0x4954.wordpress.com Open in urlscan Pro
192.0.78.13 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Submission: On January 22 via automatic, source phishtank (January 22nd 2018, 10:58:06 pm UTC)

Summary HTTP 125 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 25 IPs in 4 countries across 21 domains to perform 125 HTTP transactions. The main IP is 192.0.78.13, located in San Francisco, United States and belongs to AUTOMATTIC - Automattic, Inc, US. The main domain is 0x4954.wordpress.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 6th 2015. Valid for: 3 years.

This is the only time 0x4954.wordpress.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	192.0.78.13 192.0.78.13	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
12	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
3	178.250.0.74 178.250.0.74	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 17	52.51.125.50 52.51.125.50	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	192.0.72.23 192.0.72.23	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
5	192.0.73.2 192.0.73.2	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
1	151.101.114.202 151.101.114.202	54113 (FASTLY) (FASTLY - Fastly)
6	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
2	172.217.22.40 172.217.22.40	15169 (GOOGLE) (GOOGLE - Google LLC)
1	172.217.21.234 172.217.21.234	15169 (GOOGLE) (GOOGLE - Google LLC)
2	35.190.59.101 35.190.59.101	15169 (GOOGLE) (GOOGLE - Google LLC)
2	35.190.91.160 35.190.91.160	15169 (GOOGLE) (GOOGLE - Google LLC)
1	185.63.145.1 185.63.145.1	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
1	185.60.216.15 185.60.216.15	32934 (FACEBOOK) (FACEBOOK - Facebook)
2	192.0.78.22 192.0.78.22	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
1	172.217.21.227 172.217.21.227	15169 (GOOGLE) (GOOGLE - Google LLC)
3 3	35.189.222.7 35.189.222.7	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	154.59.122.51 154.59.122.51	174 (COGENT-174) (COGENT-174 - Cogent Communications)
12	52.51.145.237 52.51.145.237	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	52.222.158.196 52.222.158.196	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	37.252.172.80 37.252.172.80	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
1	178.250.0.93 178.250.0.93	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
4	152.195.39.114 152.195.39.114	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
2	52.18.88.202 52.18.88.202	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
33	172.217.22.2 172.217.22.2	15169 (GOOGLE) (GOOGLE - Google LLC)
6	216.58.207.66 216.58.207.66	15169 (GOOGLE) (GOOGLE - Google LLC)
125	25

3 192.0.78.13 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

0x4954.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pubpress.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s2.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s1.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 178.250.0.74 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: static.criteo.net

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 52.51.125.50 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com

s.pubmine.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.0.72.23 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

0x4954.files.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.0.73.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

0.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
1.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.114.202 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

s.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.22.40 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s16-in-f8.1e100.net

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.21.234 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s13-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.59.101 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 101.59.190.35.bc.googleusercontent.com

r.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.91.160 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 160.91.190.35.bc.googleusercontent.com

p.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.63.145.1 (United States)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.60.216.15 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.78.22 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

public-api.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.21.227 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s13-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.189.222.7 (Mountain View, United States) 3 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: 7.222.189.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 154.59.122.51 (United States) 1 redirects

ASN174 (COGENT-174 - Cogent Communications, US)

acuityplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 52.51.145.237 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com

s.pubmine.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.158.196 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-158-196.fra53.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.172.80 (European Union)

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: 152.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.93 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 152.195.39.114 (Ashburn, United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.18.88.202 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-18-88-202.eu-west-1.compute.amazonaws.com

t.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 172.217.22.2 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s14-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 216.58.207.66 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s25-in-f2.1e100.net

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	googlesyndication.com pagead2.googlesyndication.com	218 KB
29	pubmine.com 1 redirects s.pubmine.com	101 KB
18	wp.com s0.wp.com s2.wp.com s1.wp.com stats.wp.com pixel.wp.com	215 KB
9	wordpress.com 0x4954.wordpress.com 0x4954.files.wordpress.com public-api.wordpress.com	449 KB
7	skimresources.com s.skimresources.com r.skimresources.com p.skimresources.com t.skimresources.com	19 KB
5	gravatar.com 0.gravatar.com 1.gravatar.com	13 KB
4	advertising.com adserver-us.adtech.advertising.com	369 B
3	google.com adservice.google.com	522 B
3	google.de adservice.google.de	522 B
3	bidswitch.net 3 redirects x.bidswitch.net	2 KB
3	criteo.net static.criteo.net	20 KB
2	pubpress.net pubpress.net	28 KB
2	adnxs.com ib.adnxs.com	3 KB
2	google-analytics.com ssl.google-analytics.com	17 KB
1	criteo.com bidder.criteo.com	194 B
1	amazon-adsystem.com c.amazon-adsystem.com	10 KB
1	acuityplatform.com 1 redirects acuityplatform.com	530 B
1	gstatic.com fonts.gstatic.com	9 KB
1	facebook.com graph.facebook.com	397 B
1	linkedin.com www.linkedin.com	383 B
1	googleapis.com fonts.googleapis.com	614 B
125	21

	Domain	Requested by
33	pagead2.googlesyndication.com	0x4954.wordpress.com pagead2.googlesyndication.com
29	s.pubmine.com	1 redirects 0x4954.wordpress.com s.pubmine.com
6	0x4954.files.wordpress.com	0x4954.wordpress.com
6	s1.wp.com	0x4954.wordpress.com s1.wp.com
5	pixel.wp.com	0x4954.wordpress.com
4	adserver-us.adtech.advertising.com	s.pubmine.com
4	0.gravatar.com	0x4954.wordpress.com s1.wp.com
3	adservice.google.com	pagead2.googlesyndication.com
3	adservice.google.de	pagead2.googlesyndication.com
3	x.bidswitch.net	3 redirects
3	static.criteo.net	0x4954.wordpress.com
3	s2.wp.com	0x4954.wordpress.com
3	s0.wp.com	0x4954.wordpress.com
2	pubpress.net	0x4954.wordpress.com
2	t.skimresources.com	s.skimresources.com
2	ib.adnxs.com	s.pubmine.com
2	public-api.wordpress.com	0x4954.wordpress.com public-api.wordpress.com
2	p.skimresources.com	0x4954.wordpress.com
2	r.skimresources.com	s.skimresources.com
2	ssl.google-analytics.com	0x4954.wordpress.com
1	bidder.criteo.com	static.criteo.net
1	c.amazon-adsystem.com	s.pubmine.com
1	acuityplatform.com	1 redirects
1	fonts.gstatic.com	s1.wp.com
1	graph.facebook.com	s1.wp.com
1	www.linkedin.com	s1.wp.com
1	fonts.googleapis.com	s1.wp.com
1	stats.wp.com	0x4954.wordpress.com
1	s.skimresources.com	0x4954.wordpress.com
1	1.gravatar.com	0x4954.wordpress.com
1	0x4954.wordpress.com
125	31

This site contains links to these domains. Also see Links.

Domain
gravatar.com
wordpress.com
raamdev.com
wp.me
en.wordpress.com
subscribe.wordpress.com

Subject Issuer	Validity	Valid
*.wordpress.com Go Daddy Secure Certificate Authority - G2	`2015-09-06` - `2018-10-14`	3 years	crt.sh
*.files.wordpress.com Go Daddy Secure Certificate Authority - G2	`2016-01-16` - `2019-02-23`	3 years	crt.sh

This page contains 25 frames:

Primary Page: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Frame ID: (7753EC8F8CF0E70612B4EDF908BDB5FF)
Requests: 82 HTTP requests in this frame

Frame: https://public-api.wordpress.com/connect/?googleplus-sign-in=https%3A%2F%2F0x4954.wordpress.com
Frame ID: (75462A71CAAED82720B9E11C114243ED)
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: (7DE935D45E6C28C5AC9A9F03832503)
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: (BA0BC160D3876C57C4628ABAAEE1E1AE)
Requests: 8 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (89677F657EEDE32D3E9AAD855B652D0B)
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (3ED23D44FB69411111B3F2C13A792C88)
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: (352C7245D4CC73E716E4498C000C582F)
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (1DA4DB5AD53193AC9BEA407A721D4DFD)
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (D81D6C61BE22CB2624EF78AAE109B4EE)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (6DB7820D2C6924FF20A6E1778F244EAA)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (33F7B3C4162E0C06B08C622A37A3CFB4)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (CCC47282B3E41C4A42E8604D29141098)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (8CDBFCB20CA7423E9CE964E99A4A940)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (BBBEBCD32DC45D6098EB623F7E28E0DD)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (72CF709135E774D94E9CB8957FAABAD0)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (AE25BA46F1461BB06625AFA19748106B)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (EE172537BB7290E129DE2704C72C4343)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (64FF840FF32299391DDA93080A9C64C4)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (E2E4AE30096FBBCD4E33B5CDA2AD1113)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (87AEB2D60F045084D0456C2644452B37)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (3016D944F737E31837B1EFE28542734E)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (19C2F913298137F9532CFC71A74D7A04)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (15EBD7AAC06818624E2CB73301FBD1FB)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (EE9DDB52C5825BBFF0B34B3BC5409703)
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js
Frame ID: (11A0D49FD0D94F40A0DBA263E4035C3A)
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-includes\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-includes\//i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

env /pbjs/i

Criteo (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

env /^criteo/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^gaGlobal$/i

Gravatar (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

env /^Gravatar$/i

Twitter Emoji (Twemoji) (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

env /^twemoji$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

env /^Recaptcha$/i

Page Statistics

125
Requests

7 %
HTTPS

0 %
IPv6

21
Domains

31
Subdomains

25
IPs

4
Countries

1104 kB
Transfer

5775 kB
Size

6
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://gravatar.com/site/signup/
Title:

Search URL Search Domain Scan URL

URL: https://wordpress.com/?ref=footer_custom_powered
Title: Site hospedado por WordPress.com

Search URL Search Domain Scan URL

URL: http://raamdev.com/
Title: Raam Dev

Search URL Search Domain Scan URL

URL: https://wordpress.com/start/
Title: Registre-se

Search URL Search Domain Scan URL

URL: https://wp.me/p8YpXL-gr
Title: Copiar link curto

Search URL Search Domain Scan URL

URL: http://en.wordpress.com/abuse/
Title: Denunciar este conteúdo

Search URL Search Domain Scan URL

URL: https://subscribe.wordpress.com/
Title: Gerenciar assinaturas

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47

https://s.pubmine.com/push_sync?bidder_id=1 HTTP 302
https://x.bidswitch.net/sync?ssp=wordpress HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=wordpress HTTP 302
https://acuityplatform.com/Adserver/bswds?bsw_uid=${UID}&bidswitch_ssp_id=wordpress HTTP 302
https://x.bidswitch.net/sync?dsp_id=236&user_id=317420651552&expires=30&user_group=1&ssp=wordpress HTTP 302
https://s.pubmine.com/match?bidder_id=1&external_user_id=2d320a1b-0812-419d-ab81-b3f17de48e7d&ssp_data=

125 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/ 54 KB
54 KB 275ms
275ms Document
text/html 192.0.78.13
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.0.78.13 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

832725548d795757ce41ebce4040b992496239d405a7976e433033d271022217

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
:authority: 0x4954.wordpress.com
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-pingback: https://0x4954.wordpress.com/xmlrpc.php
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding Cookie
content-type: text/html; charset=UTF-8
status: 200
x-ac: 1.fra _dfw
strict-transport-security: max-age=15552000
link: <https://wp.me/p8YpXL-gr>; rel=shortlink

GET
S 200 /
s0.wp.com/_static/ 119 KB
49 KB 7ms
5ms Stylesheet
text/css 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJydkt1uwyAMhV9ozFurTsrFtGchxCNuzY8wUdW3nxO0dV0rLnaDfND58DEA52xcihVjhbCYzIunKHDOLgUjgRgvf9SzE3mCxxjTCQWOWLN1J7OpO/vIyV/7pDLZScBzGi33jnapoO6HbOvqCDiRRcagth4W8ts3tZaz5upO0EYdx1xQxOgaaAmmztqoyym1RmkzgxpvdxpKEFMlpeWn6J3pMWJp9oflHdtiQl5GoDhhRl00gWommbGYHUi9MP4HpOgabLYr6t4hTR6rgCRHlk2L/Vv0h06Gk7OVUrwR5pMtlR5acP1bWvrtAa5yhT7C++vhZdjvh8OwO34BZCkeIg==?cssminify=yes
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 8be0d89f06f0b18b204e2859c5daf37cfcf650d5496b72d291455e4f4ff5494e

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 32
date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
last-modified: Mon, 30 Oct 2017 05:02:01 GMT
server: nginx
etag: W/"59f6b249-1db03"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Wed, 12 Dec 2018 21:56:33 GMT

GET
S 200 /
s2.wp.com/_static/ 55 KB
25 KB 55ms
53ms Stylesheet
text/css 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.wp.com/_static/??-eJx9i9EKwjAMRX/IGoVN54P4LVnp2kialCbD3xcfRGTi0z0XzoFHC1HFkzjUNTReM4kBRieVGfuH9tFsB7/1puZhYaQOVrCT5Pf+q0wjIQfWrN9nE3lJNRmUATLrjPwSbvV6HC6H83Qap/H+BMWZScE=?cssminify=yes
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: fd03740f8d244dc223acd95c99ef2b201f0162342b360574c5318ad47e567bd0

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 32
date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
last-modified: Wed, 29 Mar 2017 11:23:13 GMT
server: nginx
etag: W/"58db9921-da45"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Thu, 20 Sep 2018 05:50:12 GMT

GET
S 200 / Show response
s1.wp.com/_static/ 155 KB
49 KB 55ms
53ms Script
application/x-javascript 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.wp.com/_static/??-eJyFztEKwjAMBdAfsquTiXsRv6XWOFKXtDbphn69HeiDMBQCgdzDJXZOBtmP5QJiQ517gfx4rybIxv4ChnDITqEh5A/2kRVYF0vxjCOYIpDdUG+16BpXXIqiBCIVraTfLyFPCPNfFkCT8zeTQfC5tJ7o2Hb9Yde3+24bXjRNW9I=
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 9f0c1dc7bb2b53b28e8df2fdc67c22fb762251a9e76f3784646572c13f9442d7

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 32
date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
last-modified: Thu, 16 Feb 2017 21:47:59 GMT
server: nginx
etag: W/"58a61e0f-26d19"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Fri, 22 Jun 2018 02:18:14 GMT

GET
S 200 style.css
s1.wp.com/wp-content/mu-plugins/highlander-comments/ 20 KB
4 KB 55ms
53ms Stylesheet
text/css 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1377793621h&cssminify=yes
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: ebb712ab09629f6c76116536d644bebeadc843199e9763b0bdf25dafd8382e7d

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 32
date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
server: nginx
etag: W/"58674300-637d"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Fri, 22 Jun 2018 06:40:22 GMT

GET
H/1.1 200
OK publishertag.js Show response
static.criteo.net/js/ld/ 66 KB
19 KB 68ms
17ms Script
text/javascript 178.250.0.74
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: HTTP/1.1
Server: 178.250.0.74 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: static.criteo.net
Software: nginx /
Resource Hash: 4b581e54bb54f425d06c914d1870407107dd9f784387e68c3b9eca82526e4700

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 22 Jan 2018 22:57:55 GMT
Content-Encoding: gzip
Last-Modified: Wed, 19 Sep 2007 08:50:25 GMT
Server: nginx
ETag: W/"5a58c68c-108ac"
Transfer-Encoding: chunked
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400, public
Connection: keep-alive
Timing-Allow-Origin: *
Expires: Tue, 23 Jan 2018 22:57:55 GMT

GET
H/1.1 200
OK head.js Show response
s.pubmine.com/ 182 KB
73 KB 57ms
57ms Script
application/javascript 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pubmine.com/head.js
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 010bdb735d36e20e7ed8a7e9fa9e6e5e2244d417019f31ef40ef16717cd0d00a

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 22 Jan 2018 22:57:55 GMT
Content-Encoding: gzip
Last-Modified: Mon, 22 Jan 2018 15:30:39 GMT
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: max-age=3600
Connection: keep-alive
Content-Type: application/javascript

GET
H2 200 2017-10-07-13_26_57-whatsapp.png
0x4954.files.wordpress.com/2017/10/ 111 KB
112 KB 7ms
6ms Image
image/png 192.0.72.23
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x4954.files.wordpress.com/2017/10/2017-10-07-13_26_57-whatsapp.png
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.72.23 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 7a0b7159a3bdadd77403f995671a8c3e8c2bac910c3fa4fa69d10574eed65ac1

Request headers

:path: /2017/10/2017-10-07-13_26_57-whatsapp.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x4954.files.wordpress.com
referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
:scheme: https
:method: GET
Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 23 np
date: Mon, 22 Jan 2018 22:57:55 GMT
last-modified: Sat, 07 Oct 2017 16:28:00 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 113970
expires: Sun, 18 Feb 2018 05:29:02 GMT

GET
H2 200 screenshot_1.jpg
0x4954.files.wordpress.com/2017/10/ 83 KB
83 KB 7ms
6ms Image
image/jpeg 192.0.72.23
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x4954.files.wordpress.com/2017/10/screenshot_1.jpg
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.72.23 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: e36c0f4b95e5d91e0f78e83cd39e0ed7ae2b5bf8f16ada6d6ff60e10b7d6dfd2

Request headers

:path: /2017/10/screenshot_1.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x4954.files.wordpress.com
referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
:scheme: https
:method: GET
Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 23 np
date: Mon, 22 Jan 2018 22:57:55 GMT
last-modified: Sat, 07 Oct 2017 16:37:21 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/jpeg
status: 200
accept-ranges: bytes
content-length: 84563
expires: Mon, 12 Feb 2018 11:38:19 GMT

GET
S 200 0425ca3efd6c779fc45ae0602f8cf0ed
0.gravatar.com/avatar/ 1 KB
1 KB 7ms
6ms Image
image/png 192.0.73.2
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0.gravatar.com/avatar/0425ca3efd6c779fc45ae0602f8cf0ed?s=80&d=identicon&r=G
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 05cac3da625c67d6a1d604f55951f0a8483a01943df479c461ccc404af2dc162

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 3
date: Mon, 22 Jan 2018 22:57:55 GMT
last-modified: Sat, 15 Jul 2017 15:29:48 GMT
server: nginx
source-age: 17623
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/0425ca3efd6c779fc45ae0602f8cf0ed?s=80&d=identicon&r=G>; rel="canonical"
content-length: 1112
expires: Mon, 22 Jan 2018 23:02:55 GMT

GET
S 200 ad516503a11cd5ca435acc9bb6523536
1.gravatar.com/avatar/ 2 KB
2 KB 6ms
6ms Image
image/png 192.0.73.2
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25&d=identicon&forcedefault=y&r=G
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: f587f2eeda0e13d45a92fb6fe8ee588ef1990c46c94b6cf4c18d5393f7ba2b02

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 3
date: Mon, 22 Jan 2018 22:57:55 GMT
last-modified: Sat, 01 Mar 2008 02:44:06 GMT
server: nginx
source-age: 186664
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25&d=identicon&forcedefault=y&r=G>; rel="canonical"
content-length: 1749
expires: Mon, 22 Jan 2018 23:02:55 GMT

GET
S 200 gprofiles.js Show response
0.gravatar.com/js/ 20 KB
7 KB 6ms
5ms Script
application/x-javascript 192.0.73.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/js/gprofiles.js?ver=201804y
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 920c9189a522af2214445b9b592232c64c6bcb262bd4bcf1e1abad27c5cbe606

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
last-modified: Thu, 17 Sep 2015 14:13:14 GMT
server: nginx
etag: W/"55faca7a-50aa"
content-type: application/x-javascript
status: 200
cache-control: max-age=604800
expires: Mon, 29 Jan 2018 22:57:55 GMT

GET
S 200 wpgroho.js Show response
s1.wp.com/wp-content/mu-plugins/gravatar-hovercards/ 582 B
526 B 6ms
5ms Script
application/x-javascript 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1380573781h
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 21c557180f1bd074974eb41ae4228b6aa9c41234ab1729d780bc8f05761110bb

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 32
date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
server: nginx
etag: W/"57391252-2f0"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Fri, 22 Jun 2018 02:18:14 GMT

GET
S 200 webfont.js Show response
s1.wp.com/wp-content/plugins/custom-fonts/js/ 12 KB
5 KB 9ms
8ms Script
application/x-javascript 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.wp.com/wp-content/plugins/custom-fonts/js/webfont.js
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: cb8943abdc046f98c2a74cbe013552f1ed2a5746fd76546ed63f60d32dd83615

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 32
date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
server: nginx
etag: W/"58674313-30cd"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Fri, 22 Jun 2018 02:18:16 GMT

GET
S 200 wp-emoji-release.min.js Show response
s0.wp.com/wp-includes/js/ 12 KB
4 KB 126ms
126ms Script
application/x-javascript 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-includes/js/wp-emoji-release.min.js?m=1505864856h&ver=4.9.2
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: dba6b80aceb1267fd1ed564e08a983730d272813e9b3aff85dc365c65333dd66

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 32
date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
server: nginx
etag: W/"59c1acfd-2e8b"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Wed, 16 Jan 2019 23:47:20 GMT

GET
S 200 global-print.css
s0.wp.com/wp-content/mu-plugins/global-print/ 5 KB
2 KB 126ms
126ms Stylesheet
text/css 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/global-print/global-print.css?m=1465851035h&cssminify=yes
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 7d08e9159f7d2bf0835085cbd1ffb0252b0e11de45ed07db4447f8e63f181dbf

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 32
date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
server: nginx
etag: W/"58674608-1f6c"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Fri, 22 Jun 2018 06:18:47 GMT

GET
S 200 / Show response
s2.wp.com/_static/ 41 KB
11 KB 6ms
6ms Script
application/x-javascript 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.wp.com/_static/??/wp-content/js/jquery/jquery.autoresize.js,/wp-content/mu-plugins/highlander-comments/script.js?m=1516198001j
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: add29b6ab4fbfa628f9dfe8b67611787ffadc3889bf44af26fedfdc440ec3c26

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 32
date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
last-modified: Wed, 17 Jan 2018 14:06:58 GMT
server: nginx
etag: W/"5a5f5882-a54e"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Thu, 17 Jan 2019 14:07:01 GMT

GET
S 200 jetpack-carousel.css
s1.wp.com/wp-content/mu-plugins/carousel/ 22 KB
4 KB 18ms
18ms Stylesheet
text/css 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.wp.com/wp-content/mu-plugins/carousel/jetpack-carousel.css?m=1481571546h&cssminify=yes
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: c70b54f83a13aeaae5b49d9787d79db666721ba8d9c877dc732023c47304f071

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 32
date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
server: nginx
etag: W/"58674601-6458"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Fri, 22 Jun 2018 02:24:53 GMT

GET
S 200 / Show response
s2.wp.com/_static/ 204 KB
55 KB 9ms
8ms Script
application/x-javascript 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.wp.com/_static/??-eJydUu1OwzAMfCFSr0xD4gfiUVCWuqvbfGEnG3t7UsFKB6PS+idOzr6LfQmcojLBJ/QJeoEGj2QwflS9PMAs5bKKNh/IC1gaUOA9Y8ZO+8YiLxSb4FyB1BepH9l7kBNFvId0Bfwmpg5dKYt5D+QbjFiWUlvOlqRDVo+jhNdHOuhEwa/j/5NaJyYDxTKMH1QbTBbV0mQ4eWNzcz02Y7TnytGa1oseiGGKSZ1iEVywXTflCrXXDE5LQi47FY7ITGM/E3anQmJthj+PNieZ8VVG0rS7ZYbEn/nneF9+Ip+/QzWvuvWzNIcsaKHHFEtf6gIs9TeQOExqW23gbbSzDbxkYwySVGs1MUinmfzhEgvp1b3Uu/qprjfb513/CTbBThw=
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 10e517e8b51c6537dab165afd2dca0d898f05ea414d981df3a46170dfa301615

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 32
date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
last-modified: Tue, 16 Jan 2018 13:46:42 GMT
server: nginx
etag: W/"5a5e0242-32fe6"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Wed, 16 Jan 2019 13:47:17 GMT

GET
S 200 725X1342.skimlinks.js Show response
s.skimresources.com/js/ 46 KB
17 KB 6ms
6ms Script
application/octet-stream 151.101.114.202
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://s.skimresources.com/js/725X1342.skimlinks.js
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 151.101.114.202 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Skimlinks V9.0 /
Resource Hash: 5c4a9209e1809a51624102bcb722b15d28f61cb39c5ce7339ccba02964a4abe7

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
server: Skimlinks V9.0
x-amz-version-id: rpNGbuDz.tQwwMdfGHDUaA8y9kg8slD0
etag: "67c5cb83e511084e305e6b214688df48"
x-served-by: cache-hhn1551-HHN
vary: Accept-Encoding
x-cache: HIT
p3p: policyref="https://s.skimresources.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
content-type: application/octet-stream
content-length: 16832
x-cache-hits: 119

GET
S 200 w.js Show response
stats.wp.com/ 11 KB
4 KB 6ms
5ms Script
application/x-javascript 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/w.js?56
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: e7f6a232138a2992064e3f39aae317a816a4b892340be34695e42089e0e95cdc

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
server: nginx
etag: W/"5890f68b-405c"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
expires: Sun, 03 Jun 2018 01:14:56 GMT

GET
S 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 6ms
5ms Script
text/javascript 172.217.22.40
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/

Protocol

SPDY

Server

172.217.22.40 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f8.1e100.net

Software

Golfe2 /

Resource Hash

7c2c58fc24e2d3458b88680cfad4577011697df9a1406808f2f7d8f46060d8a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 13 Nov 2017 20:19:12 GMT
server: Golfe2
age: 6209
date: Mon, 22 Jan 2018 21:14:26 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 17172
expires: Mon, 22 Jan 2018 23:14:26 GMT

GET
H2 200 sr01.jpg
0x4954.files.wordpress.com/2017/07/ 21 KB
21 KB 6ms
6ms Image
image/webp 192.0.72.23
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x4954.files.wordpress.com/2017/07/sr01.jpg?w=600&
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.72.23 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 953f96d299a32fcd474c0bd7c74e99d5cbee880d19ac8e3f1e57b54a1440b77c

Request headers

:path: /2017/07/sr01.jpg?w=600&
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x4954.files.wordpress.com
referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
:scheme: https
:method: GET
Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 23 np
date: Mon, 22 Jan 2018 22:57:55 GMT
last-modified: Tue, 25 Jul 2017 18:13:11 GMT
server: nginx
vary: Accept
content-type: image/webp
status: 200
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 21326
expires: Fri, 16 Feb 2018 12:54:24 GMT

GET
DATA 200
OK truncated
/ 14 KB
0 Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 970a3fa15876d16dcc0fd70eb7c9ab44d733108b3ddca1a449edd0356c1b79a7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Origin: https://0x4954.wordpress.com

Response headers

Access-Control-Allow-Origin: *
Content-Type: application/x-font-woff;charset=utf-8

GET
H/1.1 200
OK pixel.gif
static.criteo.net/images/ 43 B
424 B 16ms
16ms Image
image/gif 178.250.0.74
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=1
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: HTTP/1.1
Server: 178.250.0.74 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: static.criteo.net
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 22 Jan 2018 22:57:55 GMT
Last-Modified: Wed, 19 Sep 2007 08:50:25 GMT
Server: nginx
ETag: "493ea254-2b"
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=31104000, public
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 43
Expires: Thu, 17 Jan 2019 22:57:55 GMT

GET
H/1.1 200
OK pixel.gif
static.criteo.net/images/ 43 B
424 B 32ms
16ms Image
image/gif 178.250.0.74
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=2
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: HTTP/1.1
Server: 178.250.0.74 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: static.criteo.net
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 22 Jan 2018 22:57:55 GMT
Last-Modified: Wed, 19 Sep 2007 08:50:25 GMT
Server: nginx
ETag: "493ea254-2b"
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=31104000, public
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 43
Expires: Thu, 17 Jan 2019 22:57:55 GMT

GET
S 200 button-back.gif
s1.wp.com/wp-content/mu-plugins/highlander-comments/images/ 1 KB
1 KB 7ms
6ms Image
image/gif 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s1.wp.com/wp-content/mu-plugins/highlander-comments/images/button-back.gif
Requested by: Host: s1.wp.com
URL: https://s1.wp.com/_static/??-eJyFztEKwjAMBdAfsquTiXsRv6XWOFKXtDbphn69HeiDMBQCgdzDJXZOBtmP5QJiQ517gfx4rybIxv4ChnDITqEh5A/2kRVYF0vxjCOYIpDdUG+16BpXXIqiBCIVraTfLyFPCPNfFkCT8zeTQfC5tJ7o2Hb9Yde3+24bXjRNW9I=
Protocol: SPDY
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 0dab369eac5fd3a06420395d02d292bc3e3ab0bf62add857c72804fd9f4edd35

Request headers

Referer: https://s1.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1377793621h&cssminify=yes
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 32
date: Mon, 22 Jan 2018 22:57:55 GMT
x-ac: 4.fra _dfw
last-modified: Sat, 31 Dec 2016 05:45:43 GMT
server: nginx
etag: "58674607-4d0"
content-type: image/gif
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1232
expires: Fri, 22 Jun 2018 02:18:14 GMT

GET
DATA 200
OK truncated
/ 18 KB
0 Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Origin: https://0x4954.wordpress.com

Response headers

Access-Control-Allow-Origin: *
Content-Type: application/x-font-woff;charset=utf-8

GET
S 200 css
fonts.googleapis.com/ 1 KB
614 B 16ms
16ms Stylesheet
text/css 172.217.21.234
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Oswald:r&subset=latin,latin-ext

Requested by

Host: s1.wp.com
URL: https://s1.wp.com/wp-content/plugins/custom-fonts/js/webfont.js

Protocol

SPDY

Server

172.217.21.234 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s13-in-f10.1e100.net

Software

ESF /

Resource Hash

a5f5a5cec00015fc98365ade62a3dd226b324e88303062c4c09d69d21e885e2b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
last-modified: Mon, 22 Jan 2018 22:57:55 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:55 GMT

GET
S 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
101 B 14ms
13ms Image
image/gif 172.217.22.40
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.1&utms=1&utmn=215208034&utmhn=0x4954.wordpress.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1585x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=DFIR%20Adventures%3A%20Cibercriminosos%20usando%20o%20portal%20do%20%E2%80%9CMagazine%20Voc%C3%AA%E2%80%9D%20%E2%80%93%20br%20crimeware%20exposed!&utmhid=1065105450&utmr=-&utmp=%2F2017%2F10%2F07%2Fdfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce%2F&utmht=1516661875487&utmac=UA-52447-2&utmcc=__utma%3D11735858.815674175.1516661875.1516661875.1516661875.1%3B%2B__utmz%3D11735858.1516661875.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=4791300&utmredir=1&utmu=uBAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/

Protocol

SPDY

Server

172.217.22.40 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f8.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 22 Jan 2018 22:57:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 forensics.png
0x4954.files.wordpress.com/2017/07/ 3 KB
3 KB 6ms
6ms Image
image/png 192.0.72.23
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x4954.files.wordpress.com/2017/07/forensics.png?w=50
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.72.23 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 75f4d05359fc78350e10a3f78aaf580fd035cc360b99c1102b5acb51efe86b33

Request headers

:path: /2017/07/forensics.png?w=50
pragma: no-cache
cookie: __utma=11735858.815674175.1516661875.1516661875.1516661875.1; __utmc=11735858; __utmz=11735858.1516661875.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=11735858.1.10.1516661875
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x4954.files.wordpress.com
referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
:scheme: https
:method: GET
Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 23 np
date: Mon, 22 Jan 2018 22:57:55 GMT
last-modified: Sat, 29 Jul 2017 12:01:29 GMT
server: nginx
vary: Accept
content-type: image/png
status: 200
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 2766
expires: Sat, 03 Feb 2018 03:53:30 GMT

GET
S 200 / Show response
r.skimresources.com/api/ 181 B
439 B 16ms
15ms Script
application/javascript 35.190.59.101
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/?callback=skimlinksBeaconCallback&data=%7B%22pubcode%22%3A%22725X1342%22%2C%22domains%22%3A%5B%22gravatar.com%22%2C%22raamdev.com%22%2C%22wp.me%22%2C%22en.wordpress.com%22%2C%22subscribe.wordpress.com%22%5D%2C%22page%22%3A%22https%3A%2F%2F0x4954.wordpress.com%2F2017%2F10%2F07%2Fdfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce%2F%22%7D

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/725X1342.skimlinks.js

Protocol

SPDY

Server

35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

b06822e9c8b5392044ab3a7371140f4e94234afcbd2edbc47e86ca3654170a1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:55 GMT
via: 1.1 google
x-content-type-options: nosniff
server: openresty/1.11.2.5
status: 200
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://0x4954.wordpress.com
access-control-allow-credentials: true
content-type: application/javascript
alt-svc: clear

GET
S 200 px.gif
p.skimresources.com/ 43 B
105 B 14ms
14ms Image
image/gif 35.190.91.160
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=1&rn=0.18456354425869304
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 35.190.91.160 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 160.91.190.35.bc.googleusercontent.com
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:55 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
status: 200
content-type: image/gif
alt-svc: clear
content-length: 43

GET
S 200 px.gif
p.skimresources.com/ 43 B
105 B 14ms
14ms Image
image/gif 35.190.91.160
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=2&rn=0.18456354425869304
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 35.190.91.160 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 160.91.190.35.bc.googleusercontent.com
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:55 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
status: 200
content-type: image/gif
alt-svc: clear
content-length: 43

GET
S 200 hovercard.css
0.gravatar.com/css/ 8 KB
2 KB 6ms
5ms Stylesheet
text/css 192.0.73.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/css/hovercard.css?ver=201804y
Requested by: Host: s1.wp.com
URL: https://s1.wp.com/_static/??-eJyFztEKwjAMBdAfsquTiXsRv6XWOFKXtDbphn69HeiDMBQCgdzDJXZOBtmP5QJiQ517gfx4rybIxv4ChnDITqEh5A/2kRVYF0vxjCOYIpDdUG+16BpXXIqiBCIVraTfLyFPCPNfFkCT8zeTQfC5tJ7o2Hb9Yde3+24bXjRNW9I=
Protocol: SPDY
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 3f10442336cd9b12279a4662345ca628aa1dc48b9993a7cc75c2077b6ecbaf6b

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
last-modified: Mon, 28 Jan 2013 22:29:45 GMT
server: nginx
etag: W/"5106fbd9-2062"
content-type: text/css
status: 200
cache-control: max-age=604800
expires: Mon, 29 Jan 2018 22:57:55 GMT

GET
S 200 services.css
0.gravatar.com/css/ 3 KB
736 B 6ms
6ms Stylesheet
text/css 192.0.73.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/css/services.css?ver=201804y
Requested by: Host: s1.wp.com
URL: https://s1.wp.com/_static/??-eJyFztEKwjAMBdAfsquTiXsRv6XWOFKXtDbphn69HeiDMBQCgdzDJXZOBtmP5QJiQ517gfx4rybIxv4ChnDITqEh5A/2kRVYF0vxjCOYIpDdUG+16BpXXIqiBCIVraTfLyFPCPNfFkCT8zeTQfC5tJ7o2Hb9Yde3+24bXjRNW9I=
Protocol: SPDY
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: ab7e2ffdc04169e144920d681f782403d86113dd0a50dee1eb0522fb4c92375b

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
last-modified: Wed, 19 Mar 2014 21:35:23 GMT
server: nginx
etag: W/"532a0d9b-bd8"
content-type: text/css
status: 200
cache-control: max-age=604800
expires: Mon, 29 Jan 2018 22:57:55 GMT

GET
S 200 share Show response
www.linkedin.com/countserv/count/ 201 B
383 B 123ms
123ms Script
text/javascript 185.63.145.1
LinkedIn Corporation

General

Check archive.org

Show headers Download Go to

Full URL

https://www.linkedin.com/countserv/count/share?format=jsonp&callback=WPCOMSharing.update_linkedin_count&url=https%3A%2F%2F0x4954.wordpress.com%2F2017%2F10%2F07%2Fdfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce%2F&_=1516661875375

Requested by

Host: s1.wp.com
URL: https://s1.wp.com/_static/??-eJyFztEKwjAMBdAfsquTiXsRv6XWOFKXtDbphn69HeiDMBQCgdzDJXZOBtmP5QJiQ517gfx4rybIxv4ChnDITqEh5A/2kRVYF0vxjCOYIpDdUG+16BpXXIqiBCIVraTfLyFPCPNfFkCT8zeTQfC5tJ7o2Hb9Yde3+24bXjRNW9I=

Protocol

SPDY

Server

185.63.145.1 , United States, ASN14413 (LINKEDIN - LinkedIn Corporation, US),

Reverse DNS

Software

Apache-Coyote/1.1 /

Resource Hash

ee49942f5be18c3e4b101a225bdd39c5ccc6c8e8e0ae4a2aa7ac24bee987fe6c

Security Headers

Name	Value
Content-Security-Policy	default-src ; img-src data: blob: ; font-src data: ; style-src 'unsafe-inline' 'self' static-src.linkedin.com .licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com .ads.linkedin.com .licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src static.licdn.com www.youtube.com; media-src blob: ; child-src blob: lnkd-communities: voyager: ; frame-ancestors 'self'; connect-src * lnkd-communities: voyager:; report-uri https://www.linkedin.com/lite/contentsecurity?f=l
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
strict-transport-security: max-age=2592000
vary: Accept-Encoding
x-li-uuid: YpVj/OtDDBWAHccb3yoAAA==
server: Apache-Coyote/1.1
pragma: no-cache
x-li-pop: prod-efr5
x-frame-options: sameorigin
content-type: text/javascript;charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src static.licdn.com www.youtube.com; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; connect-src * lnkd-communities: voyager:; report-uri https://www.linkedin.com/lite/contentsecurity?f=l
x-li-proto: http/2
x-li-fabric: prod-lva1
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
S 200 / Show response
graph.facebook.com/ 365 B
397 B 57ms
57ms Script
application/json 185.60.216.15
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2F0x4954.wordpress.com%2F2017%2F10%2F07%2Fdfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce%2F&_=1516661875376

Requested by

Protocol

SPDY

Server

185.60.216.15 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

65fd7f1dcc201363b6df4cef4483b5b301ffac7aafa16416bb1e5571f30a1ce3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: gzip
etag: "65534fa430b5ea1c3a65c9587296c09443fecc6e"
status: 200
x-fb-rev: 3588598
content-length: 211
pragma: no-cache
x-fb-debug: ukhBGaAgyh3IWVHKjcZVonwF69bMUwZanoLxKeUoYuDrUjeYQE0dx0Xr294RXOKF+bmG2DF1aOjPcb2q+ERR4g==
x-fb-trace-id: FHsNb0kEli4
date: Mon, 22 Jan 2018 22:57:55 GMT
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v2.5
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 2017-10-07-13_26_57-whatsapp.png
0x4954.files.wordpress.com/2017/10/ 113 KB
114 KB 7ms
7ms Image
image/png 192.0.72.23
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x4954.files.wordpress.com/2017/10/2017-10-07-13_26_57-whatsapp.png?w=1100
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.72.23 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: d97e34fc145348d4a23114c967238e74c1ddd2c65c06c9bdc85cb06b8aa5fce7

Request headers

:path: /2017/10/2017-10-07-13_26_57-whatsapp.png?w=1100
pragma: no-cache
cookie: __utma=11735858.815674175.1516661875.1516661875.1516661875.1; __utmc=11735858; __utmz=11735858.1516661875.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=11735858.1.10.1516661875
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x4954.files.wordpress.com
referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
:scheme: https
:method: GET
Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 23 np
date: Mon, 22 Jan 2018 22:57:55 GMT
last-modified: Sat, 07 Oct 2017 16:28:00 GMT
server: nginx
vary: Accept
content-type: image/png
status: 200
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 116002
expires: Mon, 12 Feb 2018 05:56:56 GMT

GET
H2 200 screenshot_1.jpg
0x4954.files.wordpress.com/2017/10/ 54 KB
55 KB 7ms
7ms Image
image/webp 192.0.72.23
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://0x4954.files.wordpress.com/2017/10/screenshot_1.jpg?w=1100
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.72.23 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: fcd8703b3e7b9c2ca321381a3fd246da6c442ce26a57a5b745546f66e14b4b28

Request headers

:path: /2017/10/screenshot_1.jpg?w=1100
pragma: no-cache
cookie: __utma=11735858.815674175.1516661875.1516661875.1516661875.1; __utmc=11735858; __utmz=11735858.1516661875.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=11735858.1.10.1516661875
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 0x4954.files.wordpress.com
referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
:scheme: https
:method: GET
Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 23 np
date: Mon, 22 Jan 2018 22:57:55 GMT
last-modified: Sat, 07 Oct 2017 16:37:21 GMT
server: nginx
vary: Accept
content-type: image/webp
status: 200
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 55588
expires: Mon, 19 Feb 2018 18:48:13 GMT

GET
S 200 g.gif
pixel.wp.com/ 50 B
130 B 6ms
5ms Image
image/gif 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=linkedin&r=0.14983347375209344
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

status: 200
date: Mon, 22 Jan 2018 22:57:55 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
S 200 g.gif
pixel.wp.com/ 50 B
130 B 6ms
6ms Image
image/gif 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.2251204339759223
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

status: 200
date: Mon, 22 Jan 2018 22:57:55 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
S 200 / Show response
r.skimresources.com/api/ 184 B
442 B 15ms
15ms Script
application/javascript 35.190.59.101
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/?callback=skimlinksBeaconAuxCallback&data=%7B%22pubcode%22%3A%22725X1342%22%2C%22domains%22%3A%5B%22magazinevoce.com.br%22%2C%22wordpress.com%22%5D%2C%22page%22%3A%22https%3A%2F%2F0x4954.wordpress.com%2F2017%2F10%2F07%2Fdfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce%2F%22%7D

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/725X1342.skimlinks.js

Protocol

SPDY

Server

35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

a1b1cb0dd12f778d936704d4a63f9334a4c4b43c2fa4b5d94de38eb7358309fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:55 GMT
via: 1.1 google
x-content-type-options: nosniff
server: openresty/1.11.2.5
status: 200
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://0x4954.wordpress.com
access-control-allow-credentials: true
content-type: application/javascript
alt-svc: clear

GET
S 200 g.gif
pixel.wp.com/ 50 B
130 B 6ms
6ms Image
image/gif 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?x_stats-initial-visibility=visible&v=wpcom-no-pv&rand=0.2994427926041059
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

status: 200
date: Mon, 22 Jan 2018 22:57:55 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
S 200 g.gif
pixel.wp.com/ 50 B
130 B 6ms
6ms Image
image/gif 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?blog=132610173&v=wpcom&tz=0&user_id=0&post=1019&subd=0x4954&host=0x4954.wordpress.com&ref=&rand=0.42357293930876505
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

status: 200
date: Mon, 22 Jan 2018 22:57:55 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
S 200 g.gif
pixel.wp.com/ 50 B
130 B 7ms
6ms Image
image/gif 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?crypt=UE5XaGUuOTlwaD85flAmcm1mcmZsaDhkV11YdWFnNncxc1tjZG9XVXhRUmpicH5qamxuMVpFZHZ%2BdStha3RIcS11djQxV2JuNHR3VzZ8UTFGOU5xRVQudltifDE2PzNYSXkscWZRXTRQcnZHTi9COGxZLkdEPW8zbnglWS5oPUhKRkgsWUtBY3BZNyZIY3B%2BZWFsbVltV2c3L0ZuMzZqLkp1TFl8QnZIX3hWLDdQVTJmNS1fRF1dXXdUTlM2YzJSdXpUNTlDWHhZMFVQfGNRamJteWRJN2N4cGUwcE5OeH5qbX5TMURhK1NtWzcwYmw0Wmw5LC9uWmdbdVomNiVLMXBtUA%3D%3D&v=wpcom-no-pv&rand=0.08462667004706725
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

status: 200
date: Mon, 22 Jan 2018 22:57:55 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 / Show response
public-api.wordpress.com/connect/ Frame (754 2 KB
2 KB 132ms
131ms Document
text/html 192.0.78.22
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://public-api.wordpress.com/connect/?googleplus-sign-in=https%3A%2F%2F0x4954.wordpress.com

Requested by

Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.0.78.22 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

1b5c03a7b9aa1d582c0921d6e956be1c65e9d3facad66ceb1195b06433f3e9f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /connect/?googleplus-sign-in=https%3A%2F%2F0x4954.wordpress.com
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: public-api.wordpress.com
referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html; charset=utf-8
status: 200
x-ac: 2.fra _dfw
strict-transport-security: max-age=15552000

GET
S 200 _P8jt3Y65hJ9c4AzRE0V1OvvDin1pK8aKteLpeZ5c0A.woff2
fonts.gstatic.com/s/oswald/v16/ 9 KB
9 KB 6ms
5ms Font
font/woff2 172.217.21.227
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/oswald/v16/_P8jt3Y65hJ9c4AzRE0V1OvvDin1pK8aKteLpeZ5c0A.woff2

Requested by

Host: s1.wp.com
URL: https://s1.wp.com/wp-content/plugins/custom-fonts/js/webfont.js

Protocol

SPDY

Server

172.217.21.227 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s13-in-f3.1e100.net

Software

sffe /

Resource Hash

a26fd52082f9c6c191e6f75ca86d82544f74ec979da9c64406a89bea6247a9e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Oswald:r&subset=latin,latin-ext
Origin: https://0x4954.wordpress.com

Response headers

date: Sat, 09 Dec 2017 06:16:09 GMT
x-content-type-options: nosniff
last-modified: Tue, 07 Nov 2017 15:18:47 GMT
server: sffe
age: 3861706
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 9324
x-xss-protection: 1; mode=block
expires: Sun, 09 Dec 2018 06:16:09 GMT

GET
H/1.1

200
OK

match
s.pubmine.com/
Redirect Chain

https://s.pubmine.com/push_sync?bidder_id=1
https://x.bidswitch.net/sync?ssp=wordpress
https://x.bidswitch.net/ul_cb/sync?ssp=wordpress
https://acuityplatform.com/Adserver/bswds?bsw_uid=${UID}&bidswitch_ssp_id=wordpress
https://x.bidswitch.net/sync?dsp_id=236&user_id=317420651552&expires=30&user_group=1&ssp=wordpress
https://s.pubmine.com/match?bidder_id=1&external_user_id=2d320a1b-0812-419d-ab81-b3f17de48e7d&ssp_data=

43 B
486 B

28ms
28ms

Image
image/gif

52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/match?bidder_id=1&external_user_id=2d320a1b-0812-419d-ab81-b3f17de48e7d&ssp_data=
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:55 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Mon, 22 Jan 2018 22:57:55 GMT
Server: nginx/1.12.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: //s.pubmine.com/match?bidder_id=1&external_user_id=2d320a1b-0812-419d-ab81-b3f17de48e7d&ssp_data=
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Keep-Alive: timeout=10
Content-Length: 0

GET
H/1.1 200
OK pixel
s.pubmine.com/ 43 B
449 B 28ms
28ms Image
image/gif 52.51.145.237
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/pixel?id=15&type=img
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: HTTP/1.1
Server: 52.51.145.237 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:55 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 googleplus-sign-in.js Show response
public-api.wordpress.com/connect/ Frame (754 21 KB
6 KB 132ms
132ms Script
application/x-javascript 192.0.78.22
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://public-api.wordpress.com/connect/googleplus-sign-in.js

Requested by

Host: public-api.wordpress.com
URL: https://public-api.wordpress.com/connect/?googleplus-sign-in=https%3A%2F%2F0x4954.wordpress.com

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.0.78.22 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

85718d963d3d06064712e29e09ba1893f97b09db5a5fa28fca27c211d0f5febc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /connect/googleplus-sign-in.js
pragma: no-cache
cookie: __utma=11735858.815674175.1516661875.1516661875.1516661875.1; __utmc=11735858; __utmz=11735858.1516661875.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=11735858.1.10.1516661875
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: public-api.wordpress.com
referer: https://public-api.wordpress.com/connect/?googleplus-sign-in=https%3A%2F%2F0x4954.wordpress.com
:scheme: https
:method: GET
Referer: https://public-api.wordpress.com/connect/?googleplus-sign-in=https%3A%2F%2F0x4954.wordpress.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:55 GMT
content-encoding: gzip
last-modified: Thu, 21 Aug 2014 18:34:24 GMT
server: nginx
etag: W/"53f63bb0-5363"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
x-ac: 2.fra _dfw
strict-transport-security: max-age=15552000

GET
DATA 200
OK truncated
/ Frame (754 602 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 463ebb3edd217c82afaab62ad647044d87a9265186474191fd15c9e3e72588cc

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H/1.1 200
OK hbconf Show response
s.pubmine.com/ 2 KB
1 KB 28ms
28ms Script
text/javascript 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pubmine.com/hbconf?pp=%7B%22pt%22%3A1%2C%22ht%22%3A0%2C%22tn%22%3A%22independent-publisher-2%22%2C%22amp%22%3Afalse%7D&vmt=%5B%22video%2Fogg%22%2C%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D&ab=0&v=1.29.1&callbackPubmine=_callbacks____0jcqtbkxq
Requested by: Host: s.pubmine.com
URL: https://s.pubmine.com/head.js
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e0d049388e6ecb35f6b675f5fff7c34705fdb0c28df00324fec9ffc3a7a52978

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:55 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK apstag.js Show response
c.amazon-adsystem.com/aax2/ 30 KB
10 KB 7ms
7ms Script
application/javascript 52.222.158.196
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: s.pubmine.com
URL: https://s.pubmine.com/head.js
Protocol: HTTP/1.1
Server: 52.222.158.196 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-52-222-158-196.fra53.r.cloudfront.net
Software: Server /
Resource Hash: 43a3248ab9def34eab9f71eb5a6739ed0aef96a9c345f12802d1863df9ceaa5b

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 21 Jan 2018 18:53:55 GMT
Content-Encoding: gzip
Server: Server
Age: 14638
ETag: 32e73adc19ed26f83c8f8969f383eb92
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 7f9337ef3a0e409fd3409fbbbcf08744.cloudfront.net (CloudFront)
Cache-Control: public, max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
X-Amz-Cf-Id: MNG_6yunLaKFvu9ULaqkz3rn_VrkQiQiXrnSq2vC1a-3wisrWld4ZA==

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 488 B
2 KB 30ms
18ms XHR
application/json 37.252.172.80
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: s.pubmine.com
URL: https://s.pubmine.com/head.js

Protocol

HTTP/1.1

Server

37.252.172.80 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

152.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

4cf8b3e592e67531fde44159188a886f2e56113a128febe55231250d25df0ad0

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Origin: https://0x4954.wordpress.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
X-Proxy-Origin: 148.251.45.254; 148.251.45.254; 152.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.73:80
AN-X-Request-Uuid: 423ccabe-6545-4269-8139-feaba49cdf78
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://0x4954.wordpress.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 488
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 204
No Content cdb Show response
bidder.criteo.com/ 0
194 B 66ms
16ms XHR
text/plain 178.250.0.93
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?ptv=40&profileId=184&cb=14017084985
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: HTTP/1.1
Server: 178.250.0.93 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Origin: https://0x4954.wordpress.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Access-Control-Allow-Origin: https://0x4954.wordpress.com
Date: Mon, 22 Jan 2018 22:57:55 GMT
Access-Control-Allow-Credentials: true
Server: Finatra
Vary: Origin

GET
S 200 ;alias=14672979;cmd=bid;cors=yes;v=2; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/9534.1/4672979/0/0/ 48 B
104 B 105ms
105ms XHR
application/json 152.195.39.114
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9534.1/4672979/0/0/;alias=14672979;cmd=bid;cors=yes;v=2;
Requested by: Host: s.pubmine.com
URL: https://s.pubmine.com/head.js
Protocol: SPDY
Server: 152.195.39.114 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: 8603592f37406bd84e7f472c3a32b6305fee3b2279ee78597da677c9021d9047

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Origin: https://0x4954.wordpress.com

Response headers

pragma: no-cache
date: Mon, 22 Jan 2018 22:57:55 GMT
server: nginx
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://0x4954.wordpress.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 48
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
S 200 ;alias=14672980;cmd=bid;cors=yes;v=2; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/9534.1/4672980/0/0/ 48 B
81 B 106ms
105ms XHR
application/json 152.195.39.114
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9534.1/4672980/0/0/;alias=14672980;cmd=bid;cors=yes;v=2;
Requested by: Host: s.pubmine.com
URL: https://s.pubmine.com/head.js
Protocol: SPDY
Server: 152.195.39.114 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: be7cef0dfc1388bb91a44b04ec2d930f93ef574027f2b59fb4e0b9e84f37853c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Origin: https://0x4954.wordpress.com

Response headers

pragma: no-cache
date: Mon, 22 Jan 2018 22:57:55 GMT
server: nginx
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://0x4954.wordpress.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 48
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
S 200 ;alias=14672981;cmd=bid;cors=yes;v=2; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/9534.1/4672981/0/0/ 48 B
81 B 107ms
107ms XHR
application/json 152.195.39.114
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9534.1/4672981/0/0/;alias=14672981;cmd=bid;cors=yes;v=2;
Requested by: Host: s.pubmine.com
URL: https://s.pubmine.com/head.js
Protocol: SPDY
Server: 152.195.39.114 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: dfe6c59701da4889f21ed3d622b3a6dc993cbc32708b57e53f3ec683d2363d65

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Origin: https://0x4954.wordpress.com

Response headers

pragma: no-cache
date: Mon, 22 Jan 2018 22:57:55 GMT
server: nginx
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://0x4954.wordpress.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 48
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
S 200 ;alias=14672982;cmd=bid;cors=yes;v=2; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/9534.1/4672982/0/0/ 47 B
103 B 411ms
411ms XHR
application/json 152.195.39.114
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9534.1/4672982/0/0/;alias=14672982;cmd=bid;cors=yes;v=2;
Requested by: Host: s.pubmine.com
URL: https://s.pubmine.com/head.js
Protocol: SPDY
Server: 152.195.39.114 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: 3a0e947b2b6e6872da2ec671697b0530f4d4781a8877a11bd781ebb1f652118f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Origin: https://0x4954.wordpress.com

Response headers

pragma: no-cache
date: Mon, 22 Jan 2018 22:57:56 GMT
server: nginx
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://0x4954.wordpress.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 47
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 492 B
2 KB 28ms
28ms XHR
application/json 37.252.172.80
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: s.pubmine.com
URL: https://s.pubmine.com/head.js

Protocol

HTTP/1.1

Server

37.252.172.80 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

152.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

22e3ed76326727797d0674f25bc12130244fe064ddfe3d61c7dca22216ad4776

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Origin: https://0x4954.wordpress.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
X-Proxy-Origin: 148.251.45.254; 148.251.45.254; 152.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.24:80
AN-X-Request-Uuid: 54921e46-9a0d-40d5-be94-9b35e36a97f4
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://0x4954.wordpress.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 492
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK link Show response
t.skimresources.com/api/ 22 B
526 B 36ms
36ms XHR
application/javascript 52.18.88.202
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/link

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/725X1342.skimlinks.js

Protocol

HTTP/1.1

Server

52.18.88.202 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-18-88-202.eu-west-1.compute.amazonaws.com

Software

nginx/1.12.2 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Origin: https://0x4954.wordpress.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:56 GMT
X-Content-Type-Options: nosniff
Server: nginx/1.12.2
Access-Control-Allow-Methods: GET, POST
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: application/javascript
Access-Control-Allow-Headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
Content-Length: 22

POST
H/1.1 200
OK track.php Show response
t.skimresources.com/api/ 22 B
526 B 29ms
29ms XHR
application/javascript 52.18.88.202
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/track.php

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/725X1342.skimlinks.js

Protocol

HTTP/1.1

Server

52.18.88.202 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-18-88-202.eu-west-1.compute.amazonaws.com

Software

nginx/1.12.2 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Origin: https://0x4954.wordpress.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:56 GMT
X-Content-Type-Options: nosniff
Server: nginx/1.12.2
Access-Control-Allow-Methods: GET, POST
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: application/javascript
Access-Control-Allow-Headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
Content-Length: 22

GET
H/1.1 200
OK / Show response
s.pubmine.com/adj/26942/300/250/ 25 KB
7 KB 65ms
65ms Script
text/javascript 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pubmine.com/adj/26942/300/250/?pos=btf&hb=%7B%22APN%22%3A%22nobid%22%2C%22CRT%22%3A%22nobid%22%2C%22AOL%22%3A%22nobid%22%7D&imp_delay=489&pp=%7B%22pt%22%3A1%2C%22ht%22%3A0%2C%22tn%22%3A%22independent-publisher-2%22%2C%22amp%22%3Afalse%7D&pvid=3009c2b7-1a72-442a-9dcc-3c4b8d23ed42&tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&ord=4017046583397&v=1.29.1&callbackPubmine=_callbacks____1jcqtblae
Requested by: Host: s.pubmine.com
URL: https://s.pubmine.com/head.js
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a23b0327b8db0cfb2344d81d1b6834b4114922c5a56c53547e2518f96f7ddaff

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:56 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: 0

GET
H/1.1 200
OK / Show response
s.pubmine.com/adj/114160/300/250/ 25 KB
7 KB 57ms
57ms Script
text/javascript 52.51.145.237
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pubmine.com/adj/114160/300/250/?pos=btf&hb=%7B%22APN%22%3A%22nobid%22%2C%22CRT%22%3A%22nobid%22%2C%22AOL%22%3A%22nobid%22%7D&imp_delay=490&pp=%7B%22pt%22%3A1%2C%22ht%22%3A0%2C%22tn%22%3A%22independent-publisher-2%22%2C%22amp%22%3Afalse%7D&pvid=3009c2b7-1a72-442a-9dcc-3c4b8d23ed42&tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&ord=9926077804946&v=1.29.1&callbackPubmine=_callbacks____2jcqtblaf
Requested by: Host: s.pubmine.com
URL: https://s.pubmine.com/head.js
Protocol: HTTP/1.1
Server: 52.51.145.237 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1082ecb11860c93a45e52c5693be9f659f028f8ad817fb100023e248b4ba6418

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:56 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: 0

GET
S 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame (7DE 47 KB
18 KB 17ms
17ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

aa9f8739191350b92c1a71c928b94ab8b09ec951bb1364f8dc869bfe65b8b2f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
etag: 8033963110357769284
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 18559
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK /
s.pubmine.com/wl_pixel/9EDAKWMov9oYLLyfSc88bYiMaqbu7NN3qz6f3_N5fczd3lSsF01PalO9KSKd6_Wuyz5m1sbAMxKr4RQA7WwQK_EavW_6SrOvtoGVGyrcClP_4pZngiPdog_4rlBYkgDqNDQ_U00bLGy4ahxcNvdJ1Snx9ZZTkPBTlT_73DWYcdSFB4... Frame (7DE 43 B
372 B 28ms
28ms Image
image/gif 52.51.145.237
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/wl_pixel/9EDAKWMov9oYLLyfSc88bYiMaqbu7NN3qz6f3_N5fczd3lSsF01PalO9KSKd6_Wuyz5m1sbAMxKr4RQA7WwQK_EavW_6SrOvtoGVGyrcClP_4pZngiPdog_4rlBYkgDqNDQ_U00bLGy4ahxcNvdJ1Snx9ZZTkPBTlT_73DWYcdSFB4tjtLwi4GaX9KLgfIS91VfOHc9qQpOsw3DoL050QcobxRMUNN-TjY-qvgu7eaDBbEBL0oq0bCDE7pPFUqZ4uOpta_-ADk2TvaTxI8z2ebZR9exOvMmA5I8Jhy5McbLV3KZKsBFwvDczcGWgtFg0p2TPuVmQ5HhbR_WRQb-OemIbwlQJWQWtlWmr_7z300q7w2rOGfpSrlLEtVCe8XseG2lYqvirvxsvNMJqNhaM3cL0YfkRSbYL0xEGGeineneH3xlylljFvRINiHxqVW7NPEbrq5OwofY15d_NkhTbSDCVxUAutqgZQdUjAqrt8T-EJLboZD8NruGrS2kWvEpZQfRKP27sG3Rejf2HeeJXZw_-gj0QQYWI/?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: HTTP/1.1
Server: 52.51.145.237 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:56 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame (BA0 47 KB
18 KB 17ms
16ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

aa9f8739191350b92c1a71c928b94ab8b09ec951bb1364f8dc869bfe65b8b2f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
etag: 8033963110357769284
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 18559
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK /
s.pubmine.com/wl_pixel/RNNPuKi9i-v68Q7BZ8_DOLbhcILV7AZQfhsfrtI6Ggf_ZkJZHDK4JbGrreOkqfk8HXNS7Ta-vTHkiQlkFKgYU05xHg9Pjb3arwHhRDENoOrJRkoELc5apt4jh5qwHJMsKlbNzAmZoTn2G3TtCaICmZORURr-6exgl5zKnYYefwyEoF... Frame (BA0 43 B
372 B 29ms
28ms Image
image/gif 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/wl_pixel/RNNPuKi9i-v68Q7BZ8_DOLbhcILV7AZQfhsfrtI6Ggf_ZkJZHDK4JbGrreOkqfk8HXNS7Ta-vTHkiQlkFKgYU05xHg9Pjb3arwHhRDENoOrJRkoELc5apt4jh5qwHJMsKlbNzAmZoTn2G3TtCaICmZORURr-6exgl5zKnYYefwyEoFVdbKKsF2EKwoQPCuR1lOzj39026CiokeOnToRaqE_jVe20kecsicAXVFhuFzNh9EBcBq2v21KzFZ72FFjhuQjj3roSIjex5Flg14sMqPkKypovMDYoIjtc5bK96OBrAtFHpYsS7CcpA08GhPUtm2yGp2wkoXumsCyGGovEp48rGtpZfKwW1-6x3aOAYHLgSXz_m6A5Pao-qLpmBHRYToD10czCTUBSsI5r64NwMjdsgIAQwttiTm6U_ELCwNgawcmkX9G_5AEYe3L-PN35IBRRMZHnROwyYhQqHx7N6oZ8LLGm8X66bm9zbm99TCEDCXZnSQYxPFII9TNFdrpkPyYAgb7Qh5QRLe_7J5KF8zwOhYFzsWzT/?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:56 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 integrator.js Show response
adservice.google.de/adsid/ Frame (7DE 108 B
174 B 14ms
13ms Script
application/javascript 216.58.207.66
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=0x4954.wordpress.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 integrator.js Show response
adservice.google.com/adsid/ Frame (7DE 108 B
174 B 14ms
14ms Script
application/javascript 216.58.207.66
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=0x4954.wordpress.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 ca-pub-8101658338626046.js Show response
pagead2.googlesyndication.com/pub-config/r20160913/ Frame (7DE 133 B
189 B 6ms
5ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-8101658338626046.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 20:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 21 Jan 2018 21:24:15 GMT
server: sffe
age: 9979
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=43200
accept-ranges: bytes
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 125
x-xss-protection: 1; mode=block
expires: Tue, 23 Jan 2018 08:11:37 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (896 180 KB
67 KB 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
S 200 integrator.js Show response
adservice.google.de/adsid/ Frame (BA0 108 B
174 B 14ms
14ms Script
application/javascript 216.58.207.66
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=0x4954.wordpress.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 integrator.js Show response
adservice.google.com/adsid/ Frame (BA0 108 B
174 B 14ms
14ms Script
application/javascript 216.58.207.66
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=0x4954.wordpress.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 ca-pub-8101658338626046.js Show response
pagead2.googlesyndication.com/pub-config/r20160913/ Frame (BA0 133 B
0 6ms
5ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-8101658338626046.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 20:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 21 Jan 2018 21:24:15 GMT
server: sffe
age: 9979
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=43200
accept-ranges: bytes
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 125
x-xss-protection: 1; mode=block
expires: Tue, 23 Jan 2018 08:11:37 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (896 83 KB
30 KB 6ms
5ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

d38b37159bf64d981602acc01541f1427cffa9479e4f3ef980e5f334ee688676

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Fri, 19 Jan 2018 18:09:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 276480
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 30434
x-xss-protection: 1; mode=block
server: cafe
etag: 17055803591118644262
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 02 Feb 2018 18:09:56 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (3ED 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (3ED 83 KB
30 KB 6ms
5ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

d38b37159bf64d981602acc01541f1427cffa9479e4f3ef980e5f334ee688676

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Fri, 19 Jan 2018 18:09:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 276480
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 30434
x-xss-protection: 1; mode=block
server: cafe
etag: 17055803591118644262
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 02 Feb 2018 18:09:56 GMT

GET
S 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame (352 47 KB
0 17ms
16ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

aa9f8739191350b92c1a71c928b94ab8b09ec951bb1364f8dc869bfe65b8b2f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 8033963110357769284
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 18559
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
S 200 integrator.js Show response
adservice.google.de/adsid/ Frame (352 108 B
174 B 15ms
14ms Script
application/javascript 216.58.207.66
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=0x4954.wordpress.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 integrator.js Show response
adservice.google.com/adsid/ Frame (352 108 B
174 B 15ms
15ms Script
application/javascript 216.58.207.66
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=0x4954.wordpress.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 ca-pub-8101658338626046.js Show response
pagead2.googlesyndication.com/pub-config/r20160913/ Frame (352 133 B
185 B 6ms
5ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-8101658338626046.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 20:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 21 Jan 2018 21:24:15 GMT
server: sffe
age: 9979
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=43200
accept-ranges: bytes
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 125
x-xss-protection: 1; mode=block
expires: Tue, 23 Jan 2018 08:11:37 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (1DA 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (1DA 83 KB
30 KB 6ms
5ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

d38b37159bf64d981602acc01541f1427cffa9479e4f3ef980e5f334ee688676

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Fri, 19 Jan 2018 18:09:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 276480
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 30434
x-xss-protection: 1; mode=block
server: cafe
etag: 17055803591118644262
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 02 Feb 2018 18:09:56 GMT

GET
H/1.1 200
OK iJvFU3y-kDFr4gVK2cDGRxksbM6m6W14Bfji4tzc2CQWZEPW7Y12QikGKARewushy5u3BIHY3l0rjfA_mDtaNRXTXqJSYIj0gVGrpkVTAB0DhT-_i2zXKzqWvsXkWi2qsEPrsLJkoKgcH98JDPnfcWXrCyi9YMw2W69oQy7yPsvGwaJo-SRdLb7z_44dlNKgb8mxN...
s.pubmine.com/passback/9EDAKWMov9oYLLyfSc88bYiMaqbu7NN3qz6f3_N5fczd3lSsF01PalO9KSKd6_Wuyz5m1sbAMxKr4RQA7WwQK_EavW_6SrOvtoGVGyrcClP_4pZngiPdog_4rlBYkgDqNDQ_U00bLGy4ahxcNvdJ1Snx9ZZTkPBTlT_73DWYcdSFB4... 43 B
541 B 30ms
30ms Image
image/gif 52.51.145.237
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/9EDAKWMov9oYLLyfSc88bYiMaqbu7NN3qz6f3_N5fczd3lSsF01PalO9KSKd6_Wuyz5m1sbAMxKr4RQA7WwQK_EavW_6SrOvtoGVGyrcClP_4pZngiPdog_4rlBYkgDqNDQ_U00bLGy4ahxcNvdJ1Snx9ZZTkPBTlT_73DWYcdSFB4tjtLwi4GaX9KLgfIS91VfOHc9qQpOsw3DoL050QcobxRMUNN-TjY-qvgu7eaDBbEBL0oq0bCDE7pPFUqZ4uOpta_-ADk2TvaTxI8z2ebZR9exOvMmA5I8Jhy5McbLV3KZKsBFwvDczcGWgtFg0p2TPuVmQ5HhbR_WRQb-OemIbwlQJWQWtlWmr_7z300q7w2rOGfpSrlLEtVCe8XseG2lYqvirvxsvNMJqNhaM3cL0YfkRSbYL0xEGGeineneH3xlylljFvRINiHxqVW7NPEbrq5OwofY15d_NkhTbSDCVxUAutqgZQdUjAqrt8T-EJLboZD8NruGrS2kWvEpZQfRKP27sG3Rejf2HeeJXZw_-gj0QQYWI/iJvFU3y-kDFr4gVK2cDGRxksbM6m6W14Bfji4tzc2CQWZEPW7Y12QikGKARewushy5u3BIHY3l0rjfA_mDtaNRXTXqJSYIj0gVGrpkVTAB0DhT-_i2zXKzqWvsXkWi2qsEPrsLJkoKgcH98JDPnfcWXrCyi9YMw2W69oQy7yPsvGwaJo-SRdLb7z_44dlNKgb8mxNv8PY4Yj3aHHN3dZppDgSkEZoRHdJD18a3CPJ9FxcZUjxUkGhMBzT-sBuXfxdSenxBFVQh8OW3ii4QzNxYFRBVB5-YJn-wGYS9AxGXNjesWa0WAKAl2w3ncEfg5Oggyb5vYHJGq_JXnz9Snc14Opmbt6wWRKhM2qfPNh6XNrxE6Cl6GuUE_fqFLt9NCZAfbksCG07WP6eU31k7_syDtPBFiTRnip7_sfOjfQ4HX942WOvuM5KuyMqulDtXseU6zjw98-hzL39GRJJzXyQqH3gIthXqsTXBHO0LvGE6M7cULpN8y-pZNw25NWisE1u41Z91sJmg8CB2wKB_4s6jxq-OJZr2NM?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=415
Protocol: HTTP/1.1
Server: 52.51.145.237 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:56 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (D81 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK AxwuO6itJCk5GldgE9yUQUxks-H7F0yAY_G9SQw2TpbYT89PnS-KzzqeJOPuMiCEWCCQfSjdhNzfsJJCJyrYQJcfU2CXUzSINCU6k07pir4_UV3d0qu2qUDOC1BRJzm7ebpQPCMjXvUHOgZCdWq6xOVOUE90jfZHgGlu8V6oglKJALa5BxqXPBoEJZVSuZsycJbQX...
s.pubmine.com/passback/RNNPuKi9i-v68Q7BZ8_DOLbhcILV7AZQfhsfrtI6Ggf_ZkJZHDK4JbGrreOkqfk8HXNS7Ta-vTHkiQlkFKgYU05xHg9Pjb3arwHhRDENoOrJRkoELc5apt4jh5qwHJMsKlbNzAmZoTn2G3TtCaICmZORURr-6exgl5zKnYYefwyEoF... 43 B
541 B 28ms
28ms Image
image/gif 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/RNNPuKi9i-v68Q7BZ8_DOLbhcILV7AZQfhsfrtI6Ggf_ZkJZHDK4JbGrreOkqfk8HXNS7Ta-vTHkiQlkFKgYU05xHg9Pjb3arwHhRDENoOrJRkoELc5apt4jh5qwHJMsKlbNzAmZoTn2G3TtCaICmZORURr-6exgl5zKnYYefwyEoFVdbKKsF2EKwoQPCuR1lOzj39026CiokeOnToRaqE_jVe20kecsicAXVFhuFzNh9EBcBq2v21KzFZ72FFjhuQjj3roSIjex5Flg14sMqPkKypovMDYoIjtc5bK96OBrAtFHpYsS7CcpA08GhPUtm2yGp2wkoXumsCyGGovEp48rGtpZfKwW1-6x3aOAYHLgSXz_m6A5Pao-qLpmBHRYToD10czCTUBSsI5r64NwMjdsgIAQwttiTm6U_ELCwNgawcmkX9G_5AEYe3L-PN35IBRRMZHnROwyYhQqHx7N6oZ8LLGm8X66bm9zbm99TCEDCXZnSQYxPFII9TNFdrpkPyYAgb7Qh5QRLe_7J5KF8zwOhYFzsWzT/AxwuO6itJCk5GldgE9yUQUxks-H7F0yAY_G9SQw2TpbYT89PnS-KzzqeJOPuMiCEWCCQfSjdhNzfsJJCJyrYQJcfU2CXUzSINCU6k07pir4_UV3d0qu2qUDOC1BRJzm7ebpQPCMjXvUHOgZCdWq6xOVOUE90jfZHgGlu8V6oglKJALa5BxqXPBoEJZVSuZsycJbQXQTi_usXcVokb86MbVNP5JedbySQnqn8sdDDV0QwpFg9q5_2Iy2H9_XwNqi_Qf-FCB8TjPsE9v_2Lg7JqRyIW6zWusVflc1RZ6kNr1sdpykTOwnHx9QitDmV6Fzskgenv6jlw0b7UVcYT4THFq7SlEyq3v0KA_GWcPMQK0rXX4fBXb__LfI7uwFzsOXkOoXhDbbtXw1QzJI1H-QWilEKbDuz5tzc2ODmtDR6Ojm_fBKpJRpVIOJBCdZOTcJz4Dr_S_2cQDFWT2dGgz025peMFMfZW6x4l20Ng-ZgfEGlc46oxN1071MFekRKb26IqF3GnIxPM7iFarrfcBlQ4uTTz-h3fU5E?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=443
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:56 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (6DB 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK E6HGTFrXaV03zW7Ge0MQW3qyQ4l-ZCsR5AEhgNbLXVaVZSDvPB32FfTHISf9_gS8mS0NRxoJ9D1h9fFIi5zTPg14pDcb0RFaZuor5wDV02K17LCa3no8YPz4gye0J6EduoHe4JD2sjnZxO134GVzEbKq9oMe5kMy6FbO30sKJWxqc5TjyECXddq47F52TYrsKFV_v...
s.pubmine.com/passback/iJvFU3y-kDFr4gVK2cDGRxksbM6m6W14Bfji4tzc2CQWZEPW7Y12QikGKARewushy5u3BIHY3l0rjfA_mDtaNRXTXqJSYIj0gVGrpkVTAB0DhT-_i2zXKzqWvsXkWi2qsEPrsLJkoKgcH98JDPnfcWXrCyi9YMw2W69oQy7yPsvGwa... 43 B
541 B 28ms
28ms Image
image/gif 52.51.145.237
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/iJvFU3y-kDFr4gVK2cDGRxksbM6m6W14Bfji4tzc2CQWZEPW7Y12QikGKARewushy5u3BIHY3l0rjfA_mDtaNRXTXqJSYIj0gVGrpkVTAB0DhT-_i2zXKzqWvsXkWi2qsEPrsLJkoKgcH98JDPnfcWXrCyi9YMw2W69oQy7yPsvGwaJo-SRdLb7z_44dlNKgb8mxNv8PY4Yj3aHHN3dZppDgSkEZoRHdJD18a3CPJ9FxcZUjxUkGhMBzT-sBuXfxdSenxBFVQh8OW3ii4QzNxYFRBVB5-YJn-wGYS9AxGXNjesWa0WAKAl2w3ncEfg5Oggyb5vYHJGq_JXnz9Snc14Opmbt6wWRKhM2qfPNh6XNrxE6Cl6GuUE_fqFLt9NCZAfbksCG07WP6eU31k7_syDtPBFiTRnip7_sfOjfQ4HX942WOvuM5KuyMqulDtXseU6zjw98-hzL39GRJJzXyQqH3gIthXqsTXBHO0LvGE6M7cULpN8y-pZNw25NWisE1u41Z91sJmg8CB2wKB_4s6jxq-OJZr2NM/E6HGTFrXaV03zW7Ge0MQW3qyQ4l-ZCsR5AEhgNbLXVaVZSDvPB32FfTHISf9_gS8mS0NRxoJ9D1h9fFIi5zTPg14pDcb0RFaZuor5wDV02K17LCa3no8YPz4gye0J6EduoHe4JD2sjnZxO134GVzEbKq9oMe5kMy6FbO30sKJWxqc5TjyECXddq47F52TYrsKFV_vnGtMqx4wQvdr5W6IlqZxC-sbKDIcVx2ojU7kQnzHbqOzweHrKurvuc8tDCnTdrlLnA9kcqmkLcjy42BYNatMU61n2Xio64GFBk1heDmgNWAi1SVBSgHpFz01wXLYLMS9cJ1AbFjaoNOqhYopzEuDpYn2Ewx9O6ecMLiwy7GMRDExD6f0Zuq_LNP8VpSCGgtoEsTy2Gzm2-rNCFV0fpYz-dluma5tgFILdNIQkElLwIpdRsVOQwSjzyDFKiT2b1QuRywz6wXme8SgBPq0aHZDL39ZcVPiDNAEfmrjhlhTAsBt52iyDVfj__qqdbMKh3T9L9uU0R5JUxHy6Nkl3l8hJMsYd9t?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=192
Protocol: HTTP/1.1
Server: 52.51.145.237 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:56 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (33F 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK VfgC3zYmCbe11oZX-S9K8Qf7Zmn8A0b1o-YdRhGk13GtlQiDCbBwsRF3n18t22XRXrPQvNhKzlV0oG4GIjecraMdPK_619a7qXz1UvVTM2opWs-lpjRKULOBkEQeqBioXP07HPlwaM-ms-u2ML591QkPlPMrPSogNBrbyyWd3ktCIn5wHl4LP7qYUA2YY3CIVOv4C...
s.pubmine.com/passback/AxwuO6itJCk5GldgE9yUQUxks-H7F0yAY_G9SQw2TpbYT89PnS-KzzqeJOPuMiCEWCCQfSjdhNzfsJJCJyrYQJcfU2CXUzSINCU6k07pir4_UV3d0qu2qUDOC1BRJzm7ebpQPCMjXvUHOgZCdWq6xOVOUE90jfZHgGlu8V6oglKJAL... 43 B
541 B 28ms
28ms Image
image/gif 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/AxwuO6itJCk5GldgE9yUQUxks-H7F0yAY_G9SQw2TpbYT89PnS-KzzqeJOPuMiCEWCCQfSjdhNzfsJJCJyrYQJcfU2CXUzSINCU6k07pir4_UV3d0qu2qUDOC1BRJzm7ebpQPCMjXvUHOgZCdWq6xOVOUE90jfZHgGlu8V6oglKJALa5BxqXPBoEJZVSuZsycJbQXQTi_usXcVokb86MbVNP5JedbySQnqn8sdDDV0QwpFg9q5_2Iy2H9_XwNqi_Qf-FCB8TjPsE9v_2Lg7JqRyIW6zWusVflc1RZ6kNr1sdpykTOwnHx9QitDmV6Fzskgenv6jlw0b7UVcYT4THFq7SlEyq3v0KA_GWcPMQK0rXX4fBXb__LfI7uwFzsOXkOoXhDbbtXw1QzJI1H-QWilEKbDuz5tzc2ODmtDR6Ojm_fBKpJRpVIOJBCdZOTcJz4Dr_S_2cQDFWT2dGgz025peMFMfZW6x4l20Ng-ZgfEGlc46oxN1071MFekRKb26IqF3GnIxPM7iFarrfcBlQ4uTTz-h3fU5E/VfgC3zYmCbe11oZX-S9K8Qf7Zmn8A0b1o-YdRhGk13GtlQiDCbBwsRF3n18t22XRXrPQvNhKzlV0oG4GIjecraMdPK_619a7qXz1UvVTM2opWs-lpjRKULOBkEQeqBioXP07HPlwaM-ms-u2ML591QkPlPMrPSogNBrbyyWd3ktCIn5wHl4LP7qYUA2YY3CIVOv4CdIY6_3WM45Dz_qFtYtP71uX-H-18yH7zOlDJZUVfGdDEP-4_0O4gsLTSi3LoS9m4GuHA8JU4pbhYc-e0pXONgL-1j-SItZ47CHSGAU6g2aaal73yi_D08LT8L2BjpXSp802PiKtQAdtmHIRMUEBpfcp0C3sQDyn__j9twt1CHHIpXv1nIvhb8pKTlROi0A4S6s1qF2mY0TYEfIstLBVqsIG187EaR7vg_Pet0A3PK1lDOGf4CPqveKlSnvApFljRsIxQhmPegS3NH1u6bH_vdg2HyHoCD_sHJnGVhOIoYdxU7cdV7EueTdnjhDkCO6Doa3hcS5bnkRDHnPZwwk-nQYjv1vy?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=183
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:56 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (CCC 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK siPrEpOoNkA2xtrrZucr7UFU5mdB2oUSXFX0EU6cmUDYP98pxnHJtB-W4uBAUUDXfdOpzfxPN9-qbGbeaO0AgJh_1dE3iqzMqMIjC6r4CzsHadvL_s5-BMCY06x972QSYQoHfp0RXJE3Zik_wXAqyFWkZSEcVRffHJOiX0picGL0MX3u2HWEbVbozkDmO6QG1p4ut...
s.pubmine.com/passback/E6HGTFrXaV03zW7Ge0MQW3qyQ4l-ZCsR5AEhgNbLXVaVZSDvPB32FfTHISf9_gS8mS0NRxoJ9D1h9fFIi5zTPg14pDcb0RFaZuor5wDV02K17LCa3no8YPz4gye0J6EduoHe4JD2sjnZxO134GVzEbKq9oMe5kMy6FbO30sKJWxqc5... 43 B
541 B 28ms
28ms Image
image/gif 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/E6HGTFrXaV03zW7Ge0MQW3qyQ4l-ZCsR5AEhgNbLXVaVZSDvPB32FfTHISf9_gS8mS0NRxoJ9D1h9fFIi5zTPg14pDcb0RFaZuor5wDV02K17LCa3no8YPz4gye0J6EduoHe4JD2sjnZxO134GVzEbKq9oMe5kMy6FbO30sKJWxqc5TjyECXddq47F52TYrsKFV_vnGtMqx4wQvdr5W6IlqZxC-sbKDIcVx2ojU7kQnzHbqOzweHrKurvuc8tDCnTdrlLnA9kcqmkLcjy42BYNatMU61n2Xio64GFBk1heDmgNWAi1SVBSgHpFz01wXLYLMS9cJ1AbFjaoNOqhYopzEuDpYn2Ewx9O6ecMLiwy7GMRDExD6f0Zuq_LNP8VpSCGgtoEsTy2Gzm2-rNCFV0fpYz-dluma5tgFILdNIQkElLwIpdRsVOQwSjzyDFKiT2b1QuRywz6wXme8SgBPq0aHZDL39ZcVPiDNAEfmrjhlhTAsBt52iyDVfj__qqdbMKh3T9L9uU0R5JUxHy6Nkl3l8hJMsYd9t/siPrEpOoNkA2xtrrZucr7UFU5mdB2oUSXFX0EU6cmUDYP98pxnHJtB-W4uBAUUDXfdOpzfxPN9-qbGbeaO0AgJh_1dE3iqzMqMIjC6r4CzsHadvL_s5-BMCY06x972QSYQoHfp0RXJE3Zik_wXAqyFWkZSEcVRffHJOiX0picGL0MX3u2HWEbVbozkDmO6QG1p4ut3NIisp415fihYHa_b8EqgG0fu4N4XGQ-A71J8g4d0GA8L2Zr8rELxwh3KqwEA6e0xMI5L8mF6c2Mfhpg5N4-ioeQn10C9qm2qsgOwxK9LShXYhU4SDRjMzFMKaljheNkkFWTPSGJDB3-8oxPH_H-TietVE1_-f1jDTjtsYiyKj0zKB12Wr9KuukxIYSLDN_YbtJTTJTt0uz-egFq_kkOzjd5PJlugxgOvVXEYXRW2QBN1IHDywCwDmVTCTZ7xFnFaGHne7VAnVH7J_oPPC_hCIq5-4Dy80PIgLUQ0cfjeTfI7lAeZLW9mfNeEYoM7e8DfHHb-UQKtFQ-glU6XSwg4W36_oJ?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=131
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:56 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (8CD 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK L-4DywGYT1LuQkmsduuDYG1TkQbJWFQfKGdaqkMSKJmbIyQbrjy6cgkAfTdpvm2EhnFY9WcB5CY029iGxDkT8lqEUDWD8KLrUuF2-C24G7h9E_p-CbEZWMz98L_XT-ebz-YjFKyP3g8LM5LmqLdz0fJSVDZkMwngGAo6cX4FcPiFu3gFTd97_z8EbN1uJ_lRt0WHQ...
s.pubmine.com/passback/VfgC3zYmCbe11oZX-S9K8Qf7Zmn8A0b1o-YdRhGk13GtlQiDCbBwsRF3n18t22XRXrPQvNhKzlV0oG4GIjecraMdPK_619a7qXz1UvVTM2opWs-lpjRKULOBkEQeqBioXP07HPlwaM-ms-u2ML591QkPlPMrPSogNBrbyyWd3ktCIn... 43 B
541 B 31ms
31ms Image
image/gif 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/VfgC3zYmCbe11oZX-S9K8Qf7Zmn8A0b1o-YdRhGk13GtlQiDCbBwsRF3n18t22XRXrPQvNhKzlV0oG4GIjecraMdPK_619a7qXz1UvVTM2opWs-lpjRKULOBkEQeqBioXP07HPlwaM-ms-u2ML591QkPlPMrPSogNBrbyyWd3ktCIn5wHl4LP7qYUA2YY3CIVOv4CdIY6_3WM45Dz_qFtYtP71uX-H-18yH7zOlDJZUVfGdDEP-4_0O4gsLTSi3LoS9m4GuHA8JU4pbhYc-e0pXONgL-1j-SItZ47CHSGAU6g2aaal73yi_D08LT8L2BjpXSp802PiKtQAdtmHIRMUEBpfcp0C3sQDyn__j9twt1CHHIpXv1nIvhb8pKTlROi0A4S6s1qF2mY0TYEfIstLBVqsIG187EaR7vg_Pet0A3PK1lDOGf4CPqveKlSnvApFljRsIxQhmPegS3NH1u6bH_vdg2HyHoCD_sHJnGVhOIoYdxU7cdV7EueTdnjhDkCO6Doa3hcS5bnkRDHnPZwwk-nQYjv1vy/L-4DywGYT1LuQkmsduuDYG1TkQbJWFQfKGdaqkMSKJmbIyQbrjy6cgkAfTdpvm2EhnFY9WcB5CY029iGxDkT8lqEUDWD8KLrUuF2-C24G7h9E_p-CbEZWMz98L_XT-ebz-YjFKyP3g8LM5LmqLdz0fJSVDZkMwngGAo6cX4FcPiFu3gFTd97_z8EbN1uJ_lRt0WHQ1JkrYbku360ThE9X1HtCitfyaQzB6z6dddIhey79-E8FoQqCwX8PodIx_kDzYRxzIrODn4ozQKAlytQaFB95oydXXyINsZWIhlhNhcKTMAkYeaZxjvVm0H1P4X3oy0mE_z9Mx31YZpv1Ug6Wm-dNOJRdb8lWzJmvHDf4Fp5z0-dWEd5u0F6mUbhQ-oYI7tjstcwTTqQqsBoqSnN0WhHdoUHaDtMOGzKREbDNOS10F2hceDykoiuWRhY0H0nGR4IEwiJswKiOcr4EU0g30M-3yNjhcGQDqmwzZdVS9m2vBvhs7eqektYMM4cGCoBKdSB_w5Erl1x5okoG68T5MF87DD1webk?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=159
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:56 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (BBB 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK h_GSH8s5Qei4z4MKlwsnVdAMNXVOICPb2JUqgVluQQ1ccq-RQrHa2zrrgHl5RbPxeMJCodTAdX0WI76bfSv2y2avsLLxFT2h_wGIypxyrzwPQ-QF61Xr9nR2Gu3HfbLLJX2s-YIvRliehMdarvK4haBmueHHXJuTCieILVYvYHNP5fw-CMvT_NpugkXNvtdGY2J65...
s.pubmine.com/passback/siPrEpOoNkA2xtrrZucr7UFU5mdB2oUSXFX0EU6cmUDYP98pxnHJtB-W4uBAUUDXfdOpzfxPN9-qbGbeaO0AgJh_1dE3iqzMqMIjC6r4CzsHadvL_s5-BMCY06x972QSYQoHfp0RXJE3Zik_wXAqyFWkZSEcVRffHJOiX0picGL0MX... 43 B
544 B 29ms
29ms Image
image/gif 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/siPrEpOoNkA2xtrrZucr7UFU5mdB2oUSXFX0EU6cmUDYP98pxnHJtB-W4uBAUUDXfdOpzfxPN9-qbGbeaO0AgJh_1dE3iqzMqMIjC6r4CzsHadvL_s5-BMCY06x972QSYQoHfp0RXJE3Zik_wXAqyFWkZSEcVRffHJOiX0picGL0MX3u2HWEbVbozkDmO6QG1p4ut3NIisp415fihYHa_b8EqgG0fu4N4XGQ-A71J8g4d0GA8L2Zr8rELxwh3KqwEA6e0xMI5L8mF6c2Mfhpg5N4-ioeQn10C9qm2qsgOwxK9LShXYhU4SDRjMzFMKaljheNkkFWTPSGJDB3-8oxPH_H-TietVE1_-f1jDTjtsYiyKj0zKB12Wr9KuukxIYSLDN_YbtJTTJTt0uz-egFq_kkOzjd5PJlugxgOvVXEYXRW2QBN1IHDywCwDmVTCTZ7xFnFaGHne7VAnVH7J_oPPC_hCIq5-4Dy80PIgLUQ0cfjeTfI7lAeZLW9mfNeEYoM7e8DfHHb-UQKtFQ-glU6XSwg4W36_oJ/h_GSH8s5Qei4z4MKlwsnVdAMNXVOICPb2JUqgVluQQ1ccq-RQrHa2zrrgHl5RbPxeMJCodTAdX0WI76bfSv2y2avsLLxFT2h_wGIypxyrzwPQ-QF61Xr9nR2Gu3HfbLLJX2s-YIvRliehMdarvK4haBmueHHXJuTCieILVYvYHNP5fw-CMvT_NpugkXNvtdGY2J65NSBtVEYg0ICekrqiJEVwgnfAAC6vJuRre79-D-rdZ-gL_MgALYDmynKTk6BHVNZ7MtMlLJ3QS9z9yM-pAOGrKQQxZlIfvBQCx25BAirDvbnDp8haxF_ScjN0VDIYppC5h9W4QIjWw1f9W6W_ftYPeRDG5AmSFnG_-2aIzjkHof__2JuaY-g8w45PvhcxplhNObNru6ItdAkFdk26zYUY1xli82RyLj9fWsOiTkIJUm9PLqroZVaasJHXZiURiFaj708bqPabAJ3XzSe3NG4dETia8gIZw0B5av6wley6MhiiOsQmGIKlTqZnBnZdOZxBJo8KcM4sLrnLY50nrO84sFxXhuo?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=147
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (72C 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK l11Tn9IbPnfLQw4Yxz_7mNEVbNhwbruGevZxwgxMTc7LtHeUiT-WIxB_N-6zIkN3Yy1ORhyeRBob2uRVL5spd0FePD8IK4GMeR-zCbXka_1OGrbWB7k9bul7GL0YDPGW2s9Wfdh78buqRK-TgegxBaUk1vSO0VyvJULDMs5Sa9vb9OSvdSy9QA6xuwZ_O9uLyC8H1...
s.pubmine.com/passback/L-4DywGYT1LuQkmsduuDYG1TkQbJWFQfKGdaqkMSKJmbIyQbrjy6cgkAfTdpvm2EhnFY9WcB5CY029iGxDkT8lqEUDWD8KLrUuF2-C24G7h9E_p-CbEZWMz98L_XT-ebz-YjFKyP3g8LM5LmqLdz0fJSVDZkMwngGAo6cX4FcPiFu3... 43 B
544 B 29ms
29ms Image
image/gif 52.51.145.237
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/L-4DywGYT1LuQkmsduuDYG1TkQbJWFQfKGdaqkMSKJmbIyQbrjy6cgkAfTdpvm2EhnFY9WcB5CY029iGxDkT8lqEUDWD8KLrUuF2-C24G7h9E_p-CbEZWMz98L_XT-ebz-YjFKyP3g8LM5LmqLdz0fJSVDZkMwngGAo6cX4FcPiFu3gFTd97_z8EbN1uJ_lRt0WHQ1JkrYbku360ThE9X1HtCitfyaQzB6z6dddIhey79-E8FoQqCwX8PodIx_kDzYRxzIrODn4ozQKAlytQaFB95oydXXyINsZWIhlhNhcKTMAkYeaZxjvVm0H1P4X3oy0mE_z9Mx31YZpv1Ug6Wm-dNOJRdb8lWzJmvHDf4Fp5z0-dWEd5u0F6mUbhQ-oYI7tjstcwTTqQqsBoqSnN0WhHdoUHaDtMOGzKREbDNOS10F2hceDykoiuWRhY0H0nGR4IEwiJswKiOcr4EU0g30M-3yNjhcGQDqmwzZdVS9m2vBvhs7eqektYMM4cGCoBKdSB_w5Erl1x5okoG68T5MF87DD1webk/l11Tn9IbPnfLQw4Yxz_7mNEVbNhwbruGevZxwgxMTc7LtHeUiT-WIxB_N-6zIkN3Yy1ORhyeRBob2uRVL5spd0FePD8IK4GMeR-zCbXka_1OGrbWB7k9bul7GL0YDPGW2s9Wfdh78buqRK-TgegxBaUk1vSO0VyvJULDMs5Sa9vb9OSvdSy9QA6xuwZ_O9uLyC8H1CCJMmIgaMhf7EMDtcFy8eq8k8yynWSj5SkQwfE32Czr3vxmoJnzoaP3gW265ongVQfH61_7Y-xNWirc5l2JM8WNUPL9kEGC6fmU453xUcxJNw2vLkSXJ-i18C_RK_tsoxtYQ06euhAb1PVGYETPKjQm-ILrXu5yOA5zM8DVfU66F3fEkA54JVw0kX82gHN_Ma-ptqrM1np33iul0VisLBQMeZJxRseg8mUIECFMU69-8S_MU2FXQWn4Ptdp5CzV2ZQgp6j1b-ue95F-_1rA31RCQXVg0IPEgf2krIku2ZmXNZv1n58hmF4gtGIv3Wmf6ADVHaSNa5QHZSMVoxDf6bdnTncZ?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=157
Protocol: HTTP/1.1
Server: 52.51.145.237 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (AE2 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK UKFY4vEKHond3YavYwaU2eds--3WpG2oKLdxPp_CnYQWSc-LIe2SD7xC73eiWjVZP7ZAIWHYfnTl0e3_vTQcTB46EH7ZOfR87XysdK6iX-goBx5fhASQRNd_6i9yNmNo6t2EDqeaCkDuJM06Hsp0RXS_XyRo5S7Gf-Ejir3aPFISAti5zi10VbhtZVm8hG7cy2e3P...
s.pubmine.com/passback/h_GSH8s5Qei4z4MKlwsnVdAMNXVOICPb2JUqgVluQQ1ccq-RQrHa2zrrgHl5RbPxeMJCodTAdX0WI76bfSv2y2avsLLxFT2h_wGIypxyrzwPQ-QF61Xr9nR2Gu3HfbLLJX2s-YIvRliehMdarvK4haBmueHHXJuTCieILVYvYHNP5f... 43 B
544 B 45ms
44ms Image
image/gif 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/h_GSH8s5Qei4z4MKlwsnVdAMNXVOICPb2JUqgVluQQ1ccq-RQrHa2zrrgHl5RbPxeMJCodTAdX0WI76bfSv2y2avsLLxFT2h_wGIypxyrzwPQ-QF61Xr9nR2Gu3HfbLLJX2s-YIvRliehMdarvK4haBmueHHXJuTCieILVYvYHNP5fw-CMvT_NpugkXNvtdGY2J65NSBtVEYg0ICekrqiJEVwgnfAAC6vJuRre79-D-rdZ-gL_MgALYDmynKTk6BHVNZ7MtMlLJ3QS9z9yM-pAOGrKQQxZlIfvBQCx25BAirDvbnDp8haxF_ScjN0VDIYppC5h9W4QIjWw1f9W6W_ftYPeRDG5AmSFnG_-2aIzjkHof__2JuaY-g8w45PvhcxplhNObNru6ItdAkFdk26zYUY1xli82RyLj9fWsOiTkIJUm9PLqroZVaasJHXZiURiFaj708bqPabAJ3XzSe3NG4dETia8gIZw0B5av6wley6MhiiOsQmGIKlTqZnBnZdOZxBJo8KcM4sLrnLY50nrO84sFxXhuo/UKFY4vEKHond3YavYwaU2eds--3WpG2oKLdxPp_CnYQWSc-LIe2SD7xC73eiWjVZP7ZAIWHYfnTl0e3_vTQcTB46EH7ZOfR87XysdK6iX-goBx5fhASQRNd_6i9yNmNo6t2EDqeaCkDuJM06Hsp0RXS_XyRo5S7Gf-Ejir3aPFISAti5zi10VbhtZVm8hG7cy2e3Pm9zVv_FGbgC2z-SlxdTNRaLooEK_5pzjYSfN8ixPG898mVPsrRd2xBjRuSx-x3Yeo7TvMBE7oFYWPBAbp-ElWJl1ku8ZYaTDSW0evQtQjQNZ3QxZx9sXGxD_r80taq80yJQx8PCl-AmFhZVXDiQQA_4pbRKtXPtygDMvaC8Ns-FelZ3Rmv1B0khsUQ1AIKfk-woYND7UmHWoc3FWveafafZQL3uTtiFjLXdAIiB3AQNvBHQDd-CZjJYveLLS2VRPcU_e4GzUtnQ6-fdwRtSTWBC4puHFksTt0wRzjBS39AoQi-L1q24kYk-zDGaqW9dvQQubicUSJ2E_XgWmPgEQk09C-My?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=157
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (EE1 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK l6I8N_pbKPErqMu_vXGaDdLC_shuDXzbLgcqf395SwSNu0LrYMNsnl-drKKaoSN84IAY1DI1MlDoaUZ4c7iinsHXAutzvPuCcbgtwmdynJGVz4DJWebK-CLZnT-n3zWFp_rkhEKtEhZkBYsstuOQXTE6iyI0Rr_rUX5cZs3HIuxHshRW9mlmjja040hl_O7fHhewk...
s.pubmine.com/passback/l11Tn9IbPnfLQw4Yxz_7mNEVbNhwbruGevZxwgxMTc7LtHeUiT-WIxB_N-6zIkN3Yy1ORhyeRBob2uRVL5spd0FePD8IK4GMeR-zCbXka_1OGrbWB7k9bul7GL0YDPGW2s9Wfdh78buqRK-TgegxBaUk1vSO0VyvJULDMs5Sa9vb9O... 43 B
544 B 29ms
29ms Image
image/gif 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/l11Tn9IbPnfLQw4Yxz_7mNEVbNhwbruGevZxwgxMTc7LtHeUiT-WIxB_N-6zIkN3Yy1ORhyeRBob2uRVL5spd0FePD8IK4GMeR-zCbXka_1OGrbWB7k9bul7GL0YDPGW2s9Wfdh78buqRK-TgegxBaUk1vSO0VyvJULDMs5Sa9vb9OSvdSy9QA6xuwZ_O9uLyC8H1CCJMmIgaMhf7EMDtcFy8eq8k8yynWSj5SkQwfE32Czr3vxmoJnzoaP3gW265ongVQfH61_7Y-xNWirc5l2JM8WNUPL9kEGC6fmU453xUcxJNw2vLkSXJ-i18C_RK_tsoxtYQ06euhAb1PVGYETPKjQm-ILrXu5yOA5zM8DVfU66F3fEkA54JVw0kX82gHN_Ma-ptqrM1np33iul0VisLBQMeZJxRseg8mUIECFMU69-8S_MU2FXQWn4Ptdp5CzV2ZQgp6j1b-ue95F-_1rA31RCQXVg0IPEgf2krIku2ZmXNZv1n58hmF4gtGIv3Wmf6ADVHaSNa5QHZSMVoxDf6bdnTncZ/l6I8N_pbKPErqMu_vXGaDdLC_shuDXzbLgcqf395SwSNu0LrYMNsnl-drKKaoSN84IAY1DI1MlDoaUZ4c7iinsHXAutzvPuCcbgtwmdynJGVz4DJWebK-CLZnT-n3zWFp_rkhEKtEhZkBYsstuOQXTE6iyI0Rr_rUX5cZs3HIuxHshRW9mlmjja040hl_O7fHhewkKKC6GrLiJgtjBXbFy0NNEz_Nz1026Atez596pQG_EZBlofvEkCVhBqjhNc8CuWc7UOGyrVmPU1ErHYaY7h42qS3-WqxTtv5c85jLWVBWeP1X2lNeuNSLBaRzWQ-h3V7RxlvmFYnyYFM8NH8KVEKhWj6Jk8svNpgua2ExgqTV0T6zbLSIB2HMXZUC2rRpQXtwNgOAaxYAIH_T8BLpLZbxtgss_VAIUbFgjXDfbm9HabUWLLGlqzb5jKroX5NNPXOmhQubiVZY1Wx20sGaC4rhFzqNPs5-SZLYXiK2VvzUsln7ycdsaji9GsX5hQZ8U-diD_z9FMRtcfIpt8Izvz5Syx5OEK4?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=169
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (64F 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK ENcvA6EmxOd7FaIxMvIHhdep2hwOHrVz3AVYaXsDDBU-eb6EtOIjC0xeaPwr9ew5p08oeY7564Fzr4WAB8Uj_pst8knOn8kTVbGgq0mWT7qx_7ZDwh0pSo9SugkNFhiAd3fOWupzoR-a2QmlCnFdL0x8pYu3FIlFvc4BDsgmALfiMIGkjpP1MBxEJxrr92eW8xSIt...
s.pubmine.com/passback/UKFY4vEKHond3YavYwaU2eds--3WpG2oKLdxPp_CnYQWSc-LIe2SD7xC73eiWjVZP7ZAIWHYfnTl0e3_vTQcTB46EH7ZOfR87XysdK6iX-goBx5fhASQRNd_6i9yNmNo6t2EDqeaCkDuJM06Hsp0RXS_XyRo5S7Gf-Ejir3aPFISAt... 43 B
544 B 28ms
28ms Image
image/gif 52.51.145.237
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/UKFY4vEKHond3YavYwaU2eds--3WpG2oKLdxPp_CnYQWSc-LIe2SD7xC73eiWjVZP7ZAIWHYfnTl0e3_vTQcTB46EH7ZOfR87XysdK6iX-goBx5fhASQRNd_6i9yNmNo6t2EDqeaCkDuJM06Hsp0RXS_XyRo5S7Gf-Ejir3aPFISAti5zi10VbhtZVm8hG7cy2e3Pm9zVv_FGbgC2z-SlxdTNRaLooEK_5pzjYSfN8ixPG898mVPsrRd2xBjRuSx-x3Yeo7TvMBE7oFYWPBAbp-ElWJl1ku8ZYaTDSW0evQtQjQNZ3QxZx9sXGxD_r80taq80yJQx8PCl-AmFhZVXDiQQA_4pbRKtXPtygDMvaC8Ns-FelZ3Rmv1B0khsUQ1AIKfk-woYND7UmHWoc3FWveafafZQL3uTtiFjLXdAIiB3AQNvBHQDd-CZjJYveLLS2VRPcU_e4GzUtnQ6-fdwRtSTWBC4puHFksTt0wRzjBS39AoQi-L1q24kYk-zDGaqW9dvQQubicUSJ2E_XgWmPgEQk09C-My/ENcvA6EmxOd7FaIxMvIHhdep2hwOHrVz3AVYaXsDDBU-eb6EtOIjC0xeaPwr9ew5p08oeY7564Fzr4WAB8Uj_pst8knOn8kTVbGgq0mWT7qx_7ZDwh0pSo9SugkNFhiAd3fOWupzoR-a2QmlCnFdL0x8pYu3FIlFvc4BDsgmALfiMIGkjpP1MBxEJxrr92eW8xSItxFv83mDtAsGHCUHlxy_BiRsmqhgtDPvD8FSY3oYzxWBjDRonfbFtaD18VyWLXLIVthoA4LG2_joPmw3EdIfdtlTsm9uLUTx5BWKOCxaXjF5hvcyCfMKdAExXnKkZmKQwC3EJASq5joew7uzRAlt0K9cIp62IfzurSo20pLFviiMUIGoZy34NsMFHT2XDTjcoAwGXpZrzG7GxRMUhUae70N2iX4rviySoKamrjaml0avXbJepGu5Z02vZVdwOf_tqoqa_J0UMmWLR0h4VkwMtIdh1FHpNW9X88a1SoYDR--T6HvQ25h5NZ0oXCE9BsPR2_vJR7C6kQ5ryNd0rXszKAe8wXBJ?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=147
Protocol: HTTP/1.1
Server: 52.51.145.237 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (E2E 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK CM8rTXIUexVoCjV-rvjCwm2o0nW4AUMVjP0sYmQ8SCJBJZPdGksi30UiaIY5WTOBng9BggYe6Oaf7l6CqIOpFHL6STqHkUTrAY_ReEdccO10kGT8u0tzLi-TJPxAgGiJqDN9izXqd2d2cTbgWq7Qlq9NVhIMaFZ0j5vbexQ8PMwLeMGwjxzThAtcFq0_xEGIB1HtC...
s.pubmine.com/passback/l6I8N_pbKPErqMu_vXGaDdLC_shuDXzbLgcqf395SwSNu0LrYMNsnl-drKKaoSN84IAY1DI1MlDoaUZ4c7iinsHXAutzvPuCcbgtwmdynJGVz4DJWebK-CLZnT-n3zWFp_rkhEKtEhZkBYsstuOQXTE6iyI0Rr_rUX5cZs3HIuxHsh... 43 B
544 B 29ms
29ms Image
image/gif 52.51.145.237
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/l6I8N_pbKPErqMu_vXGaDdLC_shuDXzbLgcqf395SwSNu0LrYMNsnl-drKKaoSN84IAY1DI1MlDoaUZ4c7iinsHXAutzvPuCcbgtwmdynJGVz4DJWebK-CLZnT-n3zWFp_rkhEKtEhZkBYsstuOQXTE6iyI0Rr_rUX5cZs3HIuxHshRW9mlmjja040hl_O7fHhewkKKC6GrLiJgtjBXbFy0NNEz_Nz1026Atez596pQG_EZBlofvEkCVhBqjhNc8CuWc7UOGyrVmPU1ErHYaY7h42qS3-WqxTtv5c85jLWVBWeP1X2lNeuNSLBaRzWQ-h3V7RxlvmFYnyYFM8NH8KVEKhWj6Jk8svNpgua2ExgqTV0T6zbLSIB2HMXZUC2rRpQXtwNgOAaxYAIH_T8BLpLZbxtgss_VAIUbFgjXDfbm9HabUWLLGlqzb5jKroX5NNPXOmhQubiVZY1Wx20sGaC4rhFzqNPs5-SZLYXiK2VvzUsln7ycdsaji9GsX5hQZ8U-diD_z9FMRtcfIpt8Izvz5Syx5OEK4/CM8rTXIUexVoCjV-rvjCwm2o0nW4AUMVjP0sYmQ8SCJBJZPdGksi30UiaIY5WTOBng9BggYe6Oaf7l6CqIOpFHL6STqHkUTrAY_ReEdccO10kGT8u0tzLi-TJPxAgGiJqDN9izXqd2d2cTbgWq7Qlq9NVhIMaFZ0j5vbexQ8PMwLeMGwjxzThAtcFq0_xEGIB1HtC3B5hWxOjiLiEHn0ULJdh9Rn8U8rMpPiAt5nV9pdsG4srSdBWGhP-G9ImoPxWMOoAlJ8ydZZgNrH8m3_hKILHjxnk1w8NIKk8aBuc0Rhr7HLYlJVGBdzC-m6MSBa-HC0nGHss6Md4ZidoLgoz6S71hbf9wotcuWBnMVTnqvUfh6rGsTXEGHWmZ4nVYM_Wmc0KuVmVcUlpr7_kiRUNTkMtXCSwiiJCK_U1eeV8FwefJ3AHSQoIdiCwUlYE2t6fg7ogKQb5UspFOnUodHcBIE6bBBSzoFRehJLZB7x9y_6RDSKIF7Y8EPbeds62jQ85b_hlUANAxQG7KBf2t53bbSJfLBRd329?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=167
Protocol: HTTP/1.1
Server: 52.51.145.237 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (87A 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK 5Rk6H30eDvwLejUX1lCxbZ7vhfS_G1sS5m2Lb3kIPsaJ5q-3ZQd1WlmTIv71LGmkxTtpBfq0NBOiWX7GAq0IbEDQ_-sgxZWKOsw-suv1qTzOX5b5iyALfvqITKlaflBpaQJbWqDLAS3I0eS-yqTehqhwB9L8JNUY2GbbfQRcf4ck4If4nw_fhwoJF2Iz-JmYrVt1i...
s.pubmine.com/passback/ENcvA6EmxOd7FaIxMvIHhdep2hwOHrVz3AVYaXsDDBU-eb6EtOIjC0xeaPwr9ew5p08oeY7564Fzr4WAB8Uj_pst8knOn8kTVbGgq0mWT7qx_7ZDwh0pSo9SugkNFhiAd3fOWupzoR-a2QmlCnFdL0x8pYu3FIlFvc4BDsgmALfiMI... 43 B
544 B 29ms
29ms Image
image/gif 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/ENcvA6EmxOd7FaIxMvIHhdep2hwOHrVz3AVYaXsDDBU-eb6EtOIjC0xeaPwr9ew5p08oeY7564Fzr4WAB8Uj_pst8knOn8kTVbGgq0mWT7qx_7ZDwh0pSo9SugkNFhiAd3fOWupzoR-a2QmlCnFdL0x8pYu3FIlFvc4BDsgmALfiMIGkjpP1MBxEJxrr92eW8xSItxFv83mDtAsGHCUHlxy_BiRsmqhgtDPvD8FSY3oYzxWBjDRonfbFtaD18VyWLXLIVthoA4LG2_joPmw3EdIfdtlTsm9uLUTx5BWKOCxaXjF5hvcyCfMKdAExXnKkZmKQwC3EJASq5joew7uzRAlt0K9cIp62IfzurSo20pLFviiMUIGoZy34NsMFHT2XDTjcoAwGXpZrzG7GxRMUhUae70N2iX4rviySoKamrjaml0avXbJepGu5Z02vZVdwOf_tqoqa_J0UMmWLR0h4VkwMtIdh1FHpNW9X88a1SoYDR--T6HvQ25h5NZ0oXCE9BsPR2_vJR7C6kQ5ryNd0rXszKAe8wXBJ/5Rk6H30eDvwLejUX1lCxbZ7vhfS_G1sS5m2Lb3kIPsaJ5q-3ZQd1WlmTIv71LGmkxTtpBfq0NBOiWX7GAq0IbEDQ_-sgxZWKOsw-suv1qTzOX5b5iyALfvqITKlaflBpaQJbWqDLAS3I0eS-yqTehqhwB9L8JNUY2GbbfQRcf4ck4If4nw_fhwoJF2Iz-JmYrVt1iRW9qm0kKD-uLsbvbdsep9ALeE407ipbDuZf4_To64KIUEHO1mcKfxR1G_5BHtpClosxCLnDvtPhbx0yPJHx7guljS3-icotDmAWAdTFnRg4ZBbcm8jc7zg2o2sBV6orYRIHPziwu7SQDzRgPTxwFqtNbmvoy4pKiBh3GxnPYCaQIvAqmUS7-rjrtaMMEthR7C-iZa8Pdo73dgqusxil-qC191Xl4dnm5UHfUyUwckVy8-NUPZ56bPjxmj8YCNkuCZKJHbqw_MMNsmhrbdAXth_tGTbuiwsrmR5LKx2fPb4XFnudx6B-hi-hwwpxytsGTjGqBzolxJ8IQ07Wb3t_3jZk1yjq?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=145
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (301 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK UhXbKV48mU0u6bPK8xqZ3Blw2ETtxQuEzbiEhKYltsyhrwpb8QjJ0jQhvdcE_K_3ugxpRWFJcNpEhpzew0memQKERi7LoUOTkH9QNfRBvnSwxXI4_WnvOOe5bE1KtSL7_IL0Vw03FVEJohXeNYQHz4wTwkAQiTU2oUx1xnyiidVRu1-bRfjNXLgNVlUY4gQMALOZ_...
s.pubmine.com/passback/CM8rTXIUexVoCjV-rvjCwm2o0nW4AUMVjP0sYmQ8SCJBJZPdGksi30UiaIY5WTOBng9BggYe6Oaf7l6CqIOpFHL6STqHkUTrAY_ReEdccO10kGT8u0tzLi-TJPxAgGiJqDN9izXqd2d2cTbgWq7Qlq9NVhIMaFZ0j5vbexQ8PMwLeM... 43 B
544 B 28ms
28ms Image
image/gif 52.51.145.237
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/CM8rTXIUexVoCjV-rvjCwm2o0nW4AUMVjP0sYmQ8SCJBJZPdGksi30UiaIY5WTOBng9BggYe6Oaf7l6CqIOpFHL6STqHkUTrAY_ReEdccO10kGT8u0tzLi-TJPxAgGiJqDN9izXqd2d2cTbgWq7Qlq9NVhIMaFZ0j5vbexQ8PMwLeMGwjxzThAtcFq0_xEGIB1HtC3B5hWxOjiLiEHn0ULJdh9Rn8U8rMpPiAt5nV9pdsG4srSdBWGhP-G9ImoPxWMOoAlJ8ydZZgNrH8m3_hKILHjxnk1w8NIKk8aBuc0Rhr7HLYlJVGBdzC-m6MSBa-HC0nGHss6Md4ZidoLgoz6S71hbf9wotcuWBnMVTnqvUfh6rGsTXEGHWmZ4nVYM_Wmc0KuVmVcUlpr7_kiRUNTkMtXCSwiiJCK_U1eeV8FwefJ3AHSQoIdiCwUlYE2t6fg7ogKQb5UspFOnUodHcBIE6bBBSzoFRehJLZB7x9y_6RDSKIF7Y8EPbeds62jQ85b_hlUANAxQG7KBf2t53bbSJfLBRd329/UhXbKV48mU0u6bPK8xqZ3Blw2ETtxQuEzbiEhKYltsyhrwpb8QjJ0jQhvdcE_K_3ugxpRWFJcNpEhpzew0memQKERi7LoUOTkH9QNfRBvnSwxXI4_WnvOOe5bE1KtSL7_IL0Vw03FVEJohXeNYQHz4wTwkAQiTU2oUx1xnyiidVRu1-bRfjNXLgNVlUY4gQMALOZ_1sd7CLRqnWeFKx_hHomMNlgsBczgq6z69nPc1thHp7K5bY23F3p69c6wxPifcMTgvXQQh6G0IR8s9H7hIlwzHNqrQqhxj7yIDatwpp3Ix_HrNtp-pYBh7bHO5E-z3O6WzaAEktFCN29IcWuRohk2FjQojjnzkko51SLs6AkXcEXydAwYU_fw0TgGLFeMFNr_4Y7H_8nPiP2e061RbsJC6WhTM1lttWQKSiTFU1S4UCan7z0clYWbipHXii14nhZOFC_xKn2f5864AiDwDxJSjiGHjbay1-6Lj-upzrurCcPIrT2RwAJ6EIxXKM72jSxEpIBHFppXhonA9jpQYXA8XMch4c7?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=164
Protocol: HTTP/1.1
Server: 52.51.145.237 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (19C 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK gzTYWZ5fFusFVmgyA3_WRq9hHXuB7375ErXPnhtZmRLBUsYvBizVjI3lkmnKBOYGy3skeM7MlpFEhdOwTrCi_E0uBeVcJGWkXG1eBq6mrjGt47Niwm57IhngTGORNNsTQ09d1ZrItbvGZVWGwqS0BMCS3y-Nnws9lbXcSKqkmSfZZng9s57R3gQcNxu23T77w5RYC...
s.pubmine.com/passback/5Rk6H30eDvwLejUX1lCxbZ7vhfS_G1sS5m2Lb3kIPsaJ5q-3ZQd1WlmTIv71LGmkxTtpBfq0NBOiWX7GAq0IbEDQ_-sgxZWKOsw-suv1qTzOX5b5iyALfvqITKlaflBpaQJbWqDLAS3I0eS-yqTehqhwB9L8JNUY2GbbfQRcf4ck4I... 43 B
544 B 29ms
28ms Image
image/gif 52.51.145.237
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/5Rk6H30eDvwLejUX1lCxbZ7vhfS_G1sS5m2Lb3kIPsaJ5q-3ZQd1WlmTIv71LGmkxTtpBfq0NBOiWX7GAq0IbEDQ_-sgxZWKOsw-suv1qTzOX5b5iyALfvqITKlaflBpaQJbWqDLAS3I0eS-yqTehqhwB9L8JNUY2GbbfQRcf4ck4If4nw_fhwoJF2Iz-JmYrVt1iRW9qm0kKD-uLsbvbdsep9ALeE407ipbDuZf4_To64KIUEHO1mcKfxR1G_5BHtpClosxCLnDvtPhbx0yPJHx7guljS3-icotDmAWAdTFnRg4ZBbcm8jc7zg2o2sBV6orYRIHPziwu7SQDzRgPTxwFqtNbmvoy4pKiBh3GxnPYCaQIvAqmUS7-rjrtaMMEthR7C-iZa8Pdo73dgqusxil-qC191Xl4dnm5UHfUyUwckVy8-NUPZ56bPjxmj8YCNkuCZKJHbqw_MMNsmhrbdAXth_tGTbuiwsrmR5LKx2fPb4XFnudx6B-hi-hwwpxytsGTjGqBzolxJ8IQ07Wb3t_3jZk1yjq/gzTYWZ5fFusFVmgyA3_WRq9hHXuB7375ErXPnhtZmRLBUsYvBizVjI3lkmnKBOYGy3skeM7MlpFEhdOwTrCi_E0uBeVcJGWkXG1eBq6mrjGt47Niwm57IhngTGORNNsTQ09d1ZrItbvGZVWGwqS0BMCS3y-Nnws9lbXcSKqkmSfZZng9s57R3gQcNxu23T77w5RYCnOd-YWk8WJluGgAfSdPFp7eg1138UsvCwPI1ivBOK4pWmjG48-O_-ASeoF8acp3OINSg19Jxz21Orm9D_jV3ChEyTILR70fHVtb45B3Ke9y6qxL4pIeufr6evfh2NhGne3DoSw_nhWBeHEadNq7EcOg9rg60Axkw2FYUCiKkORpNJVOXOv4jbuSPyYQ7-O30md-NuuPysR-FOe9DMkMuFTO9toaVdNuCkD8P0_gavSg78hDfO3LHm8x7fn1lXRa0R3Tg7ivXITiz-8JkAkngmDhRq6vDPrt8JdsOhixmiw2KBFRUnU3AmrvnJBzF38Xv1fTTMvzht8nuH4DKMp7ohnEyjmk?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=163
Protocol: HTTP/1.1
Server: 52.51.145.237 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (15E 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
H/1.1 200
OK 3N4nu_XPd_FLA9NQzSTf0hH2EMxt4tNkBfjKNG7Fm7MBNcuyefeO9O_ld5pz93kGTX8zTSP_m_uJ9Hv9f9J0R105nhANZZp2pGzkuDdV2AdBKYuenjqXjVVoI12VR4aGQb-XxHLmtjkv01FtIXmrWbccsj6SNA6X-_MwCYXOByrEo-uu32HDhAJ2muzNnzgOMktmG...
s.pubmine.com/passback/UhXbKV48mU0u6bPK8xqZ3Blw2ETtxQuEzbiEhKYltsyhrwpb8QjJ0jQhvdcE_K_3ugxpRWFJcNpEhpzew0memQKERi7LoUOTkH9QNfRBvnSwxXI4_WnvOOe5bE1KtSL7_IL0Vw03FVEJohXeNYQHz4wTwkAQiTU2oUx1xnyiidVRu1... 43 B
544 B 31ms
31ms Image
image/gif 52.51.145.237
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/UhXbKV48mU0u6bPK8xqZ3Blw2ETtxQuEzbiEhKYltsyhrwpb8QjJ0jQhvdcE_K_3ugxpRWFJcNpEhpzew0memQKERi7LoUOTkH9QNfRBvnSwxXI4_WnvOOe5bE1KtSL7_IL0Vw03FVEJohXeNYQHz4wTwkAQiTU2oUx1xnyiidVRu1-bRfjNXLgNVlUY4gQMALOZ_1sd7CLRqnWeFKx_hHomMNlgsBczgq6z69nPc1thHp7K5bY23F3p69c6wxPifcMTgvXQQh6G0IR8s9H7hIlwzHNqrQqhxj7yIDatwpp3Ix_HrNtp-pYBh7bHO5E-z3O6WzaAEktFCN29IcWuRohk2FjQojjnzkko51SLs6AkXcEXydAwYU_fw0TgGLFeMFNr_4Y7H_8nPiP2e061RbsJC6WhTM1lttWQKSiTFU1S4UCan7z0clYWbipHXii14nhZOFC_xKn2f5864AiDwDxJSjiGHjbay1-6Lj-upzrurCcPIrT2RwAJ6EIxXKM72jSxEpIBHFppXhonA9jpQYXA8XMch4c7/3N4nu_XPd_FLA9NQzSTf0hH2EMxt4tNkBfjKNG7Fm7MBNcuyefeO9O_ld5pz93kGTX8zTSP_m_uJ9Hv9f9J0R105nhANZZp2pGzkuDdV2AdBKYuenjqXjVVoI12VR4aGQb-XxHLmtjkv01FtIXmrWbccsj6SNA6X-_MwCYXOByrEo-uu32HDhAJ2muzNnzgOMktmGqM4xLDa4chgnOApscXVdEEmSc290kdXd4VLiZTZLcn5bJOnq2jxzjxrz7rfYmOqSy81vKV9s8kiMM8kU5n5QniL6RvfhHhFtQWsjEp66clQPQI92yk9oMWxms27RlGFJhj_8LjBo46_t1PnmmbhPYDkpgKScfi3dTa2Sz2x6nHTzA4_jZVF2Oyd_K87kwPynCEQ_Zoy3e0Xxb-p19z_H3Lr9BZQFZEYqiN_ooHvJwkvWnNYAX1knt7DYyMlRVOUkwo6yPocy9V56UjAs6JA3PIQJ-UhmnZBco6mP3rNq_JIy-p_tPokPpYXPwm3ujhvFhRPVGFJt63S8vXH3hNfR17XGdCV?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=148
Protocol: HTTP/1.1
Server: 52.51.145.237 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame (352 67 KB
25 KB 17ms
17ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f9007a555c31577bacae597d3eb69b4c30b62a992b6222b77c2036433ae15eff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 22 Jan 2018 22:57:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
etag: 14780017265792457179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 25659
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:57 GMT

GET
H/1.1 200
OK aQorwNV3NQ7pKCQuC_ZOnGiDH4IpljUooMSF-8dykjEeQR_mlyWJajzOmyiX2gxEdhy_Dv0xVVWA6uUP-3QCbWebO4efCfmDu6EPZsec09ZkvvHzBdQeUbrkZYP6xholvQgibWksRtqrorApw46jde4j5CBtbXAALjPUSKYMo0439upcYyrcUWKxCarCnFSPRfxM9...
s.pubmine.com/passback/gzTYWZ5fFusFVmgyA3_WRq9hHXuB7375ErXPnhtZmRLBUsYvBizVjI3lkmnKBOYGy3skeM7MlpFEhdOwTrCi_E0uBeVcJGWkXG1eBq6mrjGt47Niwm57IhngTGORNNsTQ09d1ZrItbvGZVWGwqS0BMCS3y-Nnws9lbXcSKqkmSfZZn... 43 B
577 B 29ms
29ms Image
image/gif 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/gzTYWZ5fFusFVmgyA3_WRq9hHXuB7375ErXPnhtZmRLBUsYvBizVjI3lkmnKBOYGy3skeM7MlpFEhdOwTrCi_E0uBeVcJGWkXG1eBq6mrjGt47Niwm57IhngTGORNNsTQ09d1ZrItbvGZVWGwqS0BMCS3y-Nnws9lbXcSKqkmSfZZng9s57R3gQcNxu23T77w5RYCnOd-YWk8WJluGgAfSdPFp7eg1138UsvCwPI1ivBOK4pWmjG48-O_-ASeoF8acp3OINSg19Jxz21Orm9D_jV3ChEyTILR70fHVtb45B3Ke9y6qxL4pIeufr6evfh2NhGne3DoSw_nhWBeHEadNq7EcOg9rg60Axkw2FYUCiKkORpNJVOXOv4jbuSPyYQ7-O30md-NuuPysR-FOe9DMkMuFTO9toaVdNuCkD8P0_gavSg78hDfO3LHm8x7fn1lXRa0R3Tg7ivXITiz-8JkAkngmDhRq6vDPrt8JdsOhixmiw2KBFRUnU3AmrvnJBzF38Xv1fTTMvzht8nuH4DKMp7ohnEyjmk/aQorwNV3NQ7pKCQuC_ZOnGiDH4IpljUooMSF-8dykjEeQR_mlyWJajzOmyiX2gxEdhy_Dv0xVVWA6uUP-3QCbWebO4efCfmDu6EPZsec09ZkvvHzBdQeUbrkZYP6xholvQgibWksRtqrorApw46jde4j5CBtbXAALjPUSKYMo0439upcYyrcUWKxCarCnFSPRfxM9xsYWVqvdKxFSHX-jHPpE3WXErSxDlY6f3Gsh98nAepzDC4_te87W9a4gDvYCv6l9zOcbai-77u8tP34X5bCe0u5yLy2GiKqRu1m_X2T-0pPmF21bgaN0P42no4sUgQ451tQXCD124qAfnyTsLC81OxbOiIh0xasgAPBuW2Lf311qQp-TW3I_64jJy5zzZ6BsR4j9dAUyhBn6CjeVo8WLFkX8Rdq1NMEZtyA8lpBUVO23tVWpsK6BBCvq56_F-HkQ8oYmediXVAADMThFPHtgnRxOLnAJNtIeNJIvlhNmihXw0Obq-3DTZeMCXU2S8xQr0cjOHxiE6Kf7HeRK1D6BCEqmgiC?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=144
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 ca-pub-3443918307802676.js Show response
pagead2.googlesyndication.com/pub-config/r20160913/ Frame (352 133 B
191 B 6ms
6ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-3443918307802676.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 16:48:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 21 Jan 2018 21:19:57 GMT
server: sffe
age: 22156
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=43200
accept-ranges: bytes
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 125
x-xss-protection: 1; mode=block
expires: Tue, 23 Jan 2018 04:48:41 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (EE9 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
S 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame (BA0 67 KB
0 17ms
17ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f9007a555c31577bacae597d3eb69b4c30b62a992b6222b77c2036433ae15eff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 14780017265792457179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 25659
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:57 GMT

GET
H/1.1 200
OK M4RmnDcF9OxRNkQXqMEkxBZQD-xGLLL9NobmUA0VY6IDtDAflKP16m3swRe242RvwY8SLNi5pq36RY4YBmp72sCyL4u8zfGndyDaBsuFtmSvKLk2Du_P2FnVPhLWuvnXMCiHNJe6vhGTchsTr38Pk0YSDrTk81T-NhKBtiFO6Ojhw5-3__43UnE-nI92sIDKsKa-Q...
s.pubmine.com/passback/3N4nu_XPd_FLA9NQzSTf0hH2EMxt4tNkBfjKNG7Fm7MBNcuyefeO9O_ld5pz93kGTX8zTSP_m_uJ9Hv9f9J0R105nhANZZp2pGzkuDdV2AdBKYuenjqXjVVoI12VR4aGQb-XxHLmtjkv01FtIXmrWbccsj6SNA6X-_MwCYXOByrEo-... 43 B
577 B 29ms
28ms Image
image/gif 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/3N4nu_XPd_FLA9NQzSTf0hH2EMxt4tNkBfjKNG7Fm7MBNcuyefeO9O_ld5pz93kGTX8zTSP_m_uJ9Hv9f9J0R105nhANZZp2pGzkuDdV2AdBKYuenjqXjVVoI12VR4aGQb-XxHLmtjkv01FtIXmrWbccsj6SNA6X-_MwCYXOByrEo-uu32HDhAJ2muzNnzgOMktmGqM4xLDa4chgnOApscXVdEEmSc290kdXd4VLiZTZLcn5bJOnq2jxzjxrz7rfYmOqSy81vKV9s8kiMM8kU5n5QniL6RvfhHhFtQWsjEp66clQPQI92yk9oMWxms27RlGFJhj_8LjBo46_t1PnmmbhPYDkpgKScfi3dTa2Sz2x6nHTzA4_jZVF2Oyd_K87kwPynCEQ_Zoy3e0Xxb-p19z_H3Lr9BZQFZEYqiN_ooHvJwkvWnNYAX1knt7DYyMlRVOUkwo6yPocy9V56UjAs6JA3PIQJ-UhmnZBco6mP3rNq_JIy-p_tPokPpYXPwm3ujhvFhRPVGFJt63S8vXH3hNfR17XGdCV/M4RmnDcF9OxRNkQXqMEkxBZQD-xGLLL9NobmUA0VY6IDtDAflKP16m3swRe242RvwY8SLNi5pq36RY4YBmp72sCyL4u8zfGndyDaBsuFtmSvKLk2Du_P2FnVPhLWuvnXMCiHNJe6vhGTchsTr38Pk0YSDrTk81T-NhKBtiFO6Ojhw5-3__43UnE-nI92sIDKsKa-Q-YVy97wNtpJTUD2xWSHUrRl80YEDron-p-I5ZXDoDkEqzDR7Al0fbmQdysxQg-_we1PEXKFOOyHXll_e4-Eg5hEwm3UhkNpfrl93hJbTNdzKtnhSxyc4HNsNQTAv5CpUC5pOkskkG6Mauh-RS0wD03LS_qYf30KY-TDv-0ntheZ1dwt11WTeXqu_-JsNQszNQzPHDZSQko4lDYPNRSc2yCBs7Zg5MUKM_BrTJC8qPnw01epgO1Z_AMdpxAAGNiMWsLAX2rgY2gR8F5e1N8QhSTzVr4QR-vUYMfiabLZ7Ik68H94sAkUBmrQ46oVf1XpJGYvZ21UuFICI01RRp7Et2AP0e6v?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=141
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 ca-pub-3443918307802676.js Show response
pagead2.googlesyndication.com/pub-config/r20160913/ Frame (BA0 133 B
0 6ms
6ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-3443918307802676.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

sffe /

Resource Hash

7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 16:48:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 21 Jan 2018 21:19:57 GMT
server: sffe
age: 22156
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=43200
accept-ranges: bytes
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 125
x-xss-protection: 1; mode=block
expires: Tue, 23 Jan 2018 04:48:41 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/ Frame (11A 180 KB
0 24ms
24ms Script
text/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180116/r20180119/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 22 Jan 2018 22:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 438018244850507212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 68440
x-xss-protection: 1; mode=block
expires: Mon, 22 Jan 2018 22:57:56 GMT

GET
S 200 300x250_mrec_hiring.png
pubpress.net/houseads/2017/11/22/hiring/house/en/ Frame (352 12 KB
12 KB 131ms
131ms Image
image/png 192.0.78.13
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubpress.net/houseads/2017/11/22/hiring/house/en/300x250_mrec_hiring.png
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.78.13 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 9ab6997e26e2d0c9835bd784e4a3f1b4da548395709d422ea23be235f056f22f

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:58 GMT
x-ac: 1.fra _dfw
last-modified: Wed, 22 Nov 2017 15:13:51 GMT
server: nginx
etag: "5a15942f-3114"
content-type: image/png
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 12564
expires: Tue, 22 Jan 2019 22:57:58 GMT

GET
H/1.1 200
OK 5HSNIPiIQFgOzUkK8Cz30KlKQQaQPK5TwZQYHHUVj_PiADFC3eYkrLHhGhlgq7oMT72yXfqJKuXlT_3xHdBZrxzd6tNDISvPsvuh63IDE6BNwxHD2Gv3lMEdhdAMlBuVa4KjQmiaEdE_980JfpjTOvwHmwt5qzqrOQjqao8Qcqz0aBkYVyXXVkckdk3OMmKEX39Ln...
s.pubmine.com/passback/aQorwNV3NQ7pKCQuC_ZOnGiDH4IpljUooMSF-8dykjEeQR_mlyWJajzOmyiX2gxEdhy_Dv0xVVWA6uUP-3QCbWebO4efCfmDu6EPZsec09ZkvvHzBdQeUbrkZYP6xholvQgibWksRtqrorApw46jde4j5CBtbXAALjPUSKYMo0439u... 43 B
610 B 28ms
28ms Image
image/gif 52.51.125.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/aQorwNV3NQ7pKCQuC_ZOnGiDH4IpljUooMSF-8dykjEeQR_mlyWJajzOmyiX2gxEdhy_Dv0xVVWA6uUP-3QCbWebO4efCfmDu6EPZsec09ZkvvHzBdQeUbrkZYP6xholvQgibWksRtqrorApw46jde4j5CBtbXAALjPUSKYMo0439upcYyrcUWKxCarCnFSPRfxM9xsYWVqvdKxFSHX-jHPpE3WXErSxDlY6f3Gsh98nAepzDC4_te87W9a4gDvYCv6l9zOcbai-77u8tP34X5bCe0u5yLy2GiKqRu1m_X2T-0pPmF21bgaN0P42no4sUgQ451tQXCD124qAfnyTsLC81OxbOiIh0xasgAPBuW2Lf311qQp-TW3I_64jJy5zzZ6BsR4j9dAUyhBn6CjeVo8WLFkX8Rdq1NMEZtyA8lpBUVO23tVWpsK6BBCvq56_F-HkQ8oYmediXVAADMThFPHtgnRxOLnAJNtIeNJIvlhNmihXw0Obq-3DTZeMCXU2S8xQr0cjOHxiE6Kf7HeRK1D6BCEqmgiC/5HSNIPiIQFgOzUkK8Cz30KlKQQaQPK5TwZQYHHUVj_PiADFC3eYkrLHhGhlgq7oMT72yXfqJKuXlT_3xHdBZrxzd6tNDISvPsvuh63IDE6BNwxHD2Gv3lMEdhdAMlBuVa4KjQmiaEdE_980JfpjTOvwHmwt5qzqrOQjqao8Qcqz0aBkYVyXXVkckdk3OMmKEX39LnEiQyzzMj5lv6R3tSErNlHdEO_o33o8kGdZFXNk3t6so24uO0ckjmtEQMgdREXLvpkW5Br7V9xN2LczmnAXl9ZT6Wakf3aybvxG717R87mWQebVIjzgIcSv1SFT9tQX2qMmt_hwf9KkLy8pDpSskBYMb5UU0p_W-eAqk7scCjFRId5ZK_Cu73s8d0xyvtEpQ8k-qSCqGSbvjpL_Fq7byu57ZaphVjgO_kdBtr0Meb-xDyN2HxriS-mw6Ow7mrjn5By7mfegqHt_Nor1r2w9oFWHx7Qvaf1ha1v6mJqR0iuVJiFF_VBQYEJZN-WErVhhVUQ6cvALir1OjsG6cx3S1Suy5b9EB?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=232
Protocol: HTTP/1.1
Server: 52.51.125.50 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-125-50.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:57 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 300x250_mrec_blue_hiring.png
pubpress.net/houseads/2017/11/22/hiring/house/en/ Frame (BA0 15 KB
15 KB 134ms
133ms Image
image/png 192.0.78.13
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubpress.net/houseads/2017/11/22/hiring/house/en/300x250_mrec_blue_hiring.png
Requested by: Host: 0x4954.wordpress.com
URL: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
Protocol: SPDY
Server: 192.0.78.13 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: fa7f4fbb3368b7949ff2a01b0058ca675951c7661ef4b740219268f3d3037c58

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 22 Jan 2018 22:57:58 GMT
x-ac: 1.fra _dfw
last-modified: Wed, 22 Nov 2017 15:13:51 GMT
server: nginx
etag: "5a15942f-3cfc"
content-type: image/png
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 15612
expires: Tue, 22 Jan 2019 22:57:58 GMT

GET
H/1.1 200
OK rMa2H-d5i37N_DOBGsvj10tcgrFNOJ4lxhNlDPSaf_ZMKM7CccUTR07uOhPwS49tFTLBrd13d-VHqLMLseItO1JjzlEsez7nUXUeQWMvGXHTiokB0gGhC_-zleOJHLGDU_XF1gMytNT3pa-jYsOgIcaZ8u0HpfQH0Zrthd6CNviGYQ48db2u9r3lj4xlTgegCndsU...
s.pubmine.com/passback/M4RmnDcF9OxRNkQXqMEkxBZQD-xGLLL9NobmUA0VY6IDtDAflKP16m3swRe242RvwY8SLNi5pq36RY4YBmp72sCyL4u8zfGndyDaBsuFtmSvKLk2Du_P2FnVPhLWuvnXMCiHNJe6vhGTchsTr38Pk0YSDrTk81T-NhKBtiFO6Ojhw5... 43 B
577 B 29ms
28ms Image
image/gif 52.51.145.237
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/passback/M4RmnDcF9OxRNkQXqMEkxBZQD-xGLLL9NobmUA0VY6IDtDAflKP16m3swRe242RvwY8SLNi5pq36RY4YBmp72sCyL4u8zfGndyDaBsuFtmSvKLk2Du_P2FnVPhLWuvnXMCiHNJe6vhGTchsTr38Pk0YSDrTk81T-NhKBtiFO6Ojhw5-3__43UnE-nI92sIDKsKa-Q-YVy97wNtpJTUD2xWSHUrRl80YEDron-p-I5ZXDoDkEqzDR7Al0fbmQdysxQg-_we1PEXKFOOyHXll_e4-Eg5hEwm3UhkNpfrl93hJbTNdzKtnhSxyc4HNsNQTAv5CpUC5pOkskkG6Mauh-RS0wD03LS_qYf30KY-TDv-0ntheZ1dwt11WTeXqu_-JsNQszNQzPHDZSQko4lDYPNRSc2yCBs7Zg5MUKM_BrTJC8qPnw01epgO1Z_AMdpxAAGNiMWsLAX2rgY2gR8F5e1N8QhSTzVr4QR-vUYMfiabLZ7Ik68H94sAkUBmrQ46oVf1XpJGYvZ21UuFICI01RRp7Et2AP0e6v/rMa2H-d5i37N_DOBGsvj10tcgrFNOJ4lxhNlDPSaf_ZMKM7CccUTR07uOhPwS49tFTLBrd13d-VHqLMLseItO1JjzlEsez7nUXUeQWMvGXHTiokB0gGhC_-zleOJHLGDU_XF1gMytNT3pa-jYsOgIcaZ8u0HpfQH0Zrthd6CNviGYQ48db2u9r3lj4xlTgegCndsUshtqHCdYNXAYipThw9V3ZqxeQy1NfnghcQZd3yyM_UiJ6qPVjbP3TpnD43hKUV8y9awuD3l90nP9L6DXkLRbv5qBkq4Og9gVeOsLQbTE-6cs9EZA4IAHRtFgFfIxMJf0p_jUiNg9eYgj_2mxZ4eibmHjPxuJg_8a1Y62VMyhR6WzemyiVdTUT0VKTHqjeveE_Yd7Lkp4q5b3lfCLY7dn0qxjF_Oyvuh2yRKyZZ-oEfPxlNSGGKLjP4XjIYeoQRpFzv_IvjNaSgHUQ9tQZ4yk3ELd0FH2ifiRK7s3Ed7ZVBVVcUUH_99dDdWRtVcGZ6YoM4WQP5BZcE_lD-TFa6NNWCLYeUz?tuuid=d682256f-ea35-4f2c-8164-b23727dcdd0a&imp_delay=167
Protocol: HTTP/1.1
Server: 52.51.145.237 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-145-237.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://0x4954.wordpress.com/2017/10/07/dfir-adventures-cibercriminosos-usando-o-portal-do-magazine-voce/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 22 Jan 2018 22:57:58 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection: keep-alive
Content-Type: image/gif
Expires: Mon, 26 Jul 1997 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

121 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
0x4954.wordpress.com/	1970-01-19 06:48:53	Name: __ATA_tuuid Value: d682256f-ea35-4f2c-8164-b23727dcdd0a
.wordpress.com/	1970-01-18 13:17:43	Name: __utmb Value: 11735858.1.10.1516661875
.wordpress.com/	1970-01-18 13:17:42	Name: __utmt Value: 1
.wordpress.com/	1970-01-01 00:00:00	Name: __utmc Value: 11735858
.wordpress.com/	1970-01-18 17:40:29	Name: __utmz Value: 11735858.1516661875.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.wordpress.com/	1970-01-19 06:48:53	Name: __utma Value: 11735858.815674175.1516661875.1516661875.1516661875.1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://s1.wp.com/_static/??-eJyFztEKwjAMBdAfsquTiXsRv6XWOFKXtDbphn69HeiDMBQCgdzDJXZOBtmP5QJiQ517gfx4rybIxv4ChnDITqEh5A/2kRVYF0vxjCOYIpDdUG+16BpXXIqiBCIVraTfLyFPCPNfFkCT8zeTQfC5tJ7o2Hb9Yde3+24bXjRNW9I=(Line 9) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
0x4954.files.wordpress.com
0x4954.wordpress.com
1.gravatar.com
acuityplatform.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
bidder.criteo.com
c.amazon-adsystem.com
fonts.googleapis.com
fonts.gstatic.com
graph.facebook.com
ib.adnxs.com
p.skimresources.com
pagead2.googlesyndication.com
pixel.wp.com
public-api.wordpress.com
pubpress.net
r.skimresources.com
s.pubmine.com
s.skimresources.com
s0.wp.com
s1.wp.com
s2.wp.com
ssl.google-analytics.com
static.criteo.net
stats.wp.com
t.skimresources.com
www.linkedin.com
x.bidswitch.net
151.101.114.202
152.195.39.114
154.59.122.51
172.217.21.227
172.217.21.234
172.217.22.2
172.217.22.40
178.250.0.74
178.250.0.93
185.60.216.15
185.63.145.1
192.0.72.23
192.0.73.2
192.0.76.3
192.0.77.32
192.0.78.13
192.0.78.22
216.58.207.66
35.189.222.7
35.190.59.101
35.190.91.160
37.252.172.80
52.18.88.202
52.222.158.196
52.51.125.50
52.51.145.237
010bdb735d36e20e7ed8a7e9fa9e6e5e2244d417019f31ef40ef16717cd0d00a
05cac3da625c67d6a1d604f55951f0a8483a01943df479c461ccc404af2dc162
0dab369eac5fd3a06420395d02d292bc3e3ab0bf62add857c72804fd9f4edd35
1082ecb11860c93a45e52c5693be9f659f028f8ad817fb100023e248b4ba6418
10e517e8b51c6537dab165afd2dca0d898f05ea414d981df3a46170dfa301615
1b5c03a7b9aa1d582c0921d6e956be1c65e9d3facad66ceb1195b06433f3e9f9
21c557180f1bd074974eb41ae4228b6aa9c41234ab1729d780bc8f05761110bb
22e3ed76326727797d0674f25bc12130244fe064ddfe3d61c7dca22216ad4776
3a0e947b2b6e6872da2ec671697b0530f4d4781a8877a11bd781ebb1f652118f
3f10442336cd9b12279a4662345ca628aa1dc48b9993a7cc75c2077b6ecbaf6b
43a3248ab9def34eab9f71eb5a6739ed0aef96a9c345f12802d1863df9ceaa5b
463ebb3edd217c82afaab62ad647044d87a9265186474191fd15c9e3e72588cc
4b581e54bb54f425d06c914d1870407107dd9f784387e68c3b9eca82526e4700
4cf8b3e592e67531fde44159188a886f2e56113a128febe55231250d25df0ad0
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5c4a9209e1809a51624102bcb722b15d28f61cb39c5ce7339ccba02964a4abe7
65fd7f1dcc201363b6df4cef4483b5b301ffac7aafa16416bb1e5571f30a1ce3
75f4d05359fc78350e10a3f78aaf580fd035cc360b99c1102b5acb51efe86b33
7a0b7159a3bdadd77403f995671a8c3e8c2bac910c3fa4fa69d10574eed65ac1
7c2c58fc24e2d3458b88680cfad4577011697df9a1406808f2f7d8f46060d8a7
7d08e9159f7d2bf0835085cbd1ffb0252b0e11de45ed07db4447f8e63f181dbf
7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8
832725548d795757ce41ebce4040b992496239d405a7976e433033d271022217
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85718d963d3d06064712e29e09ba1893f97b09db5a5fa28fca27c211d0f5febc
8603592f37406bd84e7f472c3a32b6305fee3b2279ee78597da677c9021d9047
895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c
8be0d89f06f0b18b204e2859c5daf37cfcf650d5496b72d291455e4f4ff5494e
920c9189a522af2214445b9b592232c64c6bcb262bd4bcf1e1abad27c5cbe606
953f96d299a32fcd474c0bd7c74e99d5cbee880d19ac8e3f1e57b54a1440b77c
970a3fa15876d16dcc0fd70eb7c9ab44d733108b3ddca1a449edd0356c1b79a7
9ab6997e26e2d0c9835bd784e4a3f1b4da548395709d422ea23be235f056f22f
9f0c1dc7bb2b53b28e8df2fdc67c22fb762251a9e76f3784646572c13f9442d7
a1b1cb0dd12f778d936704d4a63f9334a4c4b43c2fa4b5d94de38eb7358309fb
a23b0327b8db0cfb2344d81d1b6834b4114922c5a56c53547e2518f96f7ddaff
a26fd52082f9c6c191e6f75ca86d82544f74ec979da9c64406a89bea6247a9e9
a5f5a5cec00015fc98365ade62a3dd226b324e88303062c4c09d69d21e885e2b
aa9f8739191350b92c1a71c928b94ab8b09ec951bb1364f8dc869bfe65b8b2f1
ab7e2ffdc04169e144920d681f782403d86113dd0a50dee1eb0522fb4c92375b
add29b6ab4fbfa628f9dfe8b67611787ffadc3889bf44af26fedfdc440ec3c26
b06822e9c8b5392044ab3a7371140f4e94234afcbd2edbc47e86ca3654170a1c
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
be7cef0dfc1388bb91a44b04ec2d930f93ef574027f2b59fb4e0b9e84f37853c
c70b54f83a13aeaae5b49d9787d79db666721ba8d9c877dc732023c47304f071
cb8943abdc046f98c2a74cbe013552f1ed2a5746fd76546ed63f60d32dd83615
d38b37159bf64d981602acc01541f1427cffa9479e4f3ef980e5f334ee688676
d97e34fc145348d4a23114c967238e74c1ddd2c65c06c9bdc85cb06b8aa5fce7
dba6b80aceb1267fd1ed564e08a983730d272813e9b3aff85dc365c65333dd66
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dfe6c59701da4889f21ed3d622b3a6dc993cbc32708b57e53f3ec683d2363d65
e0d049388e6ecb35f6b675f5fff7c34705fdb0c28df00324fec9ffc3a7a52978
e36c0f4b95e5d91e0f78e83cd39e0ed7ae2b5bf8f16ada6d6ff60e10b7d6dfd2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7f6a232138a2992064e3f39aae317a816a4b892340be34695e42089e0e95cdc
ebb712ab09629f6c76116536d644bebeadc843199e9763b0bdf25dafd8382e7d
ee49942f5be18c3e4b101a225bdd39c5ccc6c8e8e0ae4a2aa7ac24bee987fe6c
f1b69e0958e0df1147487eba8b471b27e364066170535e047fff533dce64ccfd
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f587f2eeda0e13d45a92fb6fe8ee588ef1990c46c94b6cf4c18d5393f7ba2b02
f9007a555c31577bacae597d3eb69b4c30b62a992b6222b77c2036433ae15eff
fa7f4fbb3368b7949ff2a01b0058ca675951c7661ef4b740219268f3d3037c58
fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
fcd8703b3e7b9c2ca321381a3fd246da6c442ce26a57a5b745546f66e14b4b28
fd03740f8d244dc223acd95c99ef2b201f0162342b360574c5318ad47e567bd0

0x4954.wordpress.com Open in urlscan Pro 192.0.78.13 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

125 Requests

7 %HTTPS

0 %IPv6

21 Domains

31 Subdomains

25 IPs

4 Countries

1104 kBTransfer

5775 kBSize

6 Cookies

7 Outgoing links

Redirected requests

125 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

0x4954.wordpress.com Open in urlscan Pro
192.0.78.13 Public Scan

Screenshot
Live screenshot

Full Image

125
Requests

7 %
HTTPS

0 %
IPv6

21
Domains

31
Subdomains

25
IPs

4
Countries

1104 kB
Transfer

5775 kB
Size

6
Cookies

125 HTTP transactions
3 data transactions