwe.cf/
Effective URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Submission: On October 16 via automatic, source phishtank
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 14 IPs in 3 countries across 13 domains to perform 44 HTTP transactions. The main IP is 198.23.159.66, located in Buffalo, United States and belongs to AS-COLOCROSSING - ColoCrossing, US. The main domain is heeriosd8.df.casf.jhsfqwe.cf.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 16th 2019. Valid for: 3 months.
This is the only time heeriosd8.df.casf.jhsfqwe.cf was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
2 5 198.23.159.66 36352 (AS-COLOCR...)
17 144.160.36.70 797 (AMERITECH-AS)
1 69.168.96.158 36271 (SYNACOR-C...)
5 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
4 172.217.23.98 15169 (GOOGLE)
1 143.204.98.143 16509 (AMAZON-02)
1 54.156.176.154 14618 (AMAZON-AES)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
2 206.17.25.188 7018 (ATT-INTER...)
44 14
5    198.23.159.66 (Buffalo, United States)

ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
PTR: wgh17.whogohost.com
heeriosd8.df.casf.jhsfqwe.cf
17    144.160.36.70 (United States)

ASN797 (AMERITECH-AS - AT&T Services, Inc., US)
home.secureapp.att.net
1    69.168.96.158 (United States)

ASN36271 (SYNACOR-CLUSTER - Synacor, Inc., US)
sadlib.static-app.synacor.com
5    2a02:26f0:6c00:19f::2db1 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
www.att.com
3    2a00:1450:4001:817::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagservices.com
pagead2.googlesyndication.com
1    2a00:1450:4001:825::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.de
1    2a00:1450:4001:81a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.com
4    172.217.23.98 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s45-in-f2.1e100.net
securepubads.g.doubleclick.net
1    143.204.98.143 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-98-143.fra50.r.cloudfront.net
d2oh4tlt9mrke9.cloudfront.net
1    54.156.176.154 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-156-176-154.compute-1.amazonaws.com
ws.sessioncam.com
2    2a00:1450:4001:825::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
tpc.googlesyndication.com
3    2a00:1450:4001:821::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
cdn.ampproject.org
2    206.17.25.188 (United States)

ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US)
att.inq.com
Domain Requested by
17 home.secureapp.att.net heeriosd8.df.casf.jhsfqwe.cf
home.secureapp.att.net
5 www.att.com heeriosd8.df.casf.jhsfqwe.cf
www.att.com
5 heeriosd8.df.casf.jhsfqwe.cf 2 redirects heeriosd8.df.casf.jhsfqwe.cf
att.inq.com
4 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
heeriosd8.df.casf.jhsfqwe.cf
3 cdn.ampproject.org securepubads.g.doubleclick.net
2 att.inq.com www.att.com
att.inq.com
2 tpc.googlesyndication.com securepubads.g.doubleclick.net
heeriosd8.df.casf.jhsfqwe.cf
2 pagead2.googlesyndication.com securepubads.g.doubleclick.net
1 ws.sessioncam.com d2oh4tlt9mrke9.cloudfront.net
1 d2oh4tlt9mrke9.cloudfront.net www.att.com
1 adservice.google.com www.googletagservices.com
1 adservice.google.de www.googletagservices.com
1 www.googletagservices.com sadlib.static-app.synacor.com
1 sadlib.static-app.synacor.com heeriosd8.df.casf.jhsfqwe.cf
44 14

This site contains links to these domains. Also see Links.

Domain
www.att.net
www.att.com
uverseonline.att.net
elportal.att.net
attreg.att.net
Subject Issuer Validity Valid
asgedfcqwvq.jhsfqwe.cf
Let's Encrypt Authority X3		 2019-10-16 -
2020-01-14		 3 months crt.sh
home.secureapp.att.net
DigiCert SHA2 Secure Server CA		 2018-09-17 -
2020-09-17		 2 years crt.sh
*.static-app.synacor.com
DigiCert SHA2 High Assurance Server CA		 2019-08-05 -
2021-08-25		 2 years crt.sh
*.att.com
DigiCert SHA2 Secure Server CA		 2019-01-09 -
2020-02-05		 a year crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2019-10-03 -
2019-12-26		 3 months crt.sh
*.google.com
GTS CA 1O1		 2019-10-03 -
2019-12-26		 3 months crt.sh
*.cloudfront.net
DigiCert Global CA G2		 2019-07-17 -
2020-07-05		 a year crt.sh
ws.sessioncam.com
Amazon		 2019-05-14 -
2020-06-14		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1O1		 2019-09-17 -
2019-12-10		 3 months crt.sh
misc-sni.google.com
GTS CA 1O1		 2019-09-17 -
2019-12-10		 3 months crt.sh
*.inq.com
GeoTrust RSA CA 2018		 2018-02-14 -
2019-12-01		 2 years crt.sh

This page contains 3 frames:

Primary Page: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Frame ID: E6E41415C8EF15267B85DCC6506E61CE
Requests: 38 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js
Frame ID: A35D0E37C31CE43BC1716B50F9549B9C
Requests: 6 HTTP requests in this frame

Frame: https://heeriosd8.df.casf.jhsfqwe.cf/inqChat.html?IFRAME
Frame ID: 9940AAE8A0AB2494609E2536B1963940
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://heeriosd8.df.casf.jhsfqwe.cf/ HTTP 302
    https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d HTTP 301
    https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i
Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i
Overall confidence: 100%
Detected patterns
  • html /<img[^>]+id="DCSIMG"[^>]+webtrends/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

44
Requests

100 %
HTTPS

46 %
IPv6

13
Domains

14
Subdomains

14
IPs

3
Countries

904 kB
Transfer

2414 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://heeriosd8.df.casf.jhsfqwe.cf/ HTTP 302
    https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d HTTP 301
    https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

44 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Redirect Chain
  • https://heeriosd8.df.casf.jhsfqwe.cf/
  • https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d
  • https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
8 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.23.159.66 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS
wgh17.whogohost.com
Software
Apache / PHP/7.0.33
Resource Hash
ba137ccbea3ce6b2fa1a0db924782ea2a42597b4d196aa2b8ab7628580330c9c

Request headers

Host
heeriosd8.df.casf.jhsfqwe.cf
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

Date
Wed, 16 Oct 2019 21:55:10 GMT
Server
Apache
X-Powered-By
PHP/7.0.33
Keep-Alive
timeout=5, max=98
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Wed, 16 Oct 2019 21:55:09 GMT
Server
Apache
Location
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Content-Length
278
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
_fontface.css
home.secureapp.att.net/css/sso/slid/1201/ 		0
960 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/css/sso/slid/1201/_fontface.css
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:10 GMT
ETag
"bc105c-0-56dfc1864d200"
Last-Modified
Wed, 06 Jun 2018 16:59:52 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
text/css
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
0
X-XSS-Protection
1; mode=block
main.css
home.secureapp.att.net/css/sso/slid/1201/ 		28 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
dfa2be020e3374a4b1c871c88ada990120fb198d4e8ff685ad35cfae88ad3466
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:10 GMT
ETag
"bc1054-6fd5-56dfc18464d80"
Last-Modified
Wed, 06 Jun 2018 16:59:50 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
text/css
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
28629
X-XSS-Protection
1; mode=block
jquery-1.5.1.min.js
home.secureapp.att.net/js/jquery/ 		83 KB
84 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:10 GMT
ETag
"ba19b5-14d0c-56dfbf4cf52c0"
Last-Modified
Wed, 06 Jun 2018 16:49:55 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
application/x-javascript
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
85260
X-XSS-Protection
1; mode=block
jquery.simplemodal.js
home.secureapp.att.net/js/jquery/simplemodal/ 		9 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/js/jquery/simplemodal/jquery.simplemodal.js
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
70b5a6613f03d3c015d826185e39839e6dbc2d03871f151bafbed5cc58503f69
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:10 GMT
ETag
"bc0fc0-24fd-56dfbf5772b80"
Last-Modified
Wed, 06 Jun 2018 16:50:06 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
application/x-javascript
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
9469
X-XSS-Protection
1; mode=block
script.js
home.secureapp.att.net/js/sso/slid/1201/ 		51 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/js/sso/slid/1201/script.js
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
dfa500e779f15487f52ea052877afcf802c746984cc7049d3155c0b64338aca1
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:10 GMT
ETag
"bc0002-cc01-591a18d3e8440"
Last-Modified
Tue, 03 Sep 2019 08:05:29 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
application/x-javascript
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
52225
X-XSS-Protection
1; mode=block
att.js
sadlib.static-app.synacor.com/client/att/ 		72 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sadlib.static-app.synacor.com/client/att/att.js
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
69.168.96.158 , United States, ASN36271 (SYNACOR-CLUSTER - Synacor, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
3d03f2e6b365a99b3049cf1aa58ca138858d504e18fa0ade45d66c47187624e1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:10 GMT
Content-Encoding
gzip
Age
0
P3P
CP="ALL DSP COR TAIa PSAa PSDa IVAa IVDa CONi OUR IND UNI"
Connection
keep-alive
Content-Length
19656
Access-Control-Allow-Origin
*
Last-Modified
Wed, 16 Oct 2019 19:16:45 GMT
Server
nginx
ETag
"12039-5950bf10ea140"
Vary
Accept-Encoding
X-Varnish
991846371
Via
1.1 varnish
Cache-Control
max-age=300
Accept-Ranges
bytes
Content-Type
text/javascript
Expires
Wed, 16 Oct 2019 22:00:10 GMT
satelliteLib-bee1ce9b89e943a46b1dfd167adc564fe75eef37.js
www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/ 		597 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/satelliteLib-bee1ce9b89e943a46b1dfd167adc564fe75eef37.js
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:19f::2db1 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
54ced81b0b35df5aa9e8d182c4a75f1de8c9cff14bcd3d897cf0caf25f8c5648
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; preload

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 21:55:10 GMT
content-encoding
gzip
vary
Accept-Encoding
status
200
uxtime
Xadya3Q7IiX@mGtzMrasJAAAABM D=60910
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
89949
last-modified
Wed, 16 Oct 2019 17:26:30 GMT
server
Apache
etag
"953bc-5950a66c5bd80-gzip"
strict-transport-security
max-age=15768000 ; preload
content-type
application/javascript
cache-control
max-age=900
accept-ranges
bytes
x-datastream-cache-status
1
expires
Wed, 16 Oct 2019 22:10:10 GMT
Button.png
home.secureapp.att.net/design/CDLS10/img/logos/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/CDLS10/img/logos/Button.png
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
8e6ec1efd720fba57823309829b05bb57ebb5716c813c88b3c88cf36ab9aa5e9
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:10 GMT
ETag
"c00864-9a2-583d5a2f82f40"
Last-Modified
Mon, 11 Mar 2019 18:21:09 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
image/png
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
2466
X-XSS-Protection
1; mode=block
AT&T_logo.png
home.secureapp.att.net/design/CDLS10/img/logos/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/CDLS10/img/logos/AT&T_logo.png
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
a8c89bb3937cdc4a70b3568eae5a390d918433be78f89deba07846932ae7c695
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:11 GMT
ETag
"b2081e-d37-583d5a2e8ed00"
Last-Modified
Mon, 11 Mar 2019 18:21:08 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
image/png
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
3383
X-XSS-Protection
1; mode=block
mobile.css
home.secureapp.att.net/css/sso/slid/1201/ 		4 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/css/sso/slid/1201/mobile.css
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
30a949cc26cd4f709fa897313f8d448b2cb724a40a170c4b8e8ce6b3aa890fd1
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:11 GMT
ETag
"bc105b-fa3-56dfc1864d200"
Last-Modified
Wed, 06 Jun 2018 16:59:52 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
text/css
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
4003
X-XSS-Protection
1; mode=block
gpt.js
www.googletagservices.com/tag/js/ 		45 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: sadlib.static-app.synacor.com
URL: https://sadlib.static-app.synacor.com/client/att/att.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
eed2b7b85bfd84ebdcda3f2d24b5b4566dc77d0340efb27b20e00a5b6085af2e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 21:55:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"309 / 550 of 1000 / last-modified: 1571261169"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14547
x-xss-protection
0
expires
Wed, 16 Oct 2019 21:55:11 GMT
webtrends.min.js
heeriosd8.df.casf.jhsfqwe.cf/commonLogin/igate_edam/staticContent/images/SLID/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://heeriosd8.df.casf.jhsfqwe.cf/commonLogin/igate_edam/staticContent/images/SLID/js/webtrends.min.js
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.23.159.66 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS
wgh17.whogohost.com
Software
Apache /
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:11 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
pageBg.png
home.secureapp.att.net/design/cdls10/img/ui/ 		169 B
1001 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/cdls10/img/ui/pageBg.png
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
c537cf7e2770d1b4953255dfccff8e0bdbfd4adb4e88d868e353208ae7ff13c1
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:11 GMT
ETag
"b20a88-a9-584693b8bbf40"
Last-Modified
Tue, 19 Mar 2019 02:26:29 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
image/png
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
169
X-XSS-Protection
1; mode=block
btnSumbit.png
home.secureapp.att.net/img/sso/slid/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/img/sso/slid/btnSumbit.png
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
27da51ec2023f96407f92161ddda0e290b0661a765822ff03e5d61f3aecf8aa0
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:11 GMT
ETag
"b20b44-573-583d5ba465f00"
Last-Modified
Mon, 11 Mar 2019 18:27:40 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
image/png
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1395
X-XSS-Protection
1; mode=block
footerBg.png
home.secureapp.att.net/design/CDLS10/img/ui/ 		560 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/CDLS10/img/ui/footerBg.png
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
61e91515aaf72cba3014a136331a138eca6b27831c8f2e6b0c128825243f5263
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:11 GMT
ETag
"b20997-230-584680e200d00"
Last-Modified
Tue, 19 Mar 2019 01:02:12 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
image/png
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
560
X-XSS-Protection
1; mode=block
satellite-5902439064746d5a880062b0.js
www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/scripts/ 		10 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/scripts/satellite-5902439064746d5a880062b0.js
Requested by
Host: www.att.com
URL: https://www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/satelliteLib-bee1ce9b89e943a46b1dfd167adc564fe75eef37.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:19f::2db1 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
b01c8dae3a79ada09bec7776f8abe7882eb8503bc4d0cf8b0e3e341932b51362
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; preload

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 21:55:11 GMT
content-encoding
gzip
vary
Accept-Encoding
status
200
uxtime
XadyKm1sP8Lyqz5gn@rLgAAAANE D=50873
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
1629
last-modified
Wed, 16 Oct 2019 17:17:07 GMT
server
Apache
etag
"26d5-5950a45370ac0-gzip"
strict-transport-security
max-age=15768000 ; preload
content-type
application/javascript
cache-control
max-age=5184000
accept-ranges
bytes
x-datastream-cache-status
1, 1, 1
expires
Sun, 15 Dec 2019 21:55:11 GMT
satellite-5afdc1fc64746d0d8a008916.js
www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/scripts/ 		343 B
600 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/scripts/satellite-5afdc1fc64746d0d8a008916.js
Requested by
Host: www.att.com
URL: https://www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/satelliteLib-bee1ce9b89e943a46b1dfd167adc564fe75eef37.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:19f::2db1 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
97af9f6b59052366e570ad67fdcec5321f75a1c1bcd21258ef7b832ec45e7f3d
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; preload

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 21:55:11 GMT
content-encoding
gzip
vary
Accept-Encoding
status
200
uxtime
XadyKjqGVWP2f2BMFk94xQAAAAU D=79798
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
270
last-modified
Wed, 16 Oct 2019 17:17:07 GMT
server
Apache
etag
"157-5950a45370ac0-gzip"
strict-transport-security
max-age=15768000 ; preload
content-type
application/javascript
cache-control
max-age=5184000
accept-ranges
bytes
x-datastream-cache-status
1
expires
Sun, 15 Dec 2019 21:55:11 GMT
attGlobalNavHeader-bg.gif
home.secureapp.att.net/design/cdls20/img/ui/ 		149 B
981 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/cdls20/img/ui/attGlobalNavHeader-bg.gif
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
9880eb5b6a6b1dec8f568c14a1a5be755c460d2ea2df66fa7b5e6b99227f7128
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:11 GMT
ETag
"b20b1e-95-58469479605c0"
Last-Modified
Tue, 19 Mar 2019 02:29:51 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
image/gif
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
149
X-XSS-Protection
1; mode=block
att_globe_blue_80x80.png
home.secureapp.att.net/design/CDLS10/img/logos/ 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/CDLS10/img/logos/att_globe_blue_80x80.png
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
dfa35aa4643a991e1d2ec6e3562e1a0465174c7200a7572c92619904bb08530f
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:11 GMT
ETag
"b20897-40c4-583d5a2f82f40"
Last-Modified
Mon, 11 Mar 2019 18:21:09 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
image/png
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
16580
X-XSS-Protection
1; mode=block
support-icon.jpg
home.secureapp.att.net/img/sso/slid/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/img/sso/slid/support-icon.jpg
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
01a7e22fd83c617ff55898233518c54a9ecce7e0de3e8a63c4fa59315b029c6b
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:11 GMT
ETag
"b21074-615-583d5ba836800"
Last-Modified
Mon, 11 Mar 2019 18:27:44 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
image/jpeg
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1557
X-XSS-Protection
1; mode=block
txt-clear.png
home.secureapp.att.net/img/sso/slid/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/img/sso/slid/txt-clear.png
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
fdee766a03e4032897a2cd75326c135d8e938592bfb00f12ed5b4eb223f54c3f
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:11 GMT
ETag
"b210b2-cda-583d5ba836800"
Last-Modified
Mon, 11 Mar 2019 18:27:44 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
image/png
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
3290
X-XSS-Protection
1; mode=block
ques.png
home.secureapp.att.net/img/sso/slid/ 		363 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/img/sso/slid/ques.png
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/sso/slid/1201/script.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
unknown / unknown
Resource Hash
5fd69c4fa9f1a2a6fbdab11ff45053dbd08237e6190dfc9c071fadd08fe9b7d5
Security Headers
Name Value
Content-Security-Policy frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Frame-Options ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 21:55:11 GMT
ETag
"b20fad-16b-583d5ba7425c0"
Last-Modified
Mon, 11 Mar 2019 18:27:43 GMT
Server
unknown
x-powered-by
unknown
X-Frame-Options
ALLOW-FROM http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Content-Type
image/png
x-generator
unknown
Content-Security-Policy
frame-ancestors http://*.att.com/ https://*.att.com/ http://*.att.com:*/ https://*.att.com:*/ http://*.att.net/ https://*.att.net/ http://*.att.net:*/ https://*.att.net:*/
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
363
X-XSS-Protection
1; mode=block
integrator.js
adservice.google.de/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=heeriosd8.df.casf.jhsfqwe.cf
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 21:55:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=heeriosd8.df.casf.jhsfqwe.cf
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 21:55:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019100301.js
securepubads.g.doubleclick.net/gpt/ 		157 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s45-in-f2.1e100.net
Software
sffe /
Resource Hash
d98e77e558ef5c298f4c28cdd1604914a16a3fcc9249904ba70c57d989fb6aab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 21:55:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 13:06:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
58949
x-xss-protection
0
expires
Wed, 16 Oct 2019 21:55:11 GMT
sessioncam.recorder.js
d2oh4tlt9mrke9.cloudfront.net/Record/js/ 		261 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d2oh4tlt9mrke9.cloudfront.net/Record/js/sessioncam.recorder.js
Requested by
Host: www.att.com
URL: https://www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/scripts/satellite-5afdc1fc64746d0d8a008916.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.98.143 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-98-143.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
9c813e48aa79a4502a38e75f84d98a1af15f649440ccfaa1e3f34c279b784991

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 16 Oct 2019 14:23:39 GMT
Content-Encoding
gzip
Connection
keep-alive
Last-Modified
Thu, 03 Oct 2019 14:20:14 GMT
Server
AmazonS3
Age
27124
ETag
"5f10605f7e917aa738d69be2f95fadce"
X-Cache
Hit from cloudfront
Content-Type
text/javascript
Via
1.1 055d899361491602a9ef1eb0cdc5e337.cloudfront.net (CloudFront)
Cache-Control
max-age=14400
X-Amz-Cf-Pop
FRA50-C1
Accept-Ranges
bytes
Content-Length
60337
X-Amz-Cf-Id
nbbdRP3ttKPXJ5S6zfffpVP9sXFxHANK_4xmMPHj8Oq_leR29qBCMg==
config.aspx
ws.sessioncam.com/Record/ 		145 B
419 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ws.sessioncam.com/Record/config.aspx?url=https%3A%2F%2Fheeriosd8.df.casf.jhsfqwe.cf%2F9138e21fd3ab589cb4f769950eea148d%2F&ae=1&sse=1571262911722
Requested by
Host: d2oh4tlt9mrke9.cloudfront.net
URL: https://d2oh4tlt9mrke9.cloudfront.net/Record/js/sessioncam.recorder.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.156.176.154 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-156-176-154.compute-1.amazonaws.com
Software
/
Resource Hash
72cdde54cb5873078eccfab3f4d0e94a6d375e2a767fe66882601663686eed43

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 16 Oct 2019 21:55:11 GMT
Server
P3P
CP="ADMa DEVa IVAa IVDa OUR IND DSP NON COR"
Cache-Control
no-cache, no-store
Connection
keep-alive
Content-Type
text/javascript; charset=utf-8
Content-Length
145
Expires
-1
context.dll
home.secureapp.att.net/attportal/s/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/attportal/s/context.dll?id=9002001&type=clickthru&name=cgate.signIn.Pageviews.www-att-net&redirecturl=/i/s.gif?nocache=2159
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
144.160.36.70 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
satellite-583d593b64746d1bdc003fe1.js
www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/scripts/ 		20 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/scripts/satellite-583d593b64746d1bdc003fe1.js
Requested by
Host: www.att.com
URL: https://www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/satelliteLib-bee1ce9b89e943a46b1dfd167adc564fe75eef37.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:19f::2db1 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
9a7483d77159840894b737be347183541715f387f6b6742cc80b4ca7653c6329
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; preload

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 21:55:12 GMT
x-datastream-origin-mex-latency
144
x-datastream-midmile-rtt
5
status
200
uxtime
XadyLeri3TsrX-cOfFXykgAAAIw D=82862
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-encoding
gzip
content-length
3991
last-modified
Wed, 16 Oct 2019 17:26:30 GMT
server
Apache
etag
"510c-5950a66c5bd80-gzip"
vary
Accept-Encoding
strict-transport-security
max-age=15768000 ; preload
content-type
application/javascript
cache-control
max-age=5184000
accept-ranges
bytes
x-datastream-cache-status
3, 1, 1, 1
expires
Sun, 15 Dec 2019 21:55:12 GMT
supportGetHelpWidget.js
www.att.com/esupport/common/js/getHelpWidget/ 		152 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.att.com/esupport/common/js/getHelpWidget/supportGetHelpWidget.js
Requested by
Host: www.att.com
URL: https://www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/scripts/satellite-583d593b64746d1bdc003fe1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:19f::2db1 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
at&t /
Resource Hash
94b9a585565f3ff9de702dc743259bd609fb0138fa090d3ab6c5d1307e35d811
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.att.com/ http://*.att.com/ http://*.att.com:*/ https://*.att.com:*/
Strict-Transport-Security max-age=15768000 ; preload
X-Frame-Options ALLOW-FROM https://*.att.com/, ALLOW-FROM http://*.att.com/, ALLOW-FROM http://*.att.com:*/, ALLOW-FROM https://*.att.com:*/

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
frame-ancestors https://*.att.com/ http://*.att.com/ http://*.att.com:*/ https://*.att.com:*/
x-datastream-origin-mex-latency
1330, 1330
vary
Accept-Encoding
x-datastream-midmile-rtt
0, 5
status
200
uxtime
XaUWHLvKzGQQM8oOiBYICQAAARc D=1268212
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-encoding
gzip
content-length
39282
last-modified
Mon, 14 Oct 2019 15:04:59 GMT
server
at&t
date
Wed, 16 Oct 2019 21:55:12 GMT
x-frame-options
ALLOW-FROM https://*.att.com/, ALLOW-FROM http://*.att.com/, ALLOW-FROM http://*.att.com:*/, ALLOW-FROM https://*.att.com:*/
strict-transport-security
max-age=15768000 ; preload
content-type
application/javascript
cache-control
max-age=900
x-datastream-cache-status
3, 1, 2, 2
show_companion_ad.js
pagead2.googlesyndication.com/pagead/ 		188 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/show_companion_ad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
cb1b848e7e3e69f941836c1a3ba3cfc8b89cf862395c754751be96007d705e41
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 21:29:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1551
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
71220
x-xss-protection
0
server
cafe
etag
3511211146018124967
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
timing-allow-origin
*
expires
Wed, 16 Oct 2019 22:29:21 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		17 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1247775059417428&correlator=2770899971857924&output=ldjh&impl=fifs&adsid=NT&eid=21063817&vrg=2019100301&guci=1.2.0.0.2.2.0.0&plat=1%3A536903688%2C2%3A536903688%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191016&iu_parts=5284%2Csyn.att%2Clogin&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1440x1024%7C1440x800%7C300x250%7C300x600&eri=4&cookie_enabled=1&bc=31&abxe=1&lmt=1571262912&dt=1571262912763&dlt=1571262910467&idt=1235&frm=20&biw=1585&bih=1200&oid=3&adxs=73&adys=112&adks=3592017840&ucis=1&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&loc=https%3A%2F%2Fheeriosd8.df.casf.jhsfqwe.cf%2F9138e21fd3ab589cb4f769950eea148d%2F&dssz=21&icsg=11542735360&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1440x-1&msz=1440x-1&ga_vid=1406979140.1571262913&ga_sid=1571262913&ga_hid=2101433524&fws=4&ohw=1440
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s45-in-f2.1e100.net
Software
cafe /
Resource Hash
3f52202cd27baa5ee876d0ce8fbce3803dcd41220e926ac2ae11f9882497ea8f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 21:55:12 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
4961
x-xss-protection
0
google-lineitem-id
5120759971
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138276182263
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://heeriosd8.df.casf.jhsfqwe.cf
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019100301.js
securepubads.g.doubleclick.net/gpt/ 		63 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s45-in-f2.1e100.net
Software
sffe /
Resource Hash
33e7cfb629c6fc28bec6f0039c2b843ac7d63cb54a883599ca33ce2384e251fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 21:55:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 03 Oct 2019 13:06:21 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24653
x-xss-protection
0
expires
Wed, 16 Oct 2019 21:55:12 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
amp4ads-host-v0.js
cdn.ampproject.org/rtv/011909241711100/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/011909241711100/amp4ads-host-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
37a8b06eab08134f2037c797f4596c7688dd564a8395cb7e072577f371d8f993
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"beb093e69c81d951"
age
446582
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7119
x-xss-protection
0
server
sffe
date
Fri, 11 Oct 2019 17:52:10 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Sat, 10 Oct 2020 17:52:10 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/011909241711100/ Frame A35D 		252 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6d157866400e2e50e077448f9cf06a9f29f70e031612ad6679d3626909a4c4e5
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"96c1a383c63a0e85"
age
545529
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
70044
x-xss-protection
0
server
sffe
date
Thu, 10 Oct 2019 14:23:03 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Fri, 09 Oct 2020 14:23:03 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/011909241711100/v0/ Frame A35D 		150 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/011909241711100/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
197c294e1520b32d787d2678660c02fd195c1c93fee3441de596ef22c34ed425
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"31e12d286572e15e"
age
694871
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
40838
x-xss-protection
0
server
sffe
date
Tue, 08 Oct 2019 20:54:01 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Wed, 07 Oct 2020 20:54:01 GMT
truncated
/ Frame A35D 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
28cd930783739ffb8a290217ab2bbcf1a9bbc96b2cdf8ac6eebc5913756d7841

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
2445683651093886262
tpc.googlesyndication.com/simgad/ Frame A35D 		167 KB
167 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/2445683651093886262
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b6cc21f563f33b4159fd7efebc0334a923212e80386b57f655a0d5f827990868
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 19:34:53 GMT
x-content-type-options
nosniff
age
181219
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
170628
x-xss-protection
0
last-modified
Wed, 17 Jul 2019 20:07:03 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 13 Oct 2020 19:34:53 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame A35D 		0
274 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvt73dqCQVK5sF3jJ9C7mOekEt3E5bE4KuNeRwEwapNSDRV2KNAAHH8BcZ4uvU5-od7bT2YHFD1vcaBc1sZU0L_8Hfb6eTDPyrmZXX9zaj9U4e8Dijx_65uA92epzL35euZ1XIswe1v5YDJRu3qEPAk8WvehspQaqL26D0HdnIrCqwtGVqHV4pXv8mBIKv2vmOvdUcelmIHGftKqh-S8TKLGfuishmF0lHE78i_mmxetqO9x-cdUGr0SUbmc6qOP22gO9epvJE5bYuHaiOlonrjw9GLMdWMtXI&sai=AMfl-YQiSJEFV7xX6TgPFpchyp8jbC5K6A4S7Zs6Trb3h95Y_1YHX-HP_z9uNHgkvaeLsSO77Xuj5lfPgnCVTbbuQYZLJKaDg5iCRB2BjXTr&sig=Cg0ArKJSzAlmJm5XyFKjEAE&adurl=
Requested by
Host: heeriosd8.df.casf.jhsfqwe.cf
URL: https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s45-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 16 Oct 2019 21:55:12 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Wed, 16 Oct 2019 21:55:12 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame A35D 		42 B
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuDJSIr86gdKGgF-80_LET5wpsfazW7wSEMYV1AI8c0yo4SeTuvuYEHL3FP_DL98CxHBvKzr1Gi4wdg1tDRDEi0yseTrwnfqDU9R2nKR3s&sig=Cg0ArKJSzIoOhhBOyQg-EAE&id=ampim&o=73,112&d=1440,1024&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,0,1000,1000&tos=0,0,0,1000,0&tfs=42&tls=1042&g=100&h=100&pt=78&tt=1042&rpt=78&rst=1571262912873&r=v&adk=3592017840&avms=ampa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 16 Oct 2019 21:55:13 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
inqChatLaunch10004119.js
att.inq.com/chatskins/launch/ 		30 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://att.inq.com/chatskins/launch/inqChatLaunch10004119.js
Requested by
Host: www.att.com
URL: https://www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/scripts/satellite-583d593b64746d1bdc003fe1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
206.17.25.188 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
TouchCommerce Server /
Resource Hash
0077cd253d5b55f48a23cccdf577f5771cf5e921218ee080d673df1ab2eea07e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 14 Oct 2019 19:26:19 GMT
server
TouchCommerce Server
accept-language
bytes
etag
"8rsMVK60To/"
content-type
application/javascript
status
200
cache-control
no-cache
date
Wed, 16 Oct 2019 21:55:15 GMT
content-length
7579
x-xss-protection
1; mode=block
expires
Wed, 16 Oct 2019 22:55:15 GMT
resolvePage
att.inq.com/tagserver/launch/ 		33 B
450 B 		Script
General
Check archive.org
Download Go to
Full URL
https://att.inq.com/tagserver/launch/resolvePage?siteID=10004119&url=https%3A%2F%2Fheeriosd8.df.casf.jhsfqwe.cf%2F9138e21fd3ab589cb4f769950eea148d%2F&codeVersion=1571081138131
Requested by
Host: att.inq.com
URL: https://att.inq.com/chatskins/launch/inqChatLaunch10004119.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
206.17.25.188 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
TouchCommerce Server /
Resource Hash
5c2bb4799afe71e3806de817e1e14868d170da40d3bf8df3f59e550fb23a57c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
server
TouchCommerce Server
date
Wed, 16 Oct 2019 21:55:15 GMT
content-language
en-US
status
200
cache-control
no-cache, no-store, max-age=0
content-type
text/javascript; charset=UTF-8
content-length
33
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
inqChat.html
heeriosd8.df.casf.jhsfqwe.cf/ Frame 9940 		315 B
515 B 		Document
General
Check archive.org
Download Go to
Full URL
https://heeriosd8.df.casf.jhsfqwe.cf/inqChat.html?IFRAME
Requested by
Host: att.inq.com
URL: https://att.inq.com/chatskins/launch/inqChatLaunch10004119.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.23.159.66 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS
wgh17.whogohost.com
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Host
heeriosd8.df.casf.jhsfqwe.cf
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
same-origin
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/

Response headers

Date
Wed, 16 Oct 2019 21:55:15 GMT
Server
Apache
Content-Length
315
Keep-Alive
timeout=5, max=96
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

177 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| antiClickjack undefined| noFrameBusting function| $ function| jQuery string| agent string| ORIGINATION_POINT_URL string| RETURN_URL string| CANCEL_URL function| getWindowWidth function| getWindowHeight function| GetURLParameter function| setRegURL function| logPgvw function| refer function| submitForm function| trimAll function| chkTick function| unchkTick function| getElementsByClassName function| btnChange function| acctSelBtnEnable function| ie6Img function| getYadContents function| init undefined| countdownElement function| overlay function| cancelLoad function| Redirecturl string| focusableElementsString function| trapTabKey function| supportRedirect object| Sadlib_Config object| TN8 object| SW_Config object| rubicontag object| googletag object| Sadlib object| SynDetectPii object| sadlib object| _satellite function| webtrendsAsyncInit string| q1Zidx string| q2Zidx string| funnelDomainCheck string| funnelPathCheck object| funnelCondition number| fpc object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken string| evtAction string| evtCode string| successFlag string| statusMessage string| errorType string| linkName string| linkPosition string| linkDestinationUrl string| chatInviteType string| chatSessionId string| chatBusinessUnit string| chatAgentGroup object| chatLaunchedListener object| chatEngagedListener object| c2cStateChanged object| InqRegistry number| google_srt undefined| google_measure_js_timing object| html5 function| html5shim object| sessionCamRecorder function| SessionCamRecorder number| scInitTime0 function| sessionCamJQuery string| tcPageParms string| tcOrderNumber string| tcFAN string| tcRegionID string| tcChatEnabled string| tcCustomerRegion string| tcTroubleshooting_Transcript string| tcWirelessNumber string| tcSkill string| tcUnit string| tcRegionId string| tcChatEligibility string| tcFirstName string| tcLastName string| tcATTUID string| tcauthState string| tcBAN string| tcCustomerCity string| tcCustomerState string| tcCustomerZip string| tcLanguage string| tcMigTgt string| tcFccTrial string| tcPortingNoInd string| tcProductsInCart string| tcPromotions string| tcProductSelection string| tcProductDeSelection string| tcCartTotalRMR string| tcCartTotal string| tcWhpElig string| tcVisitorType string| tcContractTermSelected string| tcDeviceType string| tcPageName string| tcSessionParms object| inqCustData string| mywidgethost string| mywidgeturl object| tc_div number| jsDelay function| myChatjsCall function| helpwidgetfun string| currentUrl undefined| getHelpWidgetLoadIdentifier undefined| getHelpWidgetDirectlyIdentifier undefined| serviceMap undefined| SupportGetHelpWidget undefined| onReady boolean| google_noFetch number| __google_ad_urls_id function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter function| googleCompanionsServicePresent function| googleGetCompanionAdSlots function| googleSetCompanionAdContents function| google_show_companion_ad function| google_show_companion_ad_in_slot function| google_get_companion_slot_params function| google_companion_error function| google_companion_loaded function| google_increment_num_ad_mouseovers string| google_ad_output string| google_flash_version boolean| google_webgl_support string| google_ad_section string| google_country number| google_unique_id object| google_reactive_ads_global_state object| gaGlobal object| __google_ad_urls object| ampInaboxIframes object| ampInaboxPendingMessages object| __AMP_LOG object| __AMP_ERRORS boolean| ampInaboxInitialized object| __AMP_MODE function| __AMP_REPORT_ERROR object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| AMP undefined| cookies undefined| cookie undefined| eqPos undefined| cookieName undefined| host undefined| url undefined| s undefined| params undefined| src undefined| href undefined| query undefined| qs function| getParentV3LanderConfig function| getOpenerV3LanderConfig function| getV3LanderConfigProperty object| v3LanderConfig object| v3Lander

2 Cookies

Domain/Path Name / Value
heeriosd8.df.casf.jhsfqwe.cf/ Name: sc.Status
Value: 2
heeriosd8.df.casf.jhsfqwe.cf/ Name: sc.ASP.NET_SESSIONID
Value: undefined

4 Console Messages

Source Level URL
Text
console-api log URL: https://www.att.com/esupport/common/js/getHelpWidget/supportGetHelpWidget.js(Line 3)
Message:
Get Help Widget script not included
console-api log URL: https://sadlib.static-app.synacor.com/client/att/att.js(Line 1)
Message:
Targeting Providers Timeout,1254ms
console-api error URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js(Line 1)
Message:
getName on googletag.Slot is deprecated and will be removed. Use getAdUnitPath instead.
console-api info URL: https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js(Line 527)
Message:
Powered by AMP ⚡ HTML – Version 1909241711100 https://heeriosd8.df.casf.jhsfqwe.cf/9138e21fd3ab589cb4f769950eea148d/

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
att.inq.com
cdn.ampproject.org
d2oh4tlt9mrke9.cloudfront.net
heeriosd8.df.casf.jhsfqwe.cf
home.secureapp.att.net
pagead2.googlesyndication.com
sadlib.static-app.synacor.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
ws.sessioncam.com
www.att.com
www.googletagservices.com
143.204.98.143
144.160.36.70
172.217.23.98
198.23.159.66
206.17.25.188
2a00:1450:4001:817::2002
2a00:1450:4001:81a::2002
2a00:1450:4001:821::2001
2a00:1450:4001:825::2001
2a00:1450:4001:825::2002
2a02:26f0:6c00:19f::2db1
54.156.176.154
69.168.96.158
0077cd253d5b55f48a23cccdf577f5771cf5e921218ee080d673df1ab2eea07e
01a7e22fd83c617ff55898233518c54a9ecce7e0de3e8a63c4fa59315b029c6b
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
197c294e1520b32d787d2678660c02fd195c1c93fee3441de596ef22c34ed425
27da51ec2023f96407f92161ddda0e290b0661a765822ff03e5d61f3aecf8aa0
28cd930783739ffb8a290217ab2bbcf1a9bbc96b2cdf8ac6eebc5913756d7841
30a949cc26cd4f709fa897313f8d448b2cb724a40a170c4b8e8ce6b3aa890fd1
33e7cfb629c6fc28bec6f0039c2b843ac7d63cb54a883599ca33ce2384e251fa
37a8b06eab08134f2037c797f4596c7688dd564a8395cb7e072577f371d8f993
3d03f2e6b365a99b3049cf1aa58ca138858d504e18fa0ade45d66c47187624e1
3f52202cd27baa5ee876d0ce8fbce3803dcd41220e926ac2ae11f9882497ea8f
54ced81b0b35df5aa9e8d182c4a75f1de8c9cff14bcd3d897cf0caf25f8c5648
5c2bb4799afe71e3806de817e1e14868d170da40d3bf8df3f59e550fb23a57c1
5fd69c4fa9f1a2a6fbdab11ff45053dbd08237e6190dfc9c071fadd08fe9b7d5
61e91515aaf72cba3014a136331a138eca6b27831c8f2e6b0c128825243f5263
6d157866400e2e50e077448f9cf06a9f29f70e031612ad6679d3626909a4c4e5
70b5a6613f03d3c015d826185e39839e6dbc2d03871f151bafbed5cc58503f69
72cdde54cb5873078eccfab3f4d0e94a6d375e2a767fe66882601663686eed43
764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b
8e6ec1efd720fba57823309829b05bb57ebb5716c813c88b3c88cf36ab9aa5e9
94b9a585565f3ff9de702dc743259bd609fb0138fa090d3ab6c5d1307e35d811
97af9f6b59052366e570ad67fdcec5321f75a1c1bcd21258ef7b832ec45e7f3d
9880eb5b6a6b1dec8f568c14a1a5be755c460d2ea2df66fa7b5e6b99227f7128
9a7483d77159840894b737be347183541715f387f6b6742cc80b4ca7653c6329
9c813e48aa79a4502a38e75f84d98a1af15f649440ccfaa1e3f34c279b784991
a8c89bb3937cdc4a70b3568eae5a390d918433be78f89deba07846932ae7c695
b01c8dae3a79ada09bec7776f8abe7882eb8503bc4d0cf8b0e3e341932b51362
b6cc21f563f33b4159fd7efebc0334a923212e80386b57f655a0d5f827990868
ba137ccbea3ce6b2fa1a0db924782ea2a42597b4d196aa2b8ab7628580330c9c
c537cf7e2770d1b4953255dfccff8e0bdbfd4adb4e88d868e353208ae7ff13c1
cb1b848e7e3e69f941836c1a3ba3cfc8b89cf862395c754751be96007d705e41
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d98e77e558ef5c298f4c28cdd1604914a16a3fcc9249904ba70c57d989fb6aab
dfa2be020e3374a4b1c871c88ada990120fb198d4e8ff685ad35cfae88ad3466
dfa35aa4643a991e1d2ec6e3562e1a0465174c7200a7572c92619904bb08530f
dfa500e779f15487f52ea052877afcf802c746984cc7049d3155c0b64338aca1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eed2b7b85bfd84ebdcda3f2d24b5b4566dc77d0340efb27b20e00a5b6085af2e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fdee766a03e4032897a2cd75326c135d8e938592bfb00f12ed5b4eb223f54c3f